The Matryoshka of Hybrid Warfare: Telegram, Salsa and Disposable Agents

Forget trench coats and dead drops. In Germany, attracting the attention of suspected Russian handlers may require something rather more 2026: praise Vladimir Putin online and wave a Russian flag outside the Bundestag.

RTL journalist Angelique Geray tried exactly that. For about a year, she lived online as “Katja”, a fictional pro-Russian influencer with a taste for Putin, Russian sailor shirts and conspicuous displays of Kremlin enthusiasm. Suspected handlers eventually contacted her, moved the conversation to Telegram and offered paid assignments. Bitcoin included.

The same week RTL published, an international team of journalists released its own investigation into a different recruitment network operating across Europe. At its centre was Oemis Romagoza Durruthy, a Cuban salsa and bachata teacher living in Russia whose online aliases were allegedly used to find people for jobs that ended in surveillance, arson and attempted sabotage.

Lithuanian prosecutors have linked the operation in Lithuania to Russia’s military intelligence service, the GRU. The journalists’ investigation connected Romagoza to attacks in Lithuania, Poland, Czechia and Romania between May and September 2024.

Nothing connects the two networks, but recruitment worked the same way in both: public platforms are used to identify potential recruits, private channels to assign tasks, and the people carrying out the work may know little about who is ultimately directing the operation.

Meet Katja, Putin Superfan and Entirely Fictional

Geray built Katja to look like a genuine member of Germany’s pro-Russian online scene. She praised Putin, appeared in a striped Russian sailor shirt and carried a Russian flag past the Bundestag.

RTL spent a year investigating how suspected Russian actors recruit people in Germany. Reporters posing as potential recruits received instructions through Telegram and were offered payment in Bitcoin. Katja provided another route into the same environment by creating a visible pro-Kremlin persona.

The first assignments would make for a disappointing spy thriller: photograph a location, obtain a SIM card, collect a package, each paid with a small sum in Bitcoin.

Those small jobs also test a recruit. Someone who completes an assignment, accepts payment and continues answering messages has already shown that another request may be worth sending.

RTL says later requests involved gathering information about politicians, defence companies and civil-society organisations. In another case examined by the broadcaster, suspected operatives allegedly monitored an executive whose company supplies drones to Ukraine.

The cheap photograph suddenly had more company.

Disposable Agents: Espionage by the Task

German security authorities call recruits used for individual assignments “disposable agents”.

They are not necessarily trained intelligence officers, committed supporters of Russia or even aware of who ultimately ordered the work. A recruit may know only the account sending instructions and the task immediately in front of them.

In September 2025, Germany’s Federal Criminal Police Office joined the country’s intelligence agencies in a public campaign warning people: “Don’t become a disposable agent.”

The agencies said Russian intelligence services were increasingly using social media, directly or through intermediaries, to recruit people for surveillance, vandalism, arson and other tasks.

Dividing an operation among several people has an obvious advantage. One recruit photographs a building, another obtains a SIM card, another handles transport, while none of them needs access to the full plan.

An arrest may therefore lead investigators to another Telegram account rather than to the person who designed the operation.

Katja had the structure of a matryoshka: journalist on the inside, Putin influencer around her, potential disposable agent on the outside. Russian hybrid operations can add a few more dolls – Telegram contact, paid task, intermediary, handler – until the person doing the job has no idea who is sitting at the centre.

A recent investigation involving Lithuania shows what some of those extra layers can look like.

One of them taught salsa.

From Salsa Classes to Sabotage Recruitment

Oemis Romagoza Durruthy was born in Cuba and has lived in Russia for years. In Petrozavodsk, he taught salsa and bachata, with photographs and videos of his classes openly available online.

Investigators found another set of identities connected to him.

A joint investigation by Lithuania’s LRT, Deutsche Welle, Spain’s RTVE and Czech Television linked accounts allegedly operated by Romagoza – including “Dios” and “Adrian” – to sabotage operations across Lithuania, Poland, Czechia and Romania in 2024.

According to Lithuanian investigators, he was one of three men who directed the operation in Lithuania, and the journalists’ investigation found that he coordinated and commissioned the attacks in all four countries. The organisers allegedly searched for people to carry out the crimes, arranged taxis and accommodation, and passed on information about the target company. They did not tell the recruits they were taking part in a GRU operation.

Recruitment took place largely through Telegram and Facebook.

