Intelligence Research Special - GRU Assassinations File

Başlatan Karabasan, Şub 21, 2020, 09:33 ÖS

« önceki - sonraki »


Şub 21, 2020, 09:33 ÖS Last Edit: Şub 21, 2020, 10:03 ÖS by Karabasan
The first analyzes on the subject
I pass the first analyzes because the subject is very "fresh" and the analyzes are very simple.

Skripal Poisoning Suspect's Passport Data Shows Link to Security Services /September 14, 2018

Skripal Suspects Confirmed as GRU Operatives: Prior European Operations Disclosed /September 20, 2018

Wagner Mercenaries With GRU-issued Passports: Validating SBU's Allegation  January 30, 2019

At a Monday press conference in Kyiv, Ukraine, the Ukrainian Security Agency (SBU) announced that it had intercepted passenger manifests from Russian MoD-chartered airliners transporting mercenaries working for Wagner, a Russian private military company (PMC). The manifests, involving flights from Russia to several African and Middle-East destinations in the latter half of 2018, allegedly transported a total of 1012 mercenaries to Sudan, CAR and other African destinations.

The most explosive allegation made at the press conference by the SBU was that PMC Wagner's mercenaries were issued Russian international travel passports in sequential batches by -- and this is crucial -- a single Moscow-based passport desk that had issued fake identity papers to undercover GRU officers Mishkin/Petrov and Chepiga/Boshirov.

Bellingcat first reported in September 2018 that this passport desk, known as Central Migration Office Unit 770-001 ("Unit 770001"), is routinely used to issue domestic passports to GRU undercover officers, such as the Salisbury poisoning suspects and two unrelated GRU undercover officers indicted by Montenegro over the alleged 2016 coup attempt in that country. Bellingcat and other organizations later established that this passport desk also issued Russian passports to a handful of foreign VIPs freshly bestowed with Russian citizenship, people such as French actor Gerard Depardieu.

Bellingcat has subsequently discovered that this same office had also issued passports to Russian civilians with links to the Russian Ministry of Defense -- either through direct employment or via a close family member.

The SBU's allegations are significant in that, if proven true, they would implicate the Russian government in not simply tolerating Wagner's overseas military operations (which are actually illegal under Russian law), but in being actively involved in the facilitation of such black ops.

Furthermore, the fact that (apart from a handful of foreign VIPs), Unit 770001 has only been known to issue passports to people linked to the Ministry of Defense, the mass issuance of passports to PMC mercenaries by this same office would provide the strongest documentary linkage so far between Russia's MoD and the illegal private army.

Given the high stakes raised by the SBU's allegations, Bellingcat set out to independently verify these explosive claims.

Following the press conference, the SBU published three sets of lists of alleged PMC Wagner mercenaries. The first two lists included names, dates, and places of birth, as well as domestic and international passport numbers of sixteen alleged Wagner mercenaries, seven of whom were said to hold international passports issued in one "series" in 2015, and another nine with such issued in 2017. Notably, the lists included names with birth places from all over Russia, while the passport issuing authority -- in all cases, SBU claimed -- was the Moscow-based Unit 770001.

The third list, which was the longest, included only the names and birth dates of 149 alleged PMC Wagner mercenaries, who, the SBU claimed, had been deployed in Sudan in late 2018 and early 2019. SBU specified that the first two lists were subsets of the larger list of 149 people.


As Bellingcat does not have access to the database of international passports issued by passport unit 770001, it was impossible to immediately validate the SBU's claim that these alleged mercenaries had received passports from this agency. The passport numbers were consistent with those identified by us in a number of confirmed GRU undercover officers' passports, and the sequence of numbers for the two years fit into the timeline of other passports issued before and after 2015 as previously reviewed by Bellingcat.

The SBU's allegations could be substantially confirmed via indirect means. We started by taking a random sample of names from the first and second SBU list, which included both international and domestic passport numbers of alleged PMC mercenaries.

As part of our investigation into the Salisbury poisoning suspects, we had acquired a copy of a leaked database of domestic air travel bookings in Russia dating from 2014 to 2016. This database, which can be acquired from a number of torrent sites and database vendors in Russia, has proven to be accurate but not comprehensive, as it does not necessarily include all air-travel in this period.

We attempted to locate several randomly selected domestic passport numbers from the SBU's list in the air-travel database. We also tried to find names from the long list of 149 names that did not contain passport data; in this case we searched for full name and birthdate matches.

Out of eleven attempts, we were successful in finding seven of the names from the SBU's list in the domestic air-travel data.  Of these, three were matched by (domestic) passport numbers, and four by full name and birth date.

A startling observation from the resulting dataset was one destination that overlapped in all of the domestic air-travel records for the seven individuals involved. All seven had a very limited air-travel history, but each had taken at least one flight with the destination being Pashkovsy airport.

In many cases, Pashkovsky was the only destination they had traveled to. Typically, the travel pattern included travel from Moscow or St. Petersburg to Pashkovsky, preceded by a flight to Moscow or St. Petersburg from a different Russian region, typically overlapping with the person's home area.

Pashkovsky is the main airport serving Russia's southern city of Krasnodar. Notably, PMC Wagner's main training camp is based at the village of Molkino, as reported by Russian investigative media. Molkino is approximately a 30-minute drive from Pashkovsky.

Notably, we were able to identify flights on which several of the persons identified by the SBU had traveled to or from Pashkovsky airport in a group.

As Russians traveling on domestic flights typically use their internal passports, rather than their international travel passports, we could not directly verify the SBU's claim that the listed mercenaries were issued international passport numbers from the 770001 Unit in Moscow.

However, this allegation was indirectly confirmed when we checked if any travelers having international passports from the same number series as those on the SBU lists had made domestic trips using such documents. Indeed, we identified two such travelers. Notably, they had both travelled (only) between St. Petersburg and Pashkovsky on such passports. St. Petersburg is the home base of U.S.-sanctioned Yevgeny Prigozhin, commonly known in media parlance as "Putin's Chef." Prigozhin is a catering provider to Russia's Ministry of Defense and other government bodies and is widely believed to be the financial sponsor of PMC Wagner.

Our finding indirectly validates the SBU's allegation that the names identified at the press conference belong to PMC Wagner staff, and that at least some people among PMC Wagner operatives have passports from the same office that issued GRU undercover identity papers.

Previous links between PMC Wagner and GRU were evidenced by an intercepted phone call between a high-ranking GRU officer and the chief executive and nom-de-guerre-namesake of the PMC, Dmitry Utkin, a.k.a. "Wagner". The GRU officer on the call had previously been identified conclusively by Bellingcat as Col. Oleg Ivannikov, a staff GRU officer who was deployed in 2014 to Eastern Ukraine and was involved with procuring the Russian Buk missile launcher that downed MH17. The call's content strongly suggests that Wagner's CEO Utkin takes direct orders and reports to Col. Ivannikov.

Using the same 2014-2016 database, we checked domestic travel records for both Col. Ivannikov and Dmitry Utkin. Both of them made trips almost exclusively to/from Pashkovsky airport.

The limited analysis and verification conducted by Bellingcat on the data presented by SBU with publicly available leaked records is sufficient to conclude that the persons listed are indeed mercenaries contracted by, or otherwise associated with, PMC Wagner. Our limited-scope audit of names and passport numbers confirm that the referenced persons do exist, and that many of them had travel patterns that can be plausibly explained with traveling from their home regions, via either Moscow or St. Petersburg, to the main training camp of Wagner near Krasnodar.

While we cannot unequivocally endorse SBU's assertion that the issuance of the sequential international passports to these mercenaries proves their linkage to GRU, it is certain that no such mass issuance of passports from the central passport issuance agency at the federal level (which is not routinely used for issuance of civilian passports) could take place without the active endorsement of the state apparatus, if not necessarily the GRU. However, the rest of the available evidence, including the audio intercepts and the multiple travel of a senior GRU officer known to be in a commanding position to Wagner's commander and the location of the PMC's training camp, strongly supports the hypothesis that PMC Wagner is indeed a proxy and serves at the command of the Ministry of Defense, and in particular the GRU.

Third Skripal Suspect Linked to 2015 Bulgaria Poisoning

February 7, 2019 By Bellingcat Investigation Team

Bellingcat has determined that a third Russian GRU officer, who was in the United Kingdom at the time of the Skripals' Novichok poisoning in March 2018, arrived in Bulgaria just days before a local entrepreneur and his son became seriously ill after being poisoned with an unidentified substance.

The third man, a 45-year-old Russian travelling under the alias Sergey Vyacheslavovich Fedotov, has been conclusively identified by Bellingcat as a senior GRU officer. Like the other two Skripal suspects, GRU officers Anatoliy Chepiga and Alexander Mishkin, his cover identity was created in 2010, with no prior records of a person with this name ever existing.

Sergey Fedotov was first identified as a person of interest by the Russian news outlet Fontanka.

Bellingcat and its investigative partner The Insider (Russia) have traced Fedotov's prodigious travel itinerary since his cover identity was created in 2010 until his last overseas trip to London in March 2018. Over these eight years, "Fedotov" traveled extensively in Europe, Asia and the Middle East, often appearing in hot spots just days before news-making events.

A trip taken by Fedotov to Bulgaria in April 2015, however, stands out due to its eerie resemblance to the circumstances around the Skripals' poisoning in March 2018.

On April 24, 2015, "Sergey Fedotov" arrived on a flight from Moscow to the Bulgarian seaside resort of Burgas. He had a return flight for a week later, on April 30, from the capital city of Sofia back to Moscow. However, he did not show up for the return flight. Instead, late on the evening of April 28th, he showed up at Istanbul's Ataturk airport and bought a last-minute ticket to a flight to Moscow.

Earlier that day, a Bulgarian entrepreneur, Emilian Gebrev, was hospitalized after collapsing at a reception he was hosting in Sofia. At around the same time, his adult son and one of the executives at his company fell suddenly ill. All three were hospitalized with symptoms of severe poisoning. Emilian Gebrev's condition quickly deteriorated and he fell into a coma. Doctors surmised that the poison had been applied or consumed in the day or days preceding April 28. However, as they could not identify the poison, they could not be sure of its effects or mode of progression.

As first reported by Bulgarian weekly Capital, Emilian Gebrev then requested assistance in identifying the poison from two leading laboratories specializing in control of chemical weapons. One of them, Verifin at the University of Helsinki, undertook a thorough analysis. The lab was unable to identify the poison conclusively, but discovered traces of two different organophosphates in Mr. Gebrev's urine sample: One of these they managed to identify as a strong pesticide, while the other remained unidentifiable with the standard testing tools for chemical weapons.

A month after initially being admitted to hospital, Emilian Gebrev's status improved substantially and he was released. He told Bellingcat that several days later, in late May, he felt ill once again and was re-admitted to hospital.

