US prosecutors exposed a Russian intelligence-linked sabotage network operating in Latvia and Lithuania targeting pro-Ukraine infrastructure. Arrests in Riga were part of a transnational sting involving operatives recruited via social media and coordinated by former Russian officers.

Military & Paramilitary OperationsUnconventional / ParamilitaryProxy forces, militias, mercenaries (e.g. Wagner-type groups)

Aggressor

Summary

In September 2024, a Russian intelligence-linked sabotage network known as the RIS Network was accused by US prosecutors of orchestrating attacks against targets supporting Ukraine. The network recruited and sent operatives, including Latin American nationals, to carry out arson attacks and reconnaissance in Baltic states, including Latvia and Lithuania. Suspected perpetrators were arrested in Riga following a failed arson attempt on Lithuanian company TVC Solutions, which supplied equipment to Ukrainian forces. The network used layered recruitment, starting with low-risk intelligence gathering and escalating to violent sabotage or assassination. Operatives known as 'one-time agents' were recruited via social media and promises of employment, with limited direct contact with Russian intelligence. The Riga arrests were part of a joint operation between Latvian and Lithuanian security agencies. Key figures include former Russian intelligence colonel Yuri Khrameev and his son Kirill Khrameev, along with Oemiss Romagoza Durruti, a Cuban living in Russia who coordinated logistics and recruitment from Petrozavodsk. The network targeted infrastructure across NATO countries and maintained communication via Telegram. This case illustrates hybrid warfare tactics involving covert infiltration, recruitment, and sabotage within allied states.

Classification

Confidence: High

The signal clearly documents hostile covert operational activity by actors aligned with Russian intelligence, including recruitment, reconnaissance, and attempted sabotage within NATO member states Latvia and Lithuania.

Source URL

https://kompromat.lv/item.php?docid=readn&id=9778

Open source

Provenance

Publisher: extension
Submitted: Sep 28, 2026, 07:04 UTC
Last updated: Nov 8, 2026, 15:08 UTC
Event time: Sep 17, 2024, 00:00 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "c88c62e0-5bde-4804-8183-e4c940ce0535",
  "url": "https://kompromat.lv/item.php?docid=readn&id=9778",
  "source": "extension",
  "status": "processed",
  "category": "Military & Paramilitary Operations",
  "subcategory": "Unconventional / Paramilitary",
  "incident_type": "Proxy forces, militias, mercenaries (e.g. Wagner-type groups)",
  "country": "Latvia",
  "source_reliability": "F",
  "info_credibility": "6",
  "tags": [
    "RIS Network",
    "russian intelligence operations",
    "hybrid warfare",
    "Latvia",
    "Lithuania",
    "sabotage",
    "arson",
    "Russian special services",
    "recruitment",
    "social media",
    "Telegram",
    "proxy forces",
    "counterintelligence",
    "NATO infrastructure",
    "Ukraine support"
  ],
  "nodes": [],
  "countries": [],
  "where_text": "Land",
  "headline": null,
  "description": "In September 2024, a Russian intelligence-linked sabotage network known as the RIS Network was accused by US prosecutors of orchestrating attacks against targets supporting Ukraine. The network recruited and sent operatives, including Latin American nationals, to carry out arson attacks and reconnaissance in Baltic states, including Latvia and Lithuania. Suspected perpetrators were arrested in Riga following a failed arson attempt on Lithuanian company TVC Solutions, which supplied equipment to Ukrainian forces. The network used layered recruitment, starting with low-risk intelligence gathering and escalating to violent sabotage or assassination. Operatives known as 'one-time agents' were recruited via social media and promises of employment, with limited direct contact with Russian intelligence. The Riga arrests were part of a joint operation between Latvian and Lithuanian security agencies. Key figures include former Russian intelligence colonel Yuri Khrameev and his son Kirill Khrameev, along with Oemiss Romagoza Durruti, a Cuban living in Russia who coordinated logistics and recruitment from Petrozavodsk. The network targeted infrastructure across NATO countries and maintained communication via Telegram. This case illustrates hybrid warfare tactics involving covert infiltration, recruitment, and sabotage within allied states.",
  "summary_short": "US prosecutors exposed a Russian intelligence-linked sabotage network operating in Latvia and Lithuania targeting pro-Ukraine infrastructure. Arrests in Riga were part of a transnational sting involving operatives recruited via social media and coordinated by former Russian officers.",
  "summary_extended": null,
  "actor_primary": "Russian Intelligence Services Network (RIS Network)",
  "target_primary": null,
  "location_text": "Riga, Latvia and locations in Lithuania including Šiauliai and Vilnius",
  "location_region": null,
  "location_coordinates_lat": 56.879635,
  "location_coordinates_lon": 24.603189,
  "location_precision": "Exact",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The signal clearly documents hostile covert operational activity by actors aligned with Russian intelligence, including recruitment, reconnaissance, and attempted sabotage within NATO member states Latvia and Lithuania.",
  "event_time_utc": "2024-09-17T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "pm24h",
  "created_at": "2026-09-28T07:04:02.504Z",
  "updated_at": "2026-11-08T15:08:23.974Z",
  "reliability_band": "pattern",
  "location_precision_band": "exact",
  "time_precision_band": "within_24h",
  "severity_band": "moderate",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}