Accounts linked to Romagoza posted in groups used by Cubans living in Russia, Latin Americans looking for work in Poland and people interested in travelling to the European Union. Some posts said only that the work was “hard work”. Others advertised loading and unloading jobs, or sought people with military experience in surveillance and logistics.

The offers did not announce themselves as intelligence work.

Someone looking for employment could respond to what appeared to be an ordinary job offer before learning what the work actually involved.

From Telegram to Šiauliai

In Lithuania, the target was TVC Solutions, a company in Šiauliai producing mobile radio-frequency spectrum-analysis stations, equipment that can also be used to detect drones and was intended for Ukraine.

The operation began with reconnaissance.

On September 2, 2024, investigators say Colombian-Russian dual national Gonzalo de Jesus Ramos Santos travelled to Lithuania, photographed and filmed the company’s premises and sent the material to Russia.

On September 17, two other men approached the site carrying an incendiary mixture in a mineral-water bottle. They left after being disturbed, fled to Latvia and were arrested there.

Five days later, another pair tried again.

A Russian and a Belarusian national who had arrived from Switzerland, taking a taxi from Vilnius airport straight to Šiauliai, set fire to the incendiary material near the equipment. The flames went out before damaging the stations, which were worth more than €1.5 million.

The perpetrators reportedly filmed themselves near the fire before leaving.

The following day, another recruit travelled to Šiauliai to photograph and document what had happened. Lithuanian police arrested her on September 24, as she was getting into a taxi to leave.

The operation had been divided into separate functions: reconnaissance, travel, attempted arson and documentation were handled by different people.

Several of them may have known little about what the others were doing.

Telegram Does More Than Carry Narratives

In both investigations the way in ran through Telegram groups, Facebook communities and a visible influencer profile, the same spaces where political narratives circulate.

Geray made Katja visible inside Germany’s pro-Russian information environment. Romagoza’s alleged accounts searched existing online communities for people looking for work or travel opportunities.

In both cases, public platforms created the first contact. The more specific interaction then moved into private channels.

That does not mean every pro-Russian Telegram account is a recruitment channel, or that members of such groups should be treated as potential agents. What matters is the relationship between accounts: who approaches whom, which profiles repeatedly appear around the same communities, and where conversations move next.

Narrative monitoring runs into a version of the same problem: the account you can see most easily is rarely the one that matters most.

A study of 3.1 million pieces of German content found narratives moving between Russian-language Telegram, German-language Telegram and TikTok, with some appearing on Telegram 12–48 hours before wider amplification.

The TikTok account with the largest audience may therefore tell you where a narrative became visible. An earlier Telegram channel may tell you where it started moving.

Follow the Network

A small account can be easy to dismiss when viewed on its own.

Geray’s Katja profile mattered because of the people who contacted it. A Facebook job advertisement matters differently once investigators identify the person behind the account. A photograph of an industrial site becomes more significant once someone establishes who requested it and what happened next.

Narrative analysis faces the same problem when it focuses only on the post with the most views.

Follower counts show reach. Timing and account relationships can show originators, intermediaries and amplifiers. A channel with a few thousand followers may matter more than a much larger account if it repeatedly publishes a narrative first and passes it into other communities.

That is also why cross-platform analysis matters. Telegram, TikTok and Facebook do not operate as separate information environments when the same people, claims or content move between them.

The useful unit of analysis is often the sequence rather than the individual post.

Before the Fire, Follow the Layers

Journalist Angelique Geray created “Katja”, a fake pro-Russian influencer, and waited to see who would approach her. In Lithuania, investigators later traced a sabotage network through online accounts and intermediaries to Oemis Romagoza Durruthy, a Cuban salsa teacher living in Russia.

The structure is almost matryoshka-like. On the outside: a social-media profile, a Telegram message, a job ad. Inside: a private chat, a paid task, an intermediary. Further in: the people actually directing the operation.

Before the Šiauliai attack, parts of the operation had in fact been noticed: police warned TVC Solutions that authorities were watching activity around its property, and patrols in the area were increased at the beginning of September. The profiles, job ads, taxi bookings and reconnaissance photographs all existed before the first bottle of flammable liquid did.

By the time an incendiary device appears, the network has already been active.

That is where narrative intelligence becomes useful: not simply counting the noise, but mapping the structure underneath it before it turns into action.