Notably, on May 24, 2015 "Sergey Fedotov" had returned to Bulgaria on a direct flight from Moscow. He had booked a return flight on May 28, 2015, however he, once again, did not show up for that flight. Two days later, on May 30, he took a flight from neighboring Serbia to Moscow.

The events surrounding "Sergey Fedotov"'s trips to Bulgaria closely match the pattern of his trip to and from the United Kingdom at the time of the Skripal poisoning. Fedotov arrived to London on a flight from Moscow on the same day as the other two GRU officers -- these would be Col. Chepiga and Dr. Mishkin -- albeit on a different flight. He was scheduled to fly back in the afternoon of March 4, 2018, the day on which the Skripals, both father and daughter, fell ill in Salisbury. However, like in Bulgaria, he did not take the return flight, checking himself out of the airplane several minutes before departure time. Instead, he flew back to Moscow from another European capital a few days later.

Asked if he knew why he might be targeted by the GRU, Mr. Gebrev was at a loss.  One of Bulgaria's leading entrepreneurs in the defense manufacturing and export industry, he said he could not imagine what might have angered a foreign security agency enough to go after him and his family. At the same time, he admitted that this was most plausible explanation to a an unresolved mystery, as the three-year old Bulgarian investigations into his poisoning has turned up no leads or suspects.

Mr. Gebrev conceded that there may have been two hypothetical reasons why he might have been targeted. One was his company's exports of specialized defense-related equipment to Ukraine, which he said he conducted in strict compliance with Bulgarian and European regulations. Another hypothesis, he conceded, was possible interest by Russia in a weapons manufacturing plant he controlled that was seen as strategic importance to Bulgaria and NATO. Mesajı Paylaş
Çoklar diye korkma
Azız diye çekinme...


Third Suspect in Skripal Poisoning Identified as Denis Sergeev, High-Ranking GRU Officer /February 14, 2019

Bellingcat previously confirmed that a third GRU officer was present in the UK during the time Sergey and Yulia Skripal fell into a coma, after what the UK authorities said was a deliberate poisoning with Novichok. In addition, Bellingcat established that this same officer traveled multiple times to Bulgaria during 2015, including a trip days before a Bulgarian arms trader and his son were severely poisoned with a yet-unidentified poison.

Following a four-month joint investigation with our investigative partners The Insider (Russia) and Respekt (Czechia), Bellingcat can now reveal the true identity and background of this GRU officer, who operated internationally under the cover persona of Sergey Vyacheslavovich Fedotov. In fact, this person is Denis Vyacheslavovich Sergeev, a high-ranking GRU officer and a graduate of Russia's Military Diplomatic Academy.

Additional research in this investigation was also made by newspaper Helsingin Sanomat (Finland).

Notably, we have established that in the last two months, Russian authorities have taken the unusual measure of erasing any public records of the existence of Denis Sergeev, as well as of Anatoly Chepiga and Alexander Mishkin, the main two suspects in the Skripal poisoning. These unprecedented actions cannot plausibly be taken without direct involvement of the Russian state, and add further credibility to the UK government's assertion that the Skripal poisoning operation, and the subsequent cover-up, were coordinated at a state level. Additional details on these concerted efforts to purge public records of Chepiga, Mishkin, and Sergeev's identities will be detailed in the next part of our investigation, scheduled to come out next week.

Who is Denis Sergeev?

Denis Vyacheslavovich Sergeev was born in Usharal, a small militarized town in what was at the time Soviet Kazakhstan, near the Soviet-China border. Both Denis Sergeev and his cover identity "Sergey Fedotov" were born on 17 September 1973. He served in the army in the southern Russian city of Novorossiisk in the Krasnodar Region.

At some point between 2000 and 2002, he was transferred to Moscow and enrolled at the elite Military Diplomatic Academy, popularly known in Russia as the "GRU Conservatory". The Military Diplomatic Academy churns out 100 elite intelligence officers each year, ranging from spies in diplomatic and military attache covers to illegals.

We have not established what Denis Sergeev's service prior to the Academy involved; however, it is known that recruitment into the Academy takes place among military officers with the minimum rank of captain who have excelled at their military service, traditionally in Spetsnaz or navy units. Like all other graduates, Sergeev would have finished the Academy with a minimum rank of lieutenant-colonel. While we have no confirmation of his current military rank, the time served and the nature of his assignments since graduation indicate he currently holds a minimum rank of full colonel, and possibly major-general.

Denis Sergeev is married and has an adult daughter.

2004 to 2012 Period

During this period, which possibly overlapped with his last years at the Military Diplomatic Academy, Denis Sergeev, under his real identity, served as shareholder and/or managing director of eight Russian companies. These companies, all of which were liquidated between 2007 and 2012, were sham corporations with names mimicking names of other large companies registered in Russia. In most of the companies, Sergeev was the sole shareholder, while in two he was co-shareholder with other people, some of whom we also identified as GRU officers.

We established that during 2009, Denis Sergeev obtained a personal loan from a Russian bank in the amount of just over one million USD. The allocation of such a large loan to a person who - as seen from his credit record (obtained from a leaked Russian credit history collection) - had no real estate and no personal vehicle - is extraordinary.  The loan appears to have been extended on the strength of Denis Sergeev's personal income in his declared role as "specialist" working for a company called Loreven Style Ltd specializing in consulting services.

In a 2010 census, Sergeev listed Loreven Style Ltd as his employer, and indicated a Riga-based company address. There are no records of a company with such name ever existing, either in Riga or anywhere. Two phone numbers listed as contacts are not in service.

It is not certain what the function of the many sham companies incorporated by Sergeev was, and whether it was linked to the loan amount of $1 million apparently obtained from a Russian bank. A review of some of the other shareholders in these companies  - some of which also with GRU links - shows that they too incorporated dozens of companies with similar profiles, all of which have since been liquidated. It is plausible that these companies may have been used for money laundering purposes, or as cover corporations providing "respectable employment" to other GRU undercover officers, for instance in the context of visa applications. Bellingcat will continue to investigate these companies' purpose and potential use by the GRU within or outside Russia.

The Birth of Sergey Fedotov

In 2010, Denis Sergeev received his alter ego, "Sergey Vyacheslavovich Fedotov". A new, valid passport was issued under this name, by the same "770001" passport desk in Moscow that issued cover passports to Mishkin, Chepiga other GRU operatives, and "VIP" citizens, as previously detailed by Bellingcat.

"Fedotov" was given a birth date matching the one of the actual person Denis Sergeev. His place of birth was moved from Kazakhstan to the village of Apushka in the Ryazan region of Russia. As in the case of the other undercover passports issued to Mishkin and Chepiga, the "reason" for issuance of the new passport was stated as "unsuitability for use" of the previous passport. As in the other cases, the previous passport listed never actually existed.

"Sergey Fedotov" was also assigned a residential address and an employer. The new Moscow address in fact belonged to an unrelated family bearing the same family name (we were unable to contact the family to find out if they were aware of their cohabitation with the GRU officer, due to the fact that all four of their phone numbers were disconnected).

The employer, listed as a company called "Business-Courier", could not be established definitively. There are more than 25 Russian companies that carry or had this name, including ones that were liquidated in the same period as the batch in which Denis Sergeev was a shareholder.

In a 2017 census, "Sergey Fedotov" listed his income as the equivalent of USD $1000 per month. He did not list an employer in this census.

An International Man of Mystery

Using four different airline booking, PNR, and border-crossing databases, Bellingcat has collated and analyzed travel records for the persona "Sergey Fedotov" for the period of 2012-2018. He used two different (consecutive) passports during this period-both of which were issued by the same 770001 passport desk and had numbers from batches that we have identified to include other GRU undercover officers.

Fedotov's itinerary shows extensive travel to destinations across Western and Eastern Europe, Central Asia, and the Middle East.  In the period of 2012-2013, his destinations included Ukraine and Tajikistan.

In 2014, Fedotov traveled to Czechia, Italy, and Switzerland. Notably, during his first trip to Prague at the end of January 2014, he traveled alongside "Alexander Petrov", the cover persona of Dr. Alexander Mishkin, one of the key suspects in the Skripal poisonings. The two stayed in Prague eight days, until 2 February 2014, when they flew back to Moscow. Bellingcat's investigative partner Respekt has established that during this trip, "Fedotov" and "Petrov" stayed at the four-star Best Western Meteor Plaza Hotel, where they shared a room.

"Fedotov" made two subsequent trips to Western Europe during the rest of 2014, visiting Milan, Geneva, and Paris. His last trip that year was from 12 November to 1 December 2014, when he traveled to and from Paris.

Bulgarian Events

In February 2015, Fedotov made his first trip to Bulgaria. On 15 February 2015 he flew from Moscow to Belgrade in neighboring Serbia. On the next day he traveled on to Bulgaria, and stayed there until February 22, when he flew back from Sofia to Moscow.

His second trip, which was previously reported by Bellingcat, was in April 2015. He landed in the seaside resort of Burgas on a direct flight from Moscow on 24 April 2015. While he had bought a return flight from Sofia to Moscow on 30 April 2015, he did not use that ticket. Instead, on the evening of April 28 at 20:20, he flew from Sofia to Istanbul, where he bought an onward ticket to Moscow that same night.

It was earlier that same day, April 28, that the Bulgarian arms manufacturer and trader Emilian Gebrev collapsed during a dinner event with his trading partners from Poland at an upscale Sofia restaurant. Mr. Gebrev's health deteriorated fast and he slipped into a coma. He was treated for poisoning from an unidentified substance at the Military Medical Hospital in Sofia. A source from the medial institution who wished to remain anonymous confirmed to Bellingcat and its investigative partners that Mr. Gebrev's state was "touch and go" for over two weeks, with his chances of survival at times deemed to be very low. Gebrev's son and the commercial director of one of his manufacturing companies also fell ill with signs of poisoning in the days following his own collapse, albeit with lesser symptoms.

Following his release from hospital, and given that the poison had not been identified, Emilian Gebrev requested a forensic medical analysis from two European labs accredited by the OPCW. One of them - the Helsinki-based Verifin - conducted a detailed analysis on urine samples from Mr. Gebrev and his son. As previously reported, this analysis found traces of organo-phospate poisoning, with two distinct types of agent discovered in the sample of Patient 1, who is presumed to be Mr. Gebrev. One of the types was broadly identified by Verifin as a pesticide, while the other was not identified.

