US Charges Five Over Alleged Russian Intelligence-Linked Terrorism Financing Network

Five individuals allegedly linked to Russian intelligence services have been charged in the United States with conspiring to finance terrorism and, in three cases, with conspiring to commit murder for hire, following an investigation into a network accused of arranging payments for attacks, surveillance and targeted killings.

The charges were unsealed on 15 September 2026 in the Southern District of New York. According to the indictment, the network operated from at least 2024 and was involved in efforts to support attacks against individuals and infrastructure in the United States and Europe. The alleged activities included recruiting individuals, arranging travel, conducting surveillance and providing or attempting to provide payments for targeted attacks. All five defendants remained at large when the charges were announced.

The defendants were identified as Yuri Khrameev, described by prosecutors as a former Russian intelligence colonel; Kirill Khrameev, described as an officer of Russia's Federal Security Service; Oemis Romagoza Durruthy; Yaidel Delgado Suarez; and Angel Eduardo Castro. Prosecutors allege that the first three played senior or coordinating roles within the network, while Durruthy was involved in coordinating travel and payments and Suarez was involved in recruitment.

The indictment describes a financial structure involving payments to individuals who were allegedly recruited to carry out activities on behalf of the network. Among the alleged activities were pre-operational surveillance and preparations for targeted killings. Prosecutors also allege that associates were commissioned to carry out or attempt acts of terrorism against civilian and military infrastructure in European countries that support, or are perceived by the network to support, Ukraine.

Cryptocurrency was allegedly used as one of the payment mechanisms. The indictment describes cryptocurrency being transferred in connection with an operation in Europe, as well as payments associated with travel and other operational activities. The alleged transactions formed part of a wider network in which individuals were recruited for specific assignments and received relatively small payments for carrying them out.

The case also includes allegations concerning activity in the United States. Prosecutors allege that members of the network attempted to recruit people inside the country to conduct surveillance and carry out targeted killings. The indictment further alleges that payments were offered to individuals for carrying out these activities.

The alleged use of cryptocurrency forms part of a broader pattern identified by authorities and researchers concerning Russian-speaking illicit finance networks. The UK's National Crime Agency has reported that Russian-speaking professional money laundering networks have been used by organised crime groups, Russian elites and state-linked actors to move funds and evade sanctions. The agency has also reported that such networks can use cryptocurrency alongside cash collection, overseas transactions and access to cryptocurrency exchanges.

The National Crime Agency's assessment states that investigations under Operation DESTABILISE have identified links between Russian-speaking money laundering networks and Russian intelligence-related activity. According to the agency, individuals associated with Russian intelligence services attempted to use a UK-linked network to provide funding to individuals involved in a Bulgarian espionage network. The agency has also reported that networks connected with the operation have facilitated the movement and conversion of criminal cash into cryptocurrency.

Separate research published in September 2026 has described the use of cryptocurrency brokers, informal cash networks and bank accounts in connection with alleged Russian sabotage activity in Europe. The research noted that payments can be relatively small and fragmented across multiple channels, with cryptocurrency forming one of several mechanisms through which funds can be transferred to individuals recruited for individual assignments.

The US indictment alleges that the network's activities extended beyond financial transfers to the organisation of physical operations. These included surveillance of potential targets, travel arrangements and attempts to arrange targeted killings. Three of the defendants face the additional charge of conspiracy to commit murder for hire.

The charges do not establish that any of the defendants committed the alleged offences. The US Attorney's Office has expressly stated that the allegations contained in the indictment are accusations and that the defendants are presumed innocent unless and until proven guilty. The defendants had not been taken into custody when the indictment was unsealed.

The case places cryptocurrency payments within a broader alleged financing network involving individuals, travel, recruitment and operational activity across several jurisdictions. The allegations described in the indictment remain subject to the US judicial process.

By fLEXI tEAM