US charges five in alleged Russian intelligence network for contract killings and sabotage

Why it matters

The indictment alleges that a network linked to Russian intelligence services operated across the United States and Europe to hunt Kremlin opponents and to plan sabotage against countries supporting Ukraine. US officials have publicly tied the operations to Moscow, with Assistant Attorney General for National Security John Eisenberg saying the defendants acted at the direction of the Kremlin. The case names planned targets on US soil and in Lithuania and links the network to earlier attacks in the Czech Republic and Lithuania, expanding the documented geography of alleged Russian covert action beyond Ukraine. All five defendants remain at large, and three face murder-for-hire charges in addition to terrorism-financing charges carrying up to 20 years.

What happened

On September 16, US Attorney General Todd Blanche announced that the Department of Justice had unsealed an indictment in the Southern District of New York charging five people with conspiracy to finance terrorism. Three of them — Yuri Khrameyev, Kirill Khrameyev and Oemis Romagosa Durruti — are described as high-ranking members of a network referred to in the indictment as "RIS." The other two, Yaidel Delgado Suarez and Angel Eduardo Castro, are described as recruiters. Yuri Khrameyev, 63, is identified as a former colonel of Russian special services; his son Kirill, 27, is identified as an FSB officer. Durruti is a Cuban citizen residing in Russia; Suarez, 35, is a Cuban citizen with the alias "Viking"; Castro, 22, is a Venezuelan citizen.

Prosecutors say the network tracked Russian dissidents in the United States and Europe starting in 2024 and recruited or tried to recruit people to carry out killings and sabotage. In the summer of 2026, Suarez and Castro offered a US resident $40,000 to "eliminate" or make "disappear" a prominent Russian dissident based in Washington, designated "Victim-1," whose identity was not disclosed. In 2025, the network approached another US citizen and offered about $25,000 through Yuri Khrameyev to kill a Russian opposition figure living in Lithuania, designated "Victim-2." When that recruit refused, Khrameyev offered "easier work": setting fire to a warehouse or throwing a Molotov cocktail at an electrical substation, framed as attacking "all countries helping Ukraine."

Earlier operations attributed to the network include a June 2024 arson on buses in Prague, for which a Colombian citizen was arrested on the spot and sentenced to eight years, and a foiled 2024 arson attempt at the TVC Solutions facility in Šiauliai, Lithuania, which produces equipment for Ukraine. All five defendants are charged with conspiracy to finance terrorism, carrying up to 20 years; Yuri Khrameyev, Suarez and Castro also face conspiracy to commit murder-for-hire. All five remain at large.

How Ukrainian sources describe it

All sources for this story are Ukrainian-language media outlets. Coverage consistently frames the network as targeting "allies of Ukraine" or countries "helping Ukraine," foregrounding the sabotage dimension and the cross-border character of the alleged Russian intelligence operations rather than the dissident-hunting motive alone. Ukrainian outlets also highlight the indictment's references to earlier attacks in Prague and Lithuania and to a facility that produces equipment for Ukraine, presenting the case as further evidence of Russian covert action aimed at Ukraine's supporters.

Where reporting differs

Sources differ on the date of the public announcement: most place it on September 16, when Attorney General Todd Blanche addressed the indictment, while at least one source dates the announcement to September 15. Officials also framed the chain of command differently — Blanche said the defendants acted at the direction of Russian intelligence services, while Eisenberg said they acted at the direction of the Kremlin. Reporting on the network's internal hierarchy consistently names Yuriy Khrameyev, Kirill Khrameyev and Oemis Romagosa Durruti as the three "high-ranking" members, but some accounts shift or overlap the roles of Suarez and Castro between recruiter and operational coordinator.

Background

The indictment traces the network's activity to 2024 and ties it to earlier sabotage operations, including a June 2024 arson on buses in Prague — for which a Colombian citizen was detained at the scene, sentenced to eight years, and described by Czech authorities as likely recruited by Russia — and a foiled 2024 arson attempt at the TVC Solutions facility in Šiauliai, Lithuania, which produces equipment for Ukraine. The two planned killings identified in the indictment involved a dissident in Washington ("Victim-1") and a dissident in Lithuania ("Victim-2"); neither identity has been disclosed publicly. In the summer of 2026 the network offered $40,000 for Victim-1 and $25,000 for Victim-2, and discussed fallback sabotage tasks — arson at warehouses and Molotov-cocktail attacks on electrical substations — directed at countries helping Ukraine.