In a statement to the press on 11 February 2019 in the wake of Bellingcat's first publication pinpointing "Fedotov"'s presence in Buglaria during the time of Gebrev's poisoning, Bulgaria's General Prosecutor confirmed Fedotov's concurrent presence in the country. He also confirmed that Bulgarian authorities have re-opened investigation into Gebrev's 2015 poisoning, which had been closed in 2016 when no suspect had been identified. Mr. Tzatzarov said that the investigation had been reopened after Mr. Gebrev had written to the prosecutors in October 2018, having seen coverage of the Novichok poisonings in the UK and suspecting he may have been targeted in similar circumstances. Mr. Tzatzarov also confirmed that Bulgarian and UK law enforcement had been cooperating on the case since October 2018. He, however, appeared to discount the hypothesis that the 2015 poisonings in Bulgaria may have been linked to poisoning agents of the Novichok family, which he substantiated with the fact that "no chemicals in the CWC (Convention of Chemical Weapons) lists of banned substances were found in extensive testing".

Bellingcat and its reporting partners approached several experts on chemical weapons for further comments on the possible poison used in Bulgaria, based on the symptoms described and the full report from Verifin.

All consulted experts, including Vil Mirzyanov, who worked on the development of Novichok as part of the Soviet Unioin's secret chemical weapons program, concurred that the Verifin report cannot conclusively prove or disprove whether Novichok, or a similar substance, was used in the poisoning of Mr. Gebrev. Speaking to Bellingcat, Mr. Mirzyanov said that standard OPCW-standard compliant tests like the analysis conducted by Verifin are not suited to identify the use of Novichok, which is not а part of the banned list of substances under the CWC. Mr. Mirzyanov confirmed that a repeat test by the same laboratory, targeted specifically at the possible metabolysed traces and artifacts left by Novichok poisoning, is likely to prove or disprove the Novichok theory.

Verifin has confirmed to our reporting partner Helsingin Sanomat that it holds patient samples for a minimum of five years, which would mean that Mr. Gebrev's samples are available for re-testing at least until June 2020. Verifin has confirmed to the reporting team that if requested by the patient, a custom-tailored analysis could be performed.

"Fedotov" returned to Sofia on a direct flight from Moscow once more, on 23 May 2015. He left the country on 29 May 2015 by car, crossing into Serbia in the company of two Russian citizens. According to sources in Bulgarian law enforcement interviewed by our reporting partner in Bulgaria,, one of the two companions had been present in London during the poisoning of the Skripals in March 2018. Fedotov flew from Belgrade to Moscow on the next day, 30 May 2015. This return visit to Bulgaria broadly coincided with Mr. Gebrev's release from hospital, and subsequent reentry with renewed poisoning symptoms.

2016 and 2017 Hotspots

Following his Bulgaria trips, Fedotov made one more trip five-day trip to Turkey in August 2015.

During 2016, he traveled to London twice. His first visit was at the end of March, and he stayed in London six days until 1 April 2016. He returned to London for a four-day visit on 14 July 2016. Notably, or perhaps entirely coincidentally, these two trips were shortly before and after the Brexit referendum.

On 5 November 2016, Fedotov flew to Barcelona, and left back to Moscow from Zurich six days later. He returned to Barcelona one more time: on 29 September 2017, two days before the Catalunya independence referendum. Once again, by coincidence or otherwise, Fedotov remained in Spain during the October 1 vote, and flew back via Geneva to Moscow on 9 October 2017. He flew back to Geneva one more time three weeks later, on October 30, and returned to Moscow on 8 November 2017.

The Skripal Poisoning

At the end of 2017, Fedotov took a trip to Armenia. He stayed there between 23 December and 2 January 2018.  Only a week later, he flew to Zurich on January 10 and returned from Geneva on 17 January 2018. This would be his last trip before the London visit during which the Skripals were poisoned.

Traveling as "Fedotov", Denis Sergeev arrived in London early in the morning of 2 March 2018, leaving Moscow at 7:00 on Aeroflot flight SU 2580. The other two suspects, Mishkin and Chepiga, would arrive on a later flight that afternoon.

It is unclear what Fedotov's role may have been, if any, in the preparation and execution of the poisoning operation. We could also not establish if he traveled to Salisbury on any of the days he was in the UK. He had booked a return flight on Aeroflot's SU 2579
from Heathrow to Moscow in the afternoon of March 4, the day on which Sergey and Yuliya Skripal collapsed unconscious.

However, he never boarded that flight. PNR records seen by Bellingcat and its investigative partners show that despite checking in to that flight around noon on March 4, "Fedotov" was a last minute no-show. Instead, using transportation that has yet to be identified by us, he made his way to Rome, and boarded a flight at 15:30 that same day back to Moscow.

In the next part, set to be published next week, we will detail how we identified Denis Sergeev, despite concerted efforts by Russian authorities to purge all public records of him and the two Skripal poisoners, Anatoliy Chepiga and Alexander Mishkin.

Correction: the itinerary graph above contains one incorrect destination entry for the last trip of 2017. The destination was Geneva, Switzerland, and not Yerevan, Armenia. The original data was obtained from border crossing records which reflect the traveler's own declaration of destination. Subsequently obtained travel and telephone records show that Fedotov (Sergeev) traveled to Geneva, but reported Yerevan to border authorities, possibly for opsec reasons. Mesajı Paylaş
Çoklar diye korkma
Azız diye çekinme...


The Search for Denis Sergeev: Photographing a Ghost  February 21, 2019

In the previous part of this report, Bellingcat and its investigative partners The Insider (Russia) and Respekt (Czechia) identified Denis Sergeev, the GRU officer who was present in the UK during the poisoning of the Skripals in March 2018, and was also in Bulgaria during the poisoning, with similar symptoms, of a Bulgarian arms dealer in April 2015.

Following the report, Bulgarian authorities have announced that in October 2018 they re-opened investigations into the 2015 poisoning incident, and that they are now working in close cooperation with British police. In the meantime BBC Russia contacted by telephone Denis Sergeev's wife, who denied her husband was a GRU officer but declined to answer what his actual job was. She told reporters that her husband would decide whether he wishes to speak to the press, after which she has not been reachable at the telephone number. As of press time, a different person was answering her phone, who claimed not to know the Sergeevs'.

Additional Details from Denis Sergeev's Biography

Following our initial identification report, BBC Russia reported that it had discovered a person bearing the same full name and birth date as Denis Sergeev on a cached webpage of the 1990 graduating class of the Ekaterinburg Military School. Bellingcat can confirm that this was indeed the same Denis Sergeev, who studied in the two-year cadet-prepping institution. A comprehensive search in Russian databases has shown that there does not exist a second person with the same full name and birth date.

Bellingcat has established that as of 1999, Sergeev had a rank of captain and was serving as commander of the first paratroopers' company at the 108th Air Assault Regiment. This unit is based in Novorossiisk, on Russia's Black Sea coast, and played a key role in fighting in Dagestan in the summer of 1999, as well as in the second Chechen war in 2000-2001. In the early morning of August 13 1999 Denis Sergeev was wounded in the first minutes of an attempt to recapture the Alilen Mount in Dagestan from Chechen fighters. Sergeev, alongside other officers, received a state award for this battle.

The Impossible Search for "Fedotov"

The search for the identity of the third Skripal suspect "Fedotov" was markedly more difficult than that for the other two suspects, "Boshirov" and "Petrov". The reason for this, on one side, was the fact that British authorities released no information about - and crucially, no photographs of - the third suspect. On the other side, after Bellingcat's initial identifications of Col. Chepiga and Col. Mishkin, the Russian authorities apparently took unprecedented measures to purge any traces of this person's existence. Ironically, Bellingcat was able to witness this clean-up operation in real time, as data on this person that was originally available in online databases at the start of the investigation (in October 2018), became incrementally purged over the subsequent few months, with the person completely vanishing from all state-run registers by early 2019.

The initial existence of a likely third suspect traveling under the name "Sergey Fedotov" was first reported by the Russian website Fontanka, whose reporters first noticed that a person with a passport number pattern similar to that of "Petrov" and "Boshirov" traveled on a different Aeroflot flight to London on the same day as the main two suspects.

Bellingcat then obtained the passenger records for the 2 March 2018 flights from Moscow to London that had been reviewed by Fontanka, and identified the person, whose passport number different by the two last digits from those of the main suspects previously identified by us as decorated GRU officers. Indeed, "Sergey Fedotov" had flown into London on a flight several hours before "Boshoriv" and "Petrov", landing at Heathrow, while they would land at Gatwick airport later that same day.

We then obtained travel data for this person for the period 2011-2018. To re-create his travel itinerary we used three sources of data: border crossing data (both in Russia and other countries) provided by whistle-blowers, PNR data (reflecting airline bookings) that was temporarily exposed though a vulnerability in an airline booking systems, and a Russian passenger-monitoring system used by the police to track Russian citizens, to which we received access also via (different) whistle-blowers. The data sources were independent of each other, and mutually validated the travel records.

Different data sources had various advantages and disadvantages. PNR data, for example, provided more granular steps for each flight, such as times of preliminary booking, purchase, cancellations, check-in and no-show events. This allowed us to establish that "Fedotov" skipped his booked flights from London to Moscow after the Skripals poisoning, and from Sofia to Moscow after the Gebrev poisoning. On the other hand, police-monitoring data informed us of his train and car travels inside the country, and also provided information of other passengers who booked flights along with him - exposing names of other likely GRU operatives. Border-crossing data, while limited to international air-travel only, was also the only data source that turned out to be immune to deletions as part of the Russian authorities' cover-up measures.

Sergey Fedotov: Real or Fictional?

The passenger manifest for the Moscow-London flight provided a first and last (family) name and a date of birth. At this point, we were not certain if these belonged to a real person or were cover credentials. We knew from our prior research into "Boshirov" and "Petrov" that typically, GRU would create a parallel documentary trace for the cover identity, including passports, address registrations, and even employment histories (all of these are needed, among others, in order to ensure credible applications for visas).

Knowing this, we first searched for "Sergey Fedotov" born on 17 September 1973 through hundreds of Russian residential, automobile ownership, tax ID and credit history databases that have been leaked onto the internet over the past 20 years and that we have consolidated in the last 3 years. There, we found four possible matches. One of them was registered to a Moscow address: his full name was Sergey Vyacheslavovich Fedotov. This person's entries in the databases displayed certain unusual characteristics. For example, Moscow residential databases listed his place of birth as Apushka, a small village in the Ryazan region north-east of Russia. However, no entry for such a person existed in old residential databases of the Ryazan region. Also, "Fedotov" was shown as employed by a company called "Business-Courier", which had existed on paper between 2004 and 2008 and had apparently never traded. Crucially, these databases showed "Fedotov"s registered address, but when Bellingcat acquired the ownership records for this apartment, they showed a different family - also bearing the Fedotov name - as owners. Neither of these owners could be identified as having a family member named Sergey Fedotov and born in 1973. Our attempts to reach this family were futile, as all four listed numbers for them had been disconnected.

At this point in the investigation, at the end of October 2018, we obtained Moscow's Sergey Fedotov's passport file from a whistle-blower with access to the centralized police travel-tracking database. It validated our suspicions that this was a cover identity: his latest passport was issued by the same 770001 passport desk that was known to issue passports to GRU officers and foreign-born VIP citizens, and it was issued due to "unusability of the previous passport" - the same reason given for the issuance of Petrov and Boshirov's cover passports. Importantly, the previous passport - which was listed as issued in the Ryazan region - had a number that did not show up in the Ryazan databases. These peculiarities as a whole convinced us that Sergey Fedotov was a cover identity.

The Quest for a Photograph

The next step in the investigation was to obtain a photograph of the "cover" persona, which would be used to search for the real individual and prove that they are the same person. Unlike the case of the other two suspects, no published photographs of Fedotov existed, nor was he interviewed on RT.

At this point, in December 2018, Bellingcat requested a copy of Fedotov's domestic passport from a source with access to RosPassport, the central passport database. The source reported that no passport records exist for Sergey Fedotov. This information contradicted both the police tracking database which had provided full details of Fedotov's passport, as well as telephone registration records which also contained his passport details. To ensure that this was not human error, Bellingcat requested a second source with access to verify the absence of passport data; this source confirmed and presented us with a screenshot of the "no results" search menu. The only logical conclusion was that Russian authorities had purged the cover persona Sergey Fedotov from the central passport database.

With no access to a passport photo from Russian databases, Bellingcat approached many sources at border-crossing authorities in the various countries where "Fedotov" traveled to, as well as hotels at which Bellingcat's investigation partners had identified he had stayed. After long persuasion, one of these prospective sources provided Bellingcat with a photograph from a scan of Fedotov's international passport.

Finding The Real Person behind Fedotov

Based on our experience from prior identifications of GRU officers, we knew that cover identities fell into two broad categories: minimal-change (i.e. only last name, and sometimes patronymic, are changed, leaving date of birth and general region of origin unaltered, as in the cases of Mishkin, Shishmakov, Moiseev), or full make-over (i.e. change of both name and birth data, as in the case of Chepiga/Boshirov). We started the search by testing the minimum-change hypothesis. However, a search in hundreds of residential databases for a "Sergey Vyacheslavovich" with birthdate of 17 September 1973 led to no likely candidates.

As a second step, we tested for only "Sergey" with the same birthdate. This resulted in a large pool of targets, but none of them displayed immediate signs of links to GRU. Last, we decided to search only for people with a patronymic "Vyacheslavovich", and birthdate 17 September 1973. In our initial search with these criteria in a 2012 Moscow residential database, we found 15 hits, but one of them was of special interest. This person had a listed residential address at Narodnoe Opolchenie 50, which is the location of the dormitory of GRU's Military Diplomatic Academy. This was Denis Vyacheslavovich Sergeev, born in Kazakhstan, and having a passport issued in Novorossiisk in 2000. Databases of different vintage showed that he, along with his wife and daughter, had been registered as residing at this address no later than 2006, and were still registered at that address in 2012.

The links between Denis Sergeev and GRU were not restricted to his family's residence at the dormitory of the GRU "Conservatory". In certain databases his address was listed as Military Unit 22177, which is in fact the military number of the Conservatory. From leaked domestic travel databases, we obtained domestic travel records for Sergeev (he appears not to have traveled internationally under his real identity). On several train trips between Moscow and St. Petersburg, Sergeev traveled on joint bookings with other people, who were registered as residing, or having their cars registered at Khoroshevskoye Shosse 76A, the headquarters of GRU. One companion train passenger had been previously seen by Bellingcat as listed among the people authorized to drive a car owned by Vladimir Moiseev, the GRU officer identified by us as the person behind the persona Vladimir Popov, under which he is on the Interpol red notice list in connection with the abortive Montenegro coup in 2016. This same person, in turn, had traveled multiple times between Moscow and Krasnodar, where the base of the private Wagner military company is, in joint bookings with persons identified as Wagner mercenaries.  Bellingcat has previously reported that Wagner mercenaries had international passports from the same series used for GRU undercover passports, and that seniоr GRU officers frequently travel to Krasnodar's Pashkovsky airport, sometimes on flights on which known mercenaries are also flying.

Another person who traveled on joint train bookings with Denis Sergeev was also found on 4 different joint airline bookings with Eduard Shishmakov, the GRU officer expelled by Poland in 2014, and also on the Interpol wanted list for his role in the Montenegro coup. The two flew together from Moscow to and from Rostov airport in late 2012; at that time Shishmakov was formally serving as Russia's deputy military attache in Poland.

To establish conclusively that Sergeev is in fact "Fedotov", we needed to obtain a photograph of Sergeev and compare it to the already obtained "Fedotov" passport photo. However, this turned out to be nearly impossible.

Concerted cover-up Efforts by the Russian State

While we could find multiple references to Denis Sergeev in offline, aged databases from 2018 and earlier, it appeared that no such person existed in current, online state-run registries. Initially, Bellingcat tried to obtain a photo of Denis Fedotov via several sources with access to the traffic police (GIBBD) database. All sources reported that no such person exists among licensed drivers in Russia. This did not make sense, given that we had already obtained records of Sergeev's own car, and had also verified that he was listed as an authorized driver for his daughter's car.  In addition, we had obtained the number and date of issuance of Sergeev's initial driving license from an offline database.

Our hypothesis that Denis Sergeev had been purged from state-run databases - including the passport database - was confirmed via a simple experiment. As we had his domestic passport number from previously obtained documents (including the October 2018 police tracking database record), we tried to obtain Sergeev's unique tax identifying number via a web tool run by Russia's tax authority. The tool returned no results. We then tried to obtain the tax number for the other two suspects in the Skripal case. They, too, had vanished from the tax system. Other known GRU officers, whom we had identified previously but who had not been linked to the Skripal case, could still be found using this same tool. Data for the cover identities "Fedotov", "Petrov" and "Boshirov" had also disappeared from this onlne database.

We then attempted to find traffic fine violations for Denis Sergeev's car using a web-tool run by the traffic police. We had the exact registration details of Sergeev's Nissan X Trail, however the online tool informed us that no such car exists.

Last, we checked if travel records for "Fedotov" for the period 2015-2018 were still present in the police travel tracking database (we had previously obtained such records in October 2018). As of February 2019, no such travel records existed in the system. It became evident that the Russian state had implemented a full sweep of data relating to both the real and undercover identities of Sergeev and his other colleagues linked to the Skripal case.

While impeding our ability to find a photo match between Sergeev and Fedotov, this finding gave us the idea to look for other GRU officers who might be linked to the Skripal poisoning, in which case we could expect their data to not be available via the online tax tool. Indeed, we have identified one such additional GRU officer. This officer, notably, traveled to Bulgaria two weeks before Sergeev's trip which coincided with the poisoning of the Bulgarian arms trader. Bellingcat and its partner publications are currently analysing whether this may be a fourth suspect in the Skripal case.

Alternative Photo Match

While reconstructing Denis Sergeev's background prior to his studies at the Military Diplomatic Academy, we sought for a person with this name among the most likely recruiting grounds for that institution - Spetsnaz and air-attack paratrooper units, especially ones with actual hands-on military experience. We were able to find a reference to a Capt. Denis Sergeev in a book about the Dagestan events in 1999 described earlier. We also discovered several witness descriptions of the battle in which Capt. Sergeev was wounded, while his commander was killed. One of the references was in an article about a documentary film on the battle in Dagestan.

We found this documentary which was filmed shortly after the events, and saw that Capt. Sergeev was interviewed on camera in several segments. While there were certain similarities between the person in the documentary and the recent photograph from "Fedotov"'s passport, we could not be certain that this was the same person, especially given the low resolution of the photo and the nearly 20 years between the two events.

Bellingcat then requested a forensic analysis of the similarities between the persons on the passport photo, on one hand, and the screen-grab from the 1999 documentary, on the other. Prof. Hasan Ugail from the Center for Visual Computing at the University of Bradford supervised the analysis, which was conducted using a state of the art deep machine-learning algorithm trained on millions of human faces. The algorithm provides 100% matching accuracy in one to one face comparison tests of known identities. The test provided a match of 78.2%, while a match >70% is sufficient to conclude identity match of the persons.

Further details of the underlying academic work can be found in A. Elmahmudi and H. Ugail, Experiments on deep face recognition using partial faces, in Cyberworlds 2018, IEEE, doi: 10.1109/CW.2018.00071, (2018)

Mesajı Paylaş
Çoklar diye korkma
Azız diye çekinme...



This two-part report identified a third suspect in the Skripals poisoning case, who may also be a suspect in the poisoning of Bulgarian arms manufacturer and trader Emilian Gebrev in April 2015. Sergeev's undercover travels as "Fedotov" are extensive, and overlap with certain important political events in Europe. His long career profile suggests he is not a mid-rank operative or support personnel for overseas operations, but more likely serves in a supervising function. Further investigations are needed into the purpose of his rich travel history, especially in locations such as Spain, Turkey, Czechia and Tadjikistan.

A key discovery in this report was the unprecedented purge of all traces of both the cover and real persons linked to the Skripal case from public registers in Russia. Such cleansing, which took place after Bellingcat's initial identification of GRU officers "Boshirov" and "Petrov", cannot realistically be undertaken without the direct involvement of the Russian state. The only plausible explanation for this data purge is curbing further investigation into the Skripal (and possibly, the Gebrev) incidents, both by media and by foreign law enforcement agencies.

In the course of this investigation, we found that GRU undercover officers assigned to different operations often overlap, with the total number identified by Bellingcat not exceeding 10, many of which overlapping between, for instance, the Montenegro and Skripal operations, as well as other joint operations whose purpose is yet to be identified. This implies that there is a limited elite team of internationally trained operatives that are recycled among various projects.

The GRU Globetrotters: Mission London June 28, 2019

In a series of previous investigations, Bellingcat and the Insider identified the two key suspects in the Novichok poisoning of Sergey and Yulia Skripal, and the subsequent poisoning death of Dawn Sturgess. We identified the two suspects, who travelled under the fake identities of Alexander Petrov and Ruslan Boshirov, as Russian military intelligence (GU/GRU) officers Anatoliy Chepiga and Dr. Alexander Mishkin, both having rank of colonel and both recipients of Russia's highest military award.

Bellingcat subsequently identified a third GRU officer who travelled to London during the Salisbury poisoning operation under the cover identity of Sergey Fedotov. We established that his real name is Denis Sergeev, and that his rank was at no lower than colonel, and possibly Lt. General or Major General. While Sergeev's exact role in the operation was not known, taking into account his seniority and pattern of prior international operations, we assessed that he was in a senior position to Chepiga and Mishkin, and was likely in charge of coordinating the Salisbury operation.

