DOJ Unmasks Kremlin Assassination and Sabotage Network on Western Soil

Father-son FSB operatives allegedly recruited U.S. and European nationals to surveil, kill, and sabotage targets tied to Ukraine's Western support network.

Intelligence Lead

The U.S. Department of Justice unsealed an indictment late on 16 September charging five individuals with operating a Russian intelligence-directed network tasked with murder-for-hire and terrorism financing across the United States and Europe. The case, led by a retired Russian intelligence colonel and his serving FSB-officer son, confirms Moscow's continued willingness to direct lethal operations against dissidents on U.S. and allied soil, and represents one of the most significant public disruptions of Russian covert action reported this year.

Situation Report

Prosecutors in the Southern District of New York confirmed charges against Yuri Khrameev, 63, a former colonel in Russia's intelligence services; his son Kirill Khrameev, 27, a serving FSB officer; Oemis Romagoza Durruthy, 35, a Cuban national resident in Russia; Yaidel Suarez, also Cuban; and Angel Eduardo Castro, 22, a Venezuelan national. All five remain at large. The Justice Department assessed the network as "one arm of the Russian Federation's apparatus used to carry out external attacks" and charged the group with conspiracy to finance terrorism, a count carrying up to 20 years in prison; three defendants face an additional murder-for-hire conspiracy charge.

The indictment reports that, as recently as this summer, Castro was recruited to surveil a prominent Russian dissident residing in Washington, D.C. Prosecutors allege the network paid U.S.-based recruits to conduct surveillance and identify individuals willing to carry out targeted killings domestically.

A separate strand documents an alleged 2025 plot against a Kremlin critic reported to be living in Vilnius, Lithuania. According to the indictment, an American recruit met Kirill Khrameev at the Estonia-Russia border in late June 2025, where he was asked to photograph the target's residence and report back every two to three days via encrypted messaging. Yuri Khrameev is alleged to have then offered the recruit $25,000 to kill the target, reportedly citing the dissident's public criticism of Russia's role as "the aggressors" in Ukraine.

Beyond assassination, prosecutors allege the network was tasked with recruiting individuals willing to commit acts of sabotage against civilian and military infrastructure in countries supporting Kyiv, extending the group's remit from targeted killing into broader hybrid-attack facilitation.

Background & Context

The indictment lands within an established pattern of Russian hybrid activity against Western states since the full-scale invasion of Ukraine in 2022. European security services have documented a rising tempo of GRU- and FSB-linked sabotage since 2023, including arson attacks, parcel-bomb plots, and rail-network interference across Poland, Germany, the Baltic states, and the UK, largely attributed to disposable proxy recruits rather than trained intelligence officers.

The reliance on Cuban and Venezuelan nationals as operational cut-outs reflects an adaptation in Russian tradecraft under sustained Western counterintelligence pressure. With traditional "illegals" networks increasingly exposed and expelled since 2022, Russian services appear to be outsourcing higher-risk surveillance and recruitment tasks to non-Russian nationals with lower counterintelligence visibility, limiting exposure of career intelligence officers while retaining deniability for Moscow.

This case follows a string of comparable disruptions across NATO states over the past two years naming Russian-linked networks in sabotage and recruitment plots, suggesting a sustained, rather than episodic, campaign.

Analysis & Assessment

This disruption is assessed as significant less for its scale than for its geography: a Russian-directed lethal-action plot reaching Washington, D.C. itself signals a materially elevated risk tolerance in Moscow's covert posture toward the U.S. homeland, a threshold historically treated as a red line even during periods of acute great-power friction.

Moscow will almost certainly deny state involvement and frame the indictment as a politically motivated provocation timed to domestic U.S. and European audiences. Given the pattern of proxy recruitment documented here, further indictments or expulsions tied to the same or adjacent networks are considered likely in the coming weeks as U.S. and European services compare notes on shared targets and recruitment methods.

Expect a probable hardening of protective security around prominent Russian dissidents in Washington, London, and Vilnius, and a plausible acceleration of coordinated EU and Five Eyes efforts to formalize threat-sharing on Russian hybrid operations, building on frameworks already under discussion since the 2023–2025 sabotage wave.