Public assessmentReliability: Pattern fitSeverity: ModerateAttribution: HighSingle sourceTime: Same dayLocation: Exact

Source reliability

Info credibility

Event time

Sep 17, 2024, 00:00 UTC

Event time confidence

pm24h

Location

Riga, Latvia and locations in Lithuania including Šiauliai and Vilnius

Primary actor

Russian Intelligence Services Network (RIS Network)

Country

Latvia

Tags

RIS Network, russian intelligence operations, hybrid warfare, Latvia, Lithuania, sabotage, arson, Russian special services, recruitment, social media, Telegram, proxy forces, counterintelligence, NATO infrastructure, Ukraine support

Loading signal...

{ "id": "c88c62e0-5bde-4804-8183-e4c940ce0535", "url": "https://kompromat.lv/item.php?docid=readn&id=9778", "source": "extension", "status": "processed", "category": "Military & Paramilitary Operations", "subcategory": "Unconventional / Paramilitary", "incident_type": "Proxy forces, militias, mercenaries (e.g. Wagner-type groups)", "country": "Latvia", "source_reliability": "F", "info_credibility": "6", "tags": [ "RIS Network", "russian intelligence operations", "hybrid warfare", "Latvia", "Lithuania", "sabotage", "arson", "Russian special services", "recruitment", "social media", "Telegram", "proxy forces", "counterintelligence", "NATO infrastructure", "Ukraine support" ], "nodes": [], "countries": [], "where_text": "Land", "headline": null, "description": "In September 2024, a Russian intelligence-linked sabotage network known as the RIS Network was accused by US prosecutors of orchestrating attacks against targets supporting Ukraine. The network recruited and sent operatives, including Latin American nationals, to carry out arson attacks and reconnaissance in Baltic states, including Latvia and Lithuania. Suspected perpetrators were arrested in Riga following a failed arson attempt on Lithuanian company TVC Solutions, which supplied equipment to Ukrainian forces. The network used layered recruitment, starting with low-risk intelligence gathering and escalating to violent sabotage or assassination. Operatives known as 'one-time agents' were recruited via social media and promises of employment, with limited direct contact with Russian intelligence. The Riga arrests were part of a joint operation between Latvian and Lithuanian security agencies. Key figures include former Russian intelligence colonel Yuri Khrameev and his son Kirill Khrameev, along with Oemiss Romagoza Durruti, a Cuban living in Russia who coordinated logistics and recruitment from Petrozavodsk. The network targeted infrastructure across NATO countries and maintained communication via Telegram. This case illustrates hybrid warfare tactics involving covert infiltration, recruitment, and sabotage within allied states.", "summary_short": "US prosecutors exposed a Russian intelligence-linked sabotage network operating in Latvia and Lithuania targeting pro-Ukraine infrastructure. Arrests in Riga were part of a transnational sting involving operatives recruited via social media and coordinated by former Russian officers.", "summary_extended": null, "actor_primary": "Russian Intelligence Services Network (RIS Network)", "target_primary": null, "location_text": "Riga, Latvia and locations in Lithuania including Šiauliai and Vilnius", "location_region": null, "location_coordinates_lat": 56.879635, "location_coordinates_lon": 24.603189, "location_precision": "Exact", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The signal clearly documents hostile covert operational activity by actors aligned with Russian intelligence, including recruitment, reconnaissance, and attempted sabotage within NATO member states Latvia and Lithuania.", "event_time_utc": "2024-09-17T00:00:00.000Z", "end_time_utc": null, "event_time_confidence": "pm24h", "created_at": "2026-09-28T07:04:02.504Z", "updated_at": "2026-11-08T15:08:23.974Z", "reliability_band": "pattern", "location_precision_band": "exact", "time_precision_band": "within_24h", "severity_band": "moderate", "attribution_confidence_band": "high", "attribution_basis": "single_source" }