In a series of follow-up investigations conducted in cooperation with international media organizations, we have attempted to uncover more details on Sergeev's role in several international GRU operations.

This first installment is conducted in cooperation with BBC's Newsnight.

Newly obtained telephone metadata logs from a telephone number registered in the name of the (cover) persona "Sergey Fedotov" has allowed us to analyze Denis Sergeev's telephone usage - including calls and data connections - in the period of May 2017 - May 2019. The data - and especially the cell-ID metadata that we have been able to convert to geo-locations -  allowed us to recreate Sergeev's movements. These movements were both in Russia and abroad, as well as his pattern of communications during his overseas operations. Bellingcat obtained the telephone metadata records from a whistleblower working at a Russian mobile operator, who was convinced s/he was not breaching any data privacy laws due to the fact that the person to whom this phone number was registered ("Sergey Fedotov") does not in fact exist.

  • Based on the analysis of Sergeev's telephone movements within Moscow, we have established that his daily routine involves trips from his place of residence to several locations housing GRU operations. These include the GRU headquarters at Khoroshevskoe Shosse 67B, and the GRU Academy at Narodnoe Opolchenie 50.
  • Notably, Sergeev's daily routine shows unchanged pattern of travel to these GRU locations from 2017 through the end of 2018, validating our hypotheses that he was in the employ of the GRU at the time of the Skripal poisoning.
  • The telephone metadata produced further, unexpected evidence validating our identification of Denis Sergeev as the real person behind the "Sergey Fedotov" cover persona. This extra proof came in the form of a stray phone call from a telephone number registered in the name of Denis Sergeev's wife, to the number registered in the name of "Sergey Fedotov".
  • Our reporting partner BBC has established via its own sourcing that Denis Sergeev has a rank of Major General. This, along with our prior assessment of his seniority to the Mishkin/Chepiga team and with the objective telephone records from his trip to London, presented below, validates our assumption that he was involved in the Skripal operation in a supervising, coordinating role; communicating back and forth to Moscow, while leaving the suspected Chepiga/Mishkin hit-team to work in an operational "Faraday cage".

The Impulsive Traveler

On the morning of Thursday, March 1st 2018, Denis Sergeev was working from his new home, a 7-minute walk from the GRU Academy where he had worked - and lived in a dormitory-style apartment with his family - for almost 10 years.  His new apartment was on a street named, somewhat imprudently, after a famous German spy who during World War II had passed on information about Hitler's plans to the Soviet Union.

At 10:51 Sergeev, using a phone issued in the name of his cover identity, made a call to a number registered in the name of another non-existing person, a fictional Timur Agofonov. Whatever he had to say was short, as he hung up after 9 seconds. The rest of the day Sergeev stayed at home, browsing the internet and waiting.

Just after 6 pm, Denis Sergeev got the confirmation that he was expecting: he had to fly to London for the weekend. Not with his wife, and not under his real name, but as "Sergey Fedotov" - a department manager at a GRU front company offering courier services. Operational security protocol required that he himself book his ticket, lest traces to his employer - the GRU - remain in any of the booking systems.

Sergeev called a couple of travel agencies searching for a last-minute ticket to London for the next morning. For whatever reason - maybe the flight was sold out - it took them a while to confirm a booking. Only at 20:09 he got a call back from a travel agent situated about 2 kilometers from his home confirming that he had a ticket for the next morning.

Sergeev dialed *100# on his phone to check his prepaid credit. There was enough cash on the account, but he realized he needed to activate a roaming package plan for his trip, as he knew he would have to receive and send a lot of data files. But he left that chore for the morning - he had an early flight to catch.

The next morning Sergeev arrived at Sheremetyevo airport just before 6 am. His Aeroflot flight was scheduled to depart at 8:15 but he had to be at the airport early as he had luggage to check in. Disappointingly, at about 7:30 he got a text message from Aeroflot informing him that his flight would be delayed by an hour. An hour later, another text would extend the delay to two hours.

Sergeev used the waiting time to send a few messages and download some large files. In the two extra hours he was forced to wait, he exchanged several messages using Telegram, Viber, WhatsApp, and Facebook messenger, and downloaded 3 large files. At 9:15 he got a call from "Amir", and they spoke for about 3 minutes. 45 minutes later, just before he finally boarded the Airbus A321, he called Amir again to tell him he was finally taking off. He would speak to Amir - and only to him, many times during the next three days.

An Uninterested Tourist

Both airline data and the telephone metadata confirm that Sergeev landed at Heathrow at 10:33 local time. It took him just over an hour to start moving from Heathrow's Terminal 4 to downtown London. Telephone metadata pinpoints him at Heathrow latest at 11:50, following which it took him 37 minutes to get to the Kensington area another 15 minutes to get to his final destination, a hotel near Paddington Station.

His phone connected a number of times during his trip from the airport, suggesting he did not take the underground which typically has no phone coverage. The trajectory of the route taken, and the time it took him implies he most likely traveled by car. He checked in at his hotel at about 12:35 pm. Due to the coverage range of cell-towers, it is not possible to establish which exactly hotel he stayed at; however, it is practically certain that the hotel was within a few hundred feet from Paddington.

Over the following 2 days, and until his departure on Sunday morning, Sergeev barely left his hotel room, except for a short trip on Saturday morning.

The Great Communicator

While Sergeev did not show interest in seeing the sights of London, he spent a significant volume of time on the phone and online. Based on the data traffic of his phone, it appears that he did not trust local WiFi connections and instead used his 3G/4G telephone connection. The total data consumption for his 48-hour trip exceeded 1 GB.

Due to the specifics of data logging while in roaming, it is not possible to differentiate between different forms of data use - thus we do not know how much of Sergeev's online time was spend on encrypted messengers vs downloading and uploading files and browsing. However, based on his observed use of messaging apps while in Moscow, we can assume that at least part of the time he was online he communicated via his preferred set of messengers - Telegram, Viber, Whatsapp and FB Messenger.

At least some of Sergeev's data use can be plausibly identified as large file transfers, based on the size of the data transfer and the time it took to complete. The file size of some transfers matched the typical size of a high-resolution photograph, while other transfers were more commensurate with the expected size for video files.

Sergeev's data usage persisted throughout his stay in London, suggesting his phone was with him the whole time and he did not take (long) trips that could not be matched via connections to cell-tower locations.  For example, during the night of 2nd to the 3rd of March, we can see non-trivial data volumes at 3 am to 4 am, as well as large file transfers (or video/VOIP calls) between 4:30 and 6 am London time, which would match the start of the working day in Moscow, given the three-hour time difference in March.

"Amir from Moscow"

During his trip, Sergeev made and received regular phone calls from only one telephone number. This was the same number he called just before flying from Moscow, and he communicated with this contact a total of 11 times during the London trip.

We have established that as of press-time, this number is "unregistered", i.e. belongs to a prepaid sim-card without a documented owner. However, given that Russian mobile operators are obliged to activate sim cards only linked to individuals (or companies), and as of June 2018 they must require passport identification of number owners - or else disconnect them - this number appears to be non-standard.  In addition, metadata logs show that this telephone number does not produce the regular "footprint" left by regular numbers: i.e. there are no cell-tower IDs, or IMEI/IMSI logs matching this number. It is thus likely that this is a number from a special series used by Russian's security services, and it is possibly not linked to a hardware telephone but - for instance - to a gateway device.

The number shows up in one telephone-sharing app popular in Russia under the name "Amir - Moscow".

Sergeev first called this number shortly after checking into his hotel near Paddington station on March 2. He had another short call with "Amir" an hour later, and then a longer 9-minute call 8:49 pm.

Saturday, 3 March

The next morning Sergeev received two phone calls from the same number shortly after 9 am, and two calls again after 15:45.

Between the two calls, Sergeev took at least one trip outside the hotel. Between 11:30 and noon, his phone registered at least once at a cell tower near Oxford Circus. Then, between noon to about 1:30 pm, his phone connected several times near the Embankment, on the Thames west bank.

Notably, according to the timeline of Chepiga and Mishkin's movements, as presented by British police, they arrived from their hotel to Waterloo station at approximately 11:45 on that day.  Their train to Salisbury, however, would have left at 12:50. Waterloo station is approximately 10 minutes walk from the Embankment. Thus, had a meeting in person been necessary between Sergeev and the Chepiga/ Mishkin team - whether to pass on final instructions or a physical object - the area between the Embankment  and the Waterloo would have been a convenient place, and the one-hour time gap between their arrival to the station and their departure would have likely sufficed.

Sergeev's detour to Oxford Circus may or may not be significant. In their infamous RT interview, Chepiga and Mishkin, masquarading as tourists Boshirov and Petrov, claimed that on March 3 they visited a shop at Oxford Street. However, they said they shopped for sneakers at Oxford street after their return from Salisbury, whereas Sergeev's connection is from the morning before their trip. However, it is possible that Oxford Street was used as a point of brush-off meeting, or a fallback to another place of meeting.

Timeline of Mishkin/Chepiga movements, per UK police

2018-3-2 15:00   Gatwick arrival   

2018-3-2 17:40   Victoria station   

2018-3-2 18:00   Waterloo   

2018-3-2 19:00   Waterloo   

2018-3-2 19:00   CityStay Hotel   

2018-3-3 11:45   Waterloo   *departing Waterloo 12:50

2018-3-3 14:25   Salisbury Station   

2018-3-3 16:10   Salisbury Station   

2018-3-3 20:05   CityStay Hotel   

2018-3-4 8:05   Waterloo   *departing Waterloo 10:20

2018-3-4 11:48   Salisbury Station   

2018-3-4 11:58   Skripal house   

2018-3-4 13:05   Salisbury Fisherman street

2018-3-4 13:50   Salisbury Station   * left at 15:10

2018-3-4 16:45   Waterloo   

2018-3-4 18:30   Underground to Heathrow

2018-3-4 19:28   Passport control   

Just after 6 pm, Sergeev received two more calls from "Amir", totaling about 4 minutes. Based on the police timeline, suggesting Chepiga and Mishkin left Salisbiry just after 4 pm, by the time of the call the pair would have just returned from their first trip to Salisbury.

Sunday, 4 March. Day of the Poisoning.

On the morning of March 4, Fedotov made several data connections from his Paddington hotel.  At 9:03 AM his phone rang, and he spoke with "Amir" for just about a minute.  At 10:20 he sent or received a file of 8 MB, commensurat with a photo file.  Notably, at that same moment, the Chepiga/Mishkin team left by train from Waterloo to Salisbury.

At 10:40 Sergeev called "Amir" one last time, and spoke with him for about 2 minutes. He continued using the internet until 11, when he checked out of the hotel.  He had a scheduled flight out of Heathrow at 13:30, and he was already running late.

