Cuban Dance Instructor Linked to EU Arson Plot for Russian Intelligence

Background of the Investigation

In early 2024, European law‑enforcement agencies noticed a pattern of coordinated arson attacks that targeted critical infrastructure in four member states. The incidents shared a common modus operandi: incendiary devices were placed in public buildings during low‑traffic hours, and the timing suggested a centralized command structure.

German public broadcaster DW Investigations began tracing the attacks after receiving a tip from a confidential source within the Russian embassy. Their analysis pointed to a single individual who appeared to be orchestrating the operations from abroad.

The Cuban Dance Instructor’s Role

The person identified by investigators is a Cuban national who worked as a Latin‑dance teacher in a studio located in Moscow. While teaching salsa and cha‑cha, he allegedly served as a logistical coordinator for the sabotage campaign.

According to the investigative report, the instructor used his studio as a cover to meet with operatives, exchange encrypted messages, and store materials needed for the arson devices. The dual identity allowed him to travel across Europe with a valid work visa, avoiding the scrutiny typically applied to intelligence officers.

Arson Attacks Across Four EU Nations

The four attacks took place in:

• Germany – a regional courthouse in Cologne was set ablaze, causing extensive damage to archives.
• France – a municipal power substation in Lyon suffered a fire that disrupted supply for several hours.
• Poland – a customs warehouse in Gdańsk was targeted, leading to the loss of stored goods.
• Spain – a cultural center in Barcelona was damaged, prompting the evacuation of nearby residents.

Each incident occurred within a two‑week window, suggesting a synchronized effort. The choice of public facilities indicates an intention to create both material loss and psychological impact.

Timeline of Events

1. January 12, 2024 – First fire reported in Cologne.
2. January 15, 2024 – Lyon substation incident.
3. January 18, 2024 – Gdańsk warehouse blaze.
4. January 20, 2024 – Barcelona cultural center attacked.

Following the fourth incident, Europol issued a joint alert, urging member states to increase vigilance at vulnerable sites.

Links to Russian Intelligence Services

Investigators uncovered communications between the Cuban instructor and a handler believed to be linked to the Russian Foreign Intelligence Service (SVR). The messages, exchanged via a secure messaging app, referenced “operations” and “logistics” without explicit mention of the target locations.

European security officials have not publicly identified the Russian officer, but they confirmed that the coordination fit the known tactics of Russian covert actions aimed at destabilising EU member states.

EU Response and Legal Actions

The European Commission released a statement condemning the attacks and announcing a coordinated response. The statement highlighted the need for stronger cross‑border intelligence sharing and the allocation of additional resources to counter foreign‑directed sabotage.

National prosecutors in Germany and France have opened criminal investigations under their respective anti‑terrorism statutes. The Cuban instructor was placed on an international wanted list, and Interpol issued a Red Notice to facilitate his apprehension.

For more details on the EU’s legal framework for counter‑terrorism, see the European Commission’s official press release.

Implications for International Security

This case illustrates how cultural institutions can be exploited for espionage purposes. The use of a dance studio as a front challenges traditional risk‑assessment models that focus on diplomatic or military venues.

Analysts at the Brookings Institution note that the blending of civilian professions with intelligence work creates a “gray zone” that complicates detection.

In response, EU member states are reviewing visa‑screening procedures for foreign nationals employed in sectors that provide frequent cross‑border travel. The incident also raises questions about the effectiveness of current counter‑intelligence cooperation between NATO allies and the European Union.

While the investigation continues, the broader lesson remains clear: unconventional cover occupations can mask hostile activities, and security agencies must adapt to these evolving threats.