**WASHINGTON — **Russian intelligence officers built what prosecutors call “a criminal network” of paid recruits to surveil and murder dissidents, including one on American soil, according to an indictment unsealed Tuesday in Manhattan federal court.
The indictment alleges that a Cuban recruiter working for Moscow offered a Venezuelan man living in the United States $40,000 to kill a prominent Russian dissident believed to be living in the Washington, D.C., area. Pressed by his “boss” for an answer, the recruiter wrote, “I have people in Mexico right now and they’re delayed.”
The alleged scheme closely resembles tactics that Iran’s Islamic Revolutionary Guard Corps and intelligence services have used against dissident expatriates and perceived military enemies in North America and Europe. It marks an urgent escalation in hybrid warfare by hostile states as the war in Ukraine and the conflict with Iran spill into Western cities.
In both cases, prosecutors describe agents who hire out their tasks on behalf of Russia or Iran, paying smaller sums to photograph a target's home or attack a consulate or a synagogue, and promising much larger ones to end a life. Iran has turned to established gangsters and sought hitmen from lethal Mexican cartels. The Russian network, according to the indictment, recruited largely through Cuban and Venezuelan intermediaries and claimed to have people in Mexico.
The Justice Department charged five men it says worked for the intelligence services of the Russian Federation. According to the indictment, the network has, since at least 2024, “endeavored to surveil and murder Russian dissidents residing in both Europe and the United States.” Prosecutors say it also committed and attempted acts of terrorism against civilian and military infrastructure in European countries aligned with Ukraine.
The indictment names three senior figures. Yuri Khrameev, 63, known as “Colonel Yuri,” is described as a former colonel in the Russian intelligence services.
His son, Kirill Khrameev, 27, is described as an officer in Russia’s Federal Security Service, known as the FSB.
Oemis Romagoza Durruthy, 35, is a Cuban national whom prosecutors call “an influential member of the Cuban diaspora living in Russia.” The indictment calls Yaidel Delgado Suarez, 35, a Cuban known as “Viking,” “a prolific recruiter for the RIS Network.”
Angel Eduardo Castro, 22, a Venezuelan, worked with him.
Prosecutors open the case with a history of the Kremlin’s killings abroad.
They cite the 2004 murder in Moscow of the journalist Paul Klebnikov and the 2006 polonium poisoning of Alexander Litvinenko in London. They cite the 2018 “novichok” nerve agent attack on Sergei Skripal and his daughter in England, and the 2019 killing in Berlin of Zelimkhan Khangoshvili, which a German court attributed to “state organs of the central government of the Russian Federation.”
The indictment then turns to Europe’s current accusations of sabotage.
It notes that a German investigation this month reportedly linked Russia’s military intelligence agency, the GRU, to a drone attack at Leipzig/Halle Airport. According to the German newspaper Die Welt, the drone was loaded with Semtex and came to rest beside a Ukrainian Antonov cargo plane on August 4 without exploding. Prosecutors quote Germany’s foreign minister calling the attack part of Russia’s “long series of attempts at destabilization, disinformation, threats, sabotage and aggression directed at Europe.”
The Washington plot unfolded this summer over an encrypted messaging application, in Spanish.
On July 29, according to the indictment, the Venezuelan, Castro, asked the recruit, "[d]o you have someone in Washington you trust?"
The Cuban, Suarez, then disguised the assignment in the language of a building job. "I need him to measure a plot of land and provide measurements," he said in a voice message. He promised between $1,000 and $1,500 for photographs and video of places connected to the target, identified in court filings only as Victim-1.
The recruit, identified as U.S. Resident-1, was wary.
On August 26, Castro wrote that his “friend,” meaning Suarez, was “asking for [U.S. Resident-1’s] number so he can go direct with you.”
The recruit answered: “That’s crazy. Can we talk through you so it gets disguised? Otherwise he tells me directly so they can connect the communications. You know they track everything here.”
But Suarez contacted him directly the same day.
He told the recruit how to film, said the job “has to be today or tomorrow,” and told him to delete their chat and be “discrete and do it from afar.”
Prosecutors say Suarez got the locations from Yuri Khrameev, the Russian military intelligence veteran, who claimed to have worked directly with Vladimir Putin years ago.
The recruit sent back the surveillance.
Suarez said he had paid Castro for it, then asked whether the recruit had “someone who wants to do construction,” which prosecutors say meant the murder, or would be “interested” himself.
Suarez and Castro had offered $40,000 to “eliminate” or “disappear” the dissident. When the recruit said he would “see if I can find the right people,” Suarez replied that he had another team ready, according to the indictment.
“Let me know as soon as possible because I have a chain and my boss has questions. I have people in Mexico right now and theyre delayed. I only need a response to know if someone can do the work.”
The indictment does not identify the people in Mexico or say whether they belonged to a criminal organization. Prosecutors say Suarez tried to recruit several other people in the United States to watch and kill Victim-1 and other targets in the country.
A year earlier, the same chain ran through Europe.
On June 24, 2025, Kirill Khrameev met an American citizen at the border between Estonia and Russia and paid him to photograph an address in Vilnius, Lithuania.
The younger Khrameev then put the American in touch with his “boss” who appeared on the messaging application as “Combat Colonel Yuri.”
Yuri Khrameev told the American he had worked with Vladimir Putin when they were young. He said a “bad guy” lived at the Vilnius address and offered about $25,000 to kill him.
He wanted photos or videos of the home “every 2-3 days.” The target, he said, was “spreading dirt about my country,” “distorting history” and “telling the media and the common people that the Russians are the aggressors.” He suggested “throwing a bottle of gasoline” or “sticking a knife” in the man.
The American refused. The colonel offered a “simpler job,” such as setting fire to a warehouse or throwing gasoline at an electrical substation.
His targets were “military facilities and dual-use facilities” in countries of “the NATO military bloc,” including “railway stations, fuel tanks, wagons with humanitarian aid to Ukraine, wagons with equipment, bus depots, tram depots, electronical substations, gas stations, industrial premises, any warehouses, and so on.”
All five men are charged with conspiracy to finance terrorism, which carries a maximum sentence of 20 years. Yuri Khrameev, Suarez and Castro also face a charge of conspiracy to commit murder for hire.
“These defendants allegedly operated as part of a global assassination network that reached into the United States, attempting to recruit U.S. citizens and foreigners to carry out killings at the behest of the Kremlin,” said Assistant Attorney General for National Security John Eisenberg.
The indictment’s structure closely mirrors a case The Bureau reported in May.
In that case, federal prosecutors in New York charged Mohammad Baqer Saad Dawood Al-Saadi, a 32-year-old Iraqi described as a high-level commander in Kata’ib Hizballah, the Iraqi proxy militia of Iran’s Revolutionary Guard.
According to the case, Al-Saadi’s network carried out a shooting at the United States consulate in Toronto on March 10, 2026, and a separate attack on a Toronto synagogue. Prosecutors say he admitted as much on a wiretapped call on March 20. The complaint also lists 18 terrorist attacks across Europe between March and April. Al-Saadi described paying for them through what The Bureau reported as “a cartel-style payment arrangement,” with money routed through exchange houses and a refund clause if an attack failed.