At 11:20 Sergeev went offline and reappeared near Southhall on the way to Heathrow airport 30 minutes later. This route and timing would be consistent with him taking the 11:25 AM Heathrow Express from Paddington. He arrived at Heathrow's Terminal 4 just before 12 pm. Fortunately for him, Aeroflot's flight - once again - was late. He made the flight, and the plane to Moscow took off at 14:15.

As Sergeev's plane was about to land, "Amir" tried to call him at 8:51 PM, and when he could not reach him, sent him a text message. Sergeev landed at 21:00, checked his online messengers for messages, and left for his home by car. Once at his home, at 22:35 he made a brief 10-second call to "Amir". He then stayed browsing the internet until 4 in the morning.

Relevance of new findings

The new findings confirm that Sergeev was an active GRU officer at the time of the Salisbury operation, as opposed to a retired officer employed for a private operation. They also shed light on the likely chain of command for this (and other) GRU overseas operations, with one coordinating senior officer communicating with headquarters in Moscow while the team on the ground receive limited to no new instructions. This set-up may be linked to operational security and the need to minimize the operative team's exposure to traceable data communications.  Evidence obtained by us on other international operations involving the same team suggests that this is a stable GRU oprerational model.

The new telephone metata data also provides an answer to a mystery unresolved in our prior investigation relating to Sergeev: his mysterioius check-in and later "de-boarding" entry from the passenger list. Given the late departure from his hotel and delayed arrival at Heathrow, it is plausible that by the time he went through security control, the airline had already excluded Sergeev from the passenger list.  Assuming he had an electronic boarding pass on his phone, he would have been able to make his way to the gate and - given the delayed flight - "begged" his way back in to the checked-in passenger list. This would still leave open the question as to why, upon arriving to Moscow, he declared to border officials that he was landing from Rome, instead of London. The latter might have been out of caution given the sensitivity of his operation.

While we cannot validate from objective sources the finding by our reporting partner BBC Newsnight that Denis Sergeev has a rank of Major General, it is consistent with our own assessment, given his prior military achievements and seniority.  The involvement of a GRU Major General would indicate the unusually high importance of the operation.

Mesajı Paylaş
Çoklar diye korkma
Azız diye çekinme...


The Dreadful Eight: GRU's Unit 29155 and the 2015 Poisoning of Emilian Gebrev /November 23, 2019

  • In a previous investigation, Bellingcat and its investigative partner The Insider reported on the presence of a senior GRU officer, Denis Sergeev aka "Sergey Fedotov", in Bulgaria at the time when a Bulgarian arms manufacturer collapsed into a coma following what was identified as poisoning by an unknown neuroparalytic substance. At that same time, the entrepreneur's son and the production manager of his factory were also poisoned. A possible second poisoning may have been attempted a month later, days after Gebrev and his son were released from hospital.
  • We have previously identified Denis Sergeev as a Maj. General from Russia's military intelligence elite overseas clandestine-operations unit, a sub-unit of military unit 29155. He traveled to the UK to coordinate the operation of Col. Chepiga and Col. Mishkin (aka "Boshirov" and "Petrov") in Salisbury in March 2018.
  • The clandestine sub-unit of GRU's military unit 29155 is a top-secret intelligence squad comprising of approximately 20 undercover officers with hands-on combat experience and hailing from a broad array of backgrounds, ranging from signals intelligence to medicine.
  • We have previously identified members of this sub-unit as being involved in the destabilization and annexation of Crimea (2014), destabilization campaigns in Moldova (2014), a failed coup in Montenegro (2016), WADA-linked operations in Switzerland (2016-2017).
  • Currently unit 29155 is also under investigations in Spain - after disclosures by Bellingcat - over trips to Barcelona before and during the Catalonia independence referendum in 2017.

In a new joint investigation with Der Spiegel and The Insider, Bellingcat can now reveal that at the heart of the Bulgarian poisoning operation was a team of as many as eight GRU officers - all members of the same unit - who traveled to Bulgaria in the weeks surrounding the poisoning attempt. Crucially, constellations of teams of three - including Maj. General Denis Sergeev - were present in Bulgaria during both suspected poisonings.

The preparations for the attempt on Gebrev's life may have been months in the making. The first member of the GRU sub-unit to visit frequently Bulgaria was "Vladimir Popov" - one of the two GRU officers indicted by Montenegro for orchestrating the country's destabilization in late 2016 ahead of its accession to NATO. We previously identified "Vladimir Popov" as GRU officer Vladimir Moiseev.

Approximately one year before Gebrev's poisoning, Moiseev visited the country in March 2014 (16-18.3), followed by trips in September (12-16.9), November (18-21.11) and December (5-16.12) 2014. His visits were made under his cover persona, which has its own fake backstory as a photographer and journalist for a now-defunct Russian marine insurance journal.

Several months after Popov's initial trip, several other members of the same GRU unit began regular visits to Bulgaria. "Fedotov" was accompanied by "Pavlov" in late February 2015 (15-22), a week later agents "Kononikhin" and "Lebedev" came on a joint "tourism" trip on 26 February and stayed until 8 March. During the same period, another team member - "Nikitin" also made a short visit to the country. "Popov" came back to Bulgaria during the last three days of their stay - from 6 March to 11 March 2015.

Those visits were likely a preparation for the main operation. The immediate arrangements for the operation however appear to have begun on 24 April 2015, when two GRU officers traveling undercover as the tourists "Georgy Gorshkov" and "Sergey Fedotov", arrived to Bulgaria's Black Sea resort city of Bourgas. (Gebrev believes he recognized "Gorshkov"'s face when we showed him a photograph, however given the long time after the incident he said he could not be sure).

"Sergey Pavlov" arrived on the same day directly to the capital Sofia where Gebrev was at the time. Ticketing data shows that both "Fedotov" and "Gorshkov" were supposed to fly back from Sofia to Moscow on 30 April 2015. However, neither of them waited for their return flights. Instead, late on the evening of 28 April 2015, they both flew to Istanbul and then onward from Istanbul's Ataturk airport for Moscow. The next morning, 29 April 2015, "Pavlov" flew directly to Moscow from Sofia on a Bulgaria Air flight.

About 20 hours before the tourists' premature departure, late in the evening of 27 April 2015, Emilian Gebrev felt the first symptoms of what would soon turn out to be a near-fatal poisoning. Initially he felt a burning sensation in one of his eyes, then the uncomfortable feeling progressed to both of them. Later that night he says he felt dizzy, and had flashes and blurred vision.

He did not read too much into these early symptoms, and attributed them to tiredness or early signs of flu. However, the following day his symptoms progressed, and during dinner with business partners on the evening of 28 April, Emilian Gebrev felt that he was going to collapse. Having a good contact at Sofia's military hospital, he was rushed there just in time before falling into a coma.

In the next several hours, both his son and his production director - neither of whom attended the dinner - also felt weak and fell down with inexplicable, albeit somewhat less severe symptoms. They all ended up in hospital during the next day.

The medical examination of all three showed symptoms of severe poisoning, with Gebrev's condition deteriorating the fastest. The medical team treating him was unable to identify the poison, but - partly thanks to experience while deployed in peace-keeping operations in war-zones - the lead doctor was able to mitigate the symptoms sufficiently to maintain Gebrev's vital signs while keeping him in a medically induced coma.

Approximately 20 days after initially being admitted to hospital, Emilian Gebrev's status improved substantially and he was released. The doctors - still in the dark about the actual cause of his sudden illness - advised Gebrev and his son to spend some time away from the polluted city air, and so they drove to the beach resort of Sinemorets.

It was while the Gebrevs were at their seaside house that a revamped GRU team returned to Bulgaria.

First "Danil Stepanov" arrived on 23 May 2015. The next day he was joined by senior officer "Fedotov" who flew to Sofia on a direct flight from Moscow. "Fedotov" had booked a return ticket on May 28, 2015, however, once again, he did not show up for the flight. Instead, two days later, on 30 May 2015, he took a flight from neighbouring Serbia to Moscow. Notably, on 28 May 2015 the two were joined in Bulgaria by "Gorshkov", who accompanied "Fedotov" in his detour via Belgrad to Moscow on 30 May. "Danil Stepanov" left Bulgaria on 29 May on a direct flight to Moscow.

On 26 May 2015 - during the stay of "Fedotov" and "Stepanov" in Bulgaria - Gebrev and his son once again felt early symptoms similar to what they had experienced a month prior, and went for examination into Sofia's military hospital that same evening.

As we reported earlier, Gebrevs diagnosis remained inconclusive with doctors unable to determine the source or type of poisoning. At Gebrev's own initiative, the Finnish research institute Verifin was asked to analyse serum and urine samples. The analysis performed was not examining the actual poison, but its biological descendants (metabolites) that had remained in the human body. Verifin found traces of two organophosphates that could be linked to pesticides, and a third one that the laboratory was unfamiliar with and could not identify.

Following the news of the Skripals poisoning with Novichok in 2018, and recognizing some of the symptoms described in their case, Gebrev approached Bulgarian authorities with a request to reopen the cold-case investigation and probe for the possible use of Novichok or a similar substance on him. He also urged Bulgarian authorities to request a new chemical analysis of the samples submitted to Verifin in 2015, with the hindsight awareness of the possible use of Novichok, and accumulated knowledge of its residual manifestations in blood and urine. While the Bulgarian government has reopened the investigation and is known to be cooperating with UK law enforcement, Gebrev's requests for a repeat chemical analysis - in cooperation with the OPCW - have not yet been acted upon.

Possible motivation behind the attack

The precise motivation for the apparent poisoning attempts is still not determined by the Bulgarian investigation, nor is it clear even to the victim. Gebrev's arms business was not a major factor in arms sales to countries or militant groups that Russia's Defense Ministry considers adversaries. While Gebrev did export weapons to Georgia during the Russia-Georgian war in 2008 and ended up in a Russian Ministry of Defense blacklist, he tells us his business accounted for no more than 10% of Bulgaria's total arms sales to Georgia during the war. He is adamant that he did not export arms to Ukraine, directly or indirectly, after Russia annexed Crimea in February 2014.

One possible hypothesis for Gebrev becoming a target was the internal power struggle of oligarchs in Bulgaria, on whom Russia exerted significant influence during the period 2014-2015.

Russia did consider the arms industry in Bulgaria hostile to its interests, since by early 2015, a number of Bulgarian arms manufacturing and exporting companies were scrambling for a clandestine US budget allocation for supplying weapons to the Syrian rebels. The demand for Eastern-type light/medium weapons and munitions had grown exponentially and Bulgarian exporters were eager to get a cut of the allocation. The exported weapons, naturally, were not going directly to the Syrian insurgents armies, but were initially sold to proxies, such as Azerbaijan and Saudi Arabia.

