US prosecutors say a network linked to Russian intelligence funded terrorism, recruited foreign operatives and planned killings in the United States and Europe.
Prosecutors in New York have charged people allegedly connected to Russia’s security services with financing terrorism and conspiring to carry out contract killings, including on US soil. The defendants are accused of operating through the RIS Network, paying for surveillance and murder plots in the US and abroad, and directing associates to attack civilian and military infrastructure in European countries supporting Ukraine, according to Deutsche Welle.
The case, reported on 16 September 2026, has exposed what American investigators describe as a foreign operations structure combining intelligence work with transnational organised crime. John Eisenberg, the assistant attorney general for national security, said the accused had sought to recruit US citizens and foreign nationals to carry out killings on behalf of the Kremlin.
A network built around deniable operatives
The allegations point to a change in the way Russian intelligence services conduct operations in western countries. After the mass expulsion of Russian diplomats, Moscow has increasingly relied on citizens of third countries and people connected to local criminal milieus to carry out sensitive tasks, rather than depending solely on official Russian personnel.
According to the US side, Federal Security Service officers recruited and coordinated operatives for surveillance, arson attacks and contract killings. The network allegedly drew on citizens of Cuba and Venezuela, as well as criminal figures, to build operational capacity in the US and Europe. Using people without an obvious connection to the Russian state can create distance between the organisers and the eventual perpetrators, while making it harder for investigators to establish the full chain of command.
The structure therefore went beyond conventional espionage. Its alleged activities included gathering information, setting fires and preparing violent attacks, with Russian intelligence officers remaining at the level of planning and coordination. That arrangement would allow Moscow to preserve an ability to operate abroad despite tighter scrutiny of Russian diplomatic activity.
Plans reached from European infrastructure to Washington
The geography and intended targets described in the case suggest a broad operational reach. The alleged plots included arson attacks against infrastructure in European states that support Ukraine and an attempt to arrange the killing of a Russian dissident in Washington, in the District of Columbia.
The planned assassination in the US capital represents a particularly serious escalation in the material. It indicates that Russian intelligence services were prepared to contemplate a violent operation on American territory, despite the prospect of direct confrontation with US authorities, criminal prosecution and severe measures in response.
American investigators say the network’s work was not limited to isolated acts by freelance criminals. The participation of Kirill Khramyeev, described as a serving FSB officer, and his father Yuri Khramyeev, a former Russian intelligence employee, is presented as evidence of a direct connection to Russia’s security structures. Their alleged involvement suggests that the services helped organise and coordinate operations, including surveillance and preparations for contract killings, rather than merely recruiting people after plans had been made.
A wider legal framework for pursuing Russian operations
The US decision to apply terrorism-financing provisions to a case involving the RIS Network carries significance beyond the individual defendants. It treats alleged sabotage, recruitment and contract killings organised with the involvement of Russian intelligence as part of transnational terrorist activity, rather than solely as separate criminal offences or acts of espionage.
That approach could give American prosecutors a broader basis for pursuing organisers, coordinators and financiers, even where they did not carry out the violence themselves. It also reflects the difficulty of confronting operations designed to conceal the role of the state behind foreign recruits and criminal intermediaries.
The case presents Russia’s use of deniable agents as both an operational adaptation and a means of reducing accountability. Outsourcing surveillance and attacks may complicate attribution, but the alleged links to serving and former intelligence officers place the question of state responsibility at the centre of the proceedings. The next test will be whether the US case can establish those links in court and show how far the network’s activity extended.
Should the US treat state-directed sabotage and contract killings primarily as terrorism, espionage or organised crime?