Gebrev insists now that his company, Emco, did not bid for any arms sales under this clandestine program. He says his main export markets - India and Northern Africa - required high volumes and he was fully focused on fulfilling those export commitments. However, an export license application for a shipment to Azerbaijan - that was allegedly intended for Syria - was filed with Bulgarian foreign ministry, coincidentally, on April 27 - hours before Gebrev felt the initial symptoms of poisoning.

Gebrev's main hypothesis is that this was a forgery by a competitor, who wanted to eliminate his business from the market by turning the Russians against him. We have reviewed correspondence between the Bulgarian Ministry of Foreign Affairs and the Embassy of Azerbaijan from April 2015 which does show that Emco's name was fraudulently - or erroneously - included in the export request.

While the timing of this erroneous inclusion of Gebrev's company into a transaction seen by Russia as hostile, and his initial poisoning, is a remarkable coincidence, it is unlikely that there is a direct causal relationship between the two, as there would not have been sufficient time between the "set-up" and the poisoning operation. At the same time, it is beyond doubt that during 2015, 2016 and 2017 there were attempts to discredit Emco internationally, including through an English-language article in a Bulgarian newspaper that used the false export license application to implicate Emco in arms exports to ISIS-linked militants.

The journalist who authored the article incorrectly implicating Emco cited documents allegedly leaked to it from a little-known organization calling itself "Anonymous Bulgaria".  The only evidence of this organization's existence is a Twitter account which has posted almost exclusively Kremlin-aligned (dis)information, including an hacked email dump relating to an Azerbaijani company's alleged involvement in arms trading with ISIS-linked groups, as well as promoting a conspiracy theory that Azerbaijan used diplomatic mail to ship white phosphorus to Armenia for a false-flag attack. After being dismissed from the Bulgarian newspaper over the incorrect reporting, the journalist launched an English-language website called which publishes information and unverifiable claims focusing on the arms trade usually aligned with Russia's military-industrial complex. A recent publication alleging illicit Serbian arms exports to Ukraine (and citing 4-years-old data) appeared within hours of the escalation between the Serbian government and Russia following the publication of a surveillance video showing a GRU officer exchanging bags with a Serbian military officer in December 2018.

The long-term campaign against Emco -including by sources aligned and seem to be acting in sync with the Russian military - make it plausible that attempts may have started before the erroneous export application from April 27.

In the absence of logical alternative explanations, Gebrev's own hypothesis that he may have been targeted based on false information fed by competitors to the Kremlin, stands out as the most plausible scenario.

Identification Methodology

As we have reported earlier, GRU officers from Unit 21955 traveling undercover are issued passport in batches, and their passports are renewed approximately every two years. Each batch contains sequentially numbered passports, most of which are reserved to GRU officers. This has allowed us to identify all members of this GRU sub-unit by using as seed the cover identities - and associated passport numbers - of the trio of the Skripal-poisoning suspects.

The validation of a suspected officer from this unit can be done by searching for such suspect's domestic passport number, usually available from a number of leaked car registration or residential databases. Once the number is obtained, we can typically verify if a real person with that identity exists, by searching for that "persons"'s tax ID number on a Russian government-run website. Cover identities do not have a tax ID number, since they were removed the the tax database following our initial investigations into the Skripal suspects in 2018.

Identifying the real identity - the longest and most cumbersome process - requires trying various permutations of initial, patronyimic and family names, and using the cover persona's birth date, to locate a candidate with a residential address (current or historic) at one of several known addresses of GRU-linked dormitories.

A final step requires the photographic match between a photo of the cover identity with one of the suspected real identity. A number of different sources are used to locate photographs in each case, including social media (usually of family members), passport dossier files accessed via whistle-blowers, or Schengen visa application documents.

Bulgaria names Russians charged with poisoning linked to Skripal case  FEBRUARY 21, 2020

Bulgarian prosecutors on Friday named the three Russians they have charged with the attempted murder of three Bulgarians whose poisoning is being investigated for possible links with the 2018 nerve-agent attack on ex-Russian spy Sergei Skripal.

A police officer stands outside the London Road cemetery where the grave of Alexander Skripal; son of former Russian intelligence officer Sergei Skripal; is seen covered with a tent, in Salisbury, Britain, March 19, 2018. REUTERS/Peter Nicholls

Prosecutors said they had charged Sergey Viacheslavovich Fedotov, Sergey Viktorovich Pavlov and Georgi Gorshkov in absentia. They said the men, who used false identities when they travelled abroad, were currently living in Moscow.

Fedotov also went by the alias D.V.S. prosecutors said. The initials match the name Denis Vyacheslavovich Sergeev, a high-ranking officer of Russia's GRU military intelligence service, who operated internationally under the name Sergey Fedotov, according to investigative website Bellingcat.

In October 2018, Russian news website Fontanka named Fedotov as a suspect in the Skripal case.

Moscow never comments on the identity of GRU staff, but has denied involvement in the poisoning of Skripal.

"We have identified the men. The names we revealed are the ones we have worked with so far. We believe the initials we have also published represent their genuine identities," a spokeswoman for Sofia Prosecutor's Office told Reuters.

The three Russians were charged with trying to kill arms factory owner Emilian Gebrev and two other Bulgarians in Sofia between April 28 and May 4, 2015 by "intoxication with an unidentified organophosphorus substance," in a way that was "dangerous to the lives of many".

Gebrev and the two other victims fell ill but survived.

Prosecutors said they were cooperating with U.S. and British services on the investigation.

Bulgaria, a close satellite of Moscow during Soviet times, declined to join its allies in the European Union and NATO in expelling Russian diplomats over the Skripal case in 2018.

But it has recently adopted a tougher stance. Since October it has kicked out three Russian envoys accused of espionage and refused a visa for an incoming Russian military attache.
Mesajı Paylaş
Çoklar diye korkma
Azız diye çekinme...


An Officer And A Diplomat: The Strange Case Of The GRU Spy With A Red Notice

In its original series of investigations in 2018, Bellingcat identified three GRU officers: Maj. Gen. Denis Sergeev, Col. Anatoliy Chepiga and  Col. Alexander Mishkin, M.D., linked to the March 2018 Novichok poisonings in Salisbury.

In several follow-up reports, Bellingcat and its investigative partner The Insider disclosed the existence of a clandestine GRU team earmarked and trained for overseas disruptive operations and extraterritorial assassinations. This elite team is disguised as part of a larger GRU training unit referred to Military Unit 29155.

In a report from 7 July 2019, we tracked the frequent travels of officers from this GRU team to Switzerland in the period 2016-2018, with an especially high concentration of concurrent trips to the area near Lake Geneva at the end of 2017 and early 2018.

In two further investigations from 2019, we disclosed the link between this GRU unit and two poisoning attempts targeting Emilian Gebrev, a Bulgarian weapons manufacturer, his son, and his business associate in April and May 2018. We identified eight different GRU officers who had visited Bulgaria undercover in the months immediately preceding the poisoning, with three of these being in Bulgaria during each of the attempts.

On 23 January 2020, Bulgarian prosecutors announced indictments and issued Interpol wanted alerts against three of the GRU officers previously identified by Bellingcat. Authorities also released surveillance footage showing one of them wearing a disguise and approaching several cars in an underground garage where the poison victims' cars had been parked.

In this investigation conducted jointly with our partners Tamedia (Switzerland) and The Insider (Russia), we identify a key member of the recently indicted trio who, following the two failed assassination attempts in Bulgaria in 2015, was accredited to a diplomatic post under his real name in Switzerland. From his new base in Geneva, he continued to work for GRU under diplomatic cover, likely assisted various secret service operations in Switzerland, and may have taken part in the preparation of the Skripal poisoning.

As he was accredited by Russia through the end of 2020, this marks the first known case when a Russian diplomat is simultaneously wanted for attempted murder under an Interpol Red Notice. This GRU officer departed Geneva urgently midway through his four-year mandate following Bellingcat's disclosures and identifications of members of this GRU unit published in late 2018.

He traveled and worked undercover in the period 2008-2015 under the assumed name of Georgy Aleksandrovich Gorshkov, born 1977. In fact, his real name, under which he was accredited to the World Trade Organization in Geneva, is Egor Aleksandrovich Gordienko, born 1979.

What We Know About Gordienko

Egor Gordienko was born in 1979 in Bolgrad, a small town near Odessa, where his father, a military unit commander, had been stationed as part of the 98th Airborne Assault Division. His family hails from Tyumen, a city in Western Siberia. At some point in the early 80's, his father was relocated to Moscow and his family moved with him.

We have not been able to find out where Egor Gordienko's received his early education, but based on the credentials of other members of the clandestine GRU unit, it is not unlikely that after receiving his schooling he graduated from the GRU Academy in Moscow. His first international trip was in January 2007, was conducted under his real name, Gordienko, and involved a 12-day stay in Cairo. While domestic travel records indicate that at this time he was already working for the GRU, his undercover identity had not yet been created. Based on the oldest undercover identity document we have discovered so far, the clandestine undercover team within Unit 29155 was created in its current form in 2009.

Gordienko's first trip under his cover identity , as "Georgy Gorshkov", a made-up persona two years older than his real age, was in September 2010 when he traveled to Barcelona, Spain. During the remainder of 2010, he managed to take trips in quick succession to Finland, Ukraine, and Turkey. In 2011 and 2012, he only traveled to Ukraine and Turkey.

In 2013, "Gorshkov" also visited Ukraine and Turkey, but also made two trips to Tajikistan, both times with other members of the clandestine team, which included "Sergey Fedotov", i.e. the cover name for Denis Sergeev.

In February 2014, Gordienko traveled to Prague, and during July, October and November he made three long trips to Switzerland, France, and Italy, staying in the region for 45 days in the last quarter of that year.

During early 2014, Gordienko also made trips to Krasnodar and Crimea. Based on the pattern of his trips to Ukraine on the eve of the annexation of Crimea, and the known involvement of the clandestine GRU team in the annexation, we assume he also took part in that operation. Notably, in July 2014, Gordienko's family was granted an upscale apartment in the same Moscow building where Alexander Mishkin and Vladimir Moiseev also received apartments at the same time. Based on the timing and lack of evidence of payment for these apartments, we assume that they were gifted to (certain) members of the clandestine team as an incentive in addition to a governmental award. As Mishkin and Chepiga received their apartments as part of the bestowal of the "Hero of Russia" award over their role in the Crimea annexation, it is logical to assume the same holds true for Egor Gordienko.

Bulgarian Operation

On 11 February 2015, "Gorshkov" flew from Moscow to Sofia. Nine days later, he returned to Moscow, taking a flight from neighboring Greece. Bulgarian investigators assume that this was a reconnaissance trip in preparation for the assassination attempt on Emilian Gebrev. As we wrote previously, a number of other members of the same GRU team made "staggered" trips to Bulgaria in the first months of 2015, also likely as part of the operation's preparatory phase.

On 24 April 2015, "Gorshkov" flew back from Moscow to Bulgaria, this time landing in the seaside resort of Burgas. Two other members of the team- "Sergey Fedotov" (Denis Sergeev) and "Sergey Pavlov" (Sergey Lyutenko) - flew in on or around the same day. The three rented a car and moved on to the capital Sofia, where, according to Bulgarian prosecutors, they stayed at the Hill Hotel, and expressly requested rooms with a view to the entrance of an underground garage to the side of the hotel. This was the garage used by Emilian Gebrev's company, Emco.

At 13:57 on 28 April, one of the three -- who is thought to be the senior-most team member, Denis Sergeev -- can be seen in a wide-brim hat, shades, and gloves moving among cars in Emko's underground garage and presumably spraying the targets' car door-handles with a yet unidentified organophosphate poison.

Later that same evening, during a corporate dinner, Emilian Gebrev felt the early effects of severe poisoning, with the symptoms quickly worsening until he fell into a coma that evening. A blood and urine sample analysis conducted two months later by the OPCW-accredited Finnish laboratory VERIFIN showed that his vital functions had deteriorated severely, leading to, among other things, kidney failure. Gebrev was hospitalized at the Military Medical Academy in Sofia that same night, with his production director and son hospitalized with similar, albeit less severe, symptoms in the following few days.

As Gebrev was succumbing to the first symptoms of poisoning over dinner, "Gorshkov", "Fedotov" and "Pavlov took an evening flight from Sofia to Istanbul, and then took a connecting flight onward to Moscow that same night.

Gebrev did not die, nor did the two people who were also poisoned. Four weeks later, on 23 May 2015 "Fedotov" returned to Bulgaria, flying again to the seaside resort of Burgas. According to sources familiar with the investigation, he rented a car and disabled its GPS tracking system, making his movements in the next seven days unknowable. On 28 May 2015, "Georgy Gorshkov" also returned to Bulgaria, landing in Sofia.

On the night of 28 May Emilian Gebrev -- who was then convalescing at his seaside home a few dozen kilometers south of Burgas -- felt the onset of the symptoms he knew all too well. That same night, his son drove him back to the Military Medical Hospital in Sofia.

The next day "Gorshkov" and "Sergey Fedotov" drove from Sofia to neighboring Serbia, returning the rented car in Belgrade from where they both flew back to Moscow on 30 May.

"Georgy Gorshkov" never took another trip again.
Mesajı Paylaş
Çoklar diye korkma
Azız diye çekinme...


The Diplomat

Shortly after the failed Bulgarian operation, the persona of "Gorshkov" appears to have been decommissioned. However, the real person behind it, Egor Gordienko continued his work for the GRU.

During 2016, he took several flights from Moscow to the Siberian city of Novossibirsk, Krasnodar and Crimea, but his first international trip was not until 2017.

On 27 January, he flew on a diplomatic passport from Moscow to Geneva. Judging from a 2018 list, seen by Bellingcat, of all foreign diplomats accredited to Switzerland, Egor Gordienko was accredited as third secretary to the Russian mission at the Word Trade Organization in Geneva. However, Gordienko's name is not listed in any archived copy of the diplomatic lists published by the Russian Foreign Ministry. Several foreign diplomats based in Geneva told us they have no recollection of meeting Gordienko. However, an unidentified diplomat consulted by the Nightingale blog that first publicized Gordienko's real name said that they recognized him based on the photograph of "Gorshkov" that was published by Bellingcat.

The only open-source trace of Egor Gordienko's existence as a member of the Russian mission in Geneva comes in the form of online stats from two marathon runs in Geneva -- one from the popular Antigel 5-km run from January 2018, where he apparently finished 90th, with a time of 33 minutes, and a second one from December 2018, where he and his family were signed up but none of them showed up. In both races he is listed as a member of the Russian Mission.

Keith Rockwell, WTO's  Director of External Relations, confirmed to our investigative partner Tamedia that a person named Egor Gordienko was indeed accredited to WTO by the Russian Federation in 2017 on a term that was due to run until 2020 but was terminated prematurely in 2018. Mr. Rockwell said he did not know Mr. Gordienko nor his actual function, and stated that any of the WTO member governments can register any individual as part of their diplomatic mission, subject to authorization by the host country. A spokesperson for the Swiss foreign ministry also confirmed that Gordienko was accredited in January 2017, and that his accreditation was rescinded on 31 October 2018.

We attempted to get a clarification on Egor Gordienko's function at the WTO from the Russian Mission. Tamedia's query elicited a response from the Russian Mission's press officer, Daria Rudakova, who wrote that, "We have no information of the above-mentioned person". A follow-up email pointing to the oddity of a random stranger unknown to Russian officials being accredited to the WTO, and running marathons on behalf of the Russian Mission, remained unanswered. Our partner, The Insider, called Rudakova to follow up on this strange case of diplomatic amnesia. The press officer asked for several hours to investigate the matter, and then proceeded to stop answering her phone.

Potential Tasks in Geneva

It is not yet known what Egor Gordienko's main mission in Geneva may have been. Our review of phone metadata of his Russian phone (which he used primarily while in Russia) shows that in 2017 and 2018 he was in close working contact with Sergeev, Chepiga, Mishkin, and other members of Unit 29155. Thus, we can assume Gordienko's interests in Switzerland were similar to those of the other GRU team members, or that he provided a supporting role under diplomatic cover.

Based on our tracking of Denis Sergeev's mobile phone movements in Geneva, Sergeev appears to have visited the WTO compound on occasion, but this was clearly not his, and not the GRU's, main interest. Given frequent e-sightings of him at the Lausanne branch of the World Doping Association, the Lausanne Polytechnic Institute, as well as the frequent trips to locations near the ski slopes, it is more likely that those locations, among others, would have been of interest to Gordienko as well. Without metadata for Gordienko's Swiss mobile number, we are not able to analyze his movements in the same way we did this for Denis Sergeev.

However, it is notable that from December 2017 to February 2018, a constellation of several GRU officers from Unit 29155 traveled to Geneva, including Col. Anatoly Chepiga and Col. Alexander Mishkin, as well as the ubiquitous General Sergeev, whose last trip to Geneva was in late January. On many occasions, these officers several times postponed the return dates for their trips back to Moscow, indicating they were waiting for something to happen, or someone to arrive.

These trips occurred only two months before a crucial operation -- the poisoning of the former GRU double agent in Salisbury -- suggesting a possible link between the two operations.

Even more indicative of a link may be the trip of at least one officer from Unit 29155 to Geneva late in February 2018, just days before the Salisbury operation. GRU officer Nikolay Ezhov, travelling under his cover identity of Nikolay Kononikhin, arrived in Geneva on 21 February 2018. He had no return ticket, implying that he did not know how long his assignment might last. Ticketing records show that on 1 March 2018, he appeared at the airport at 22:30 and bought a last-minute ticket for a plane to Moscow departing only an hour later. It was that same evening that Sergeev, Mishkin and Chepiga bought their last-minute tickets to fly into London the next day.

Nikolay Ezhov was one of the GRU officers involved with the preparation for the Bulgarian poisoning in 2015, and he stayed in Sofia for approximately two weeks in February and March, presumably tracking and collecting reconnaissance on the target. While his presence in Geneva might well have been part of a different mission, the very small clandestine team of Unit 29155 is unlikely to have had the capacity to work on two important overseas operations at the same time.

Notably, upon his return to Moscow for the summer recess on 4 July 2018, three months after the Skripal operation, Gordienko immediately called Sergeev, Mishkin, Chepiga and Ezhov, in this exact sequence.

Meanwhile, the Swiss Foreign Ministry told Tamedia they were not aware of Egor Gordienko's activities outside his accredited diplomatic function.

Postus Interruptus

At 8:21 p.m. on 25 October 2018, Egor Gordienko bought a last-minute ticket to Moscow for a flight departing at 10:40 that night. He bought a two-way ticket with a return flight for 31 October. However, he never returned to Geneva, and never traveled outside Russia again.

Flight records show he arrived at Moscow's Sheremetyevo airport at 2:45 a.m. His phone metadata shows that at 7:05 a.m. he was already at the GRU headquarters at Khoroshevskoe Chausse 76B. At that time, he called his boss, General Andrey Averyanov, the commander of Unit 29155. He stayed at the HQ address for the whole day, and after 5 p.m. he began calling all his colleagues in sequence, presumably to inform them that he was back for good.

On 31 October, Egor Gordienko did drive to the airport after all. However, he did not to take his return flight to Geneva, but to pick up his family, who were also returning home. The family's names on the 1 December run status website would remain without run-times.

It is not exactly certain why Gordienko left suddenly on 25 October 2018. However, it is almost certain that the premature departure was triggered by the waterfall of disclosures on the identity and modus operandi of the clandestine team he was a member of. Only a couple weeks earlier, Bellingcat had identified his colleagues, "Boshirov" and "Petrov", as Col. Chepiga and Dr. Mishkin, and days earlier his direct superior "Fedotov" had also been outed as Denis Sergeev. And earlier that same day, we had published a lighter story: a case study on how we were able to exactly chrono-locate a 2014 photograph Col. Chepiga had posted from Prague. Little did we know then that Egor Gordienko, a.k.a. "Georgy Gorshkov", had been in Prague on that same day.

The Search for Gordienko  
Our search for the real identity of "Gorshkov" was one of the longest and most difficult GRU identification projects. We became aware of a GRU officer traveling under the alias of "Georgy Gorshkov" in October 2018. This became possible following the discovery of another senior GRU officer, "Sergey Fedotov", who had traveled to the United Kingdom during the time when Sergey and Yulia Skripal were poisoned with Novichok.

Using a leaked offline database of flights of Russian citizens in the 2014-2016 period (available as a torrent download from a number of Russian websites), we searched for co-travelers of "Fedotov" having similar passport number series. One of the persons we identified was "Georgy Gorshkov" born 2 February 1977, who had flown with 'Fedotov" to and from Bulgaria during the time Emilian Gebrev and his son had been poisoned in April 2015.

"Gorshkov"'s passport differed in only the last two digits form "Fedotov"'s and after their Bulgarian operation, both had returned to Moscow on the same flight from neighboring Serbia.

We then tried to obtain a copy of "Gorshkov"'s passport file from a whistleblower with access. We were informed that no such passport file existed, which is consistent with our understanding that Russian security services had begun purging passport files of cover identities following our disclosure of the identities of Col. Mishkin and Col. Chepiga.

We were able to obtain a copy of "Gorshkov"'s Russian border crossing records from a different whistleblower. These also contained a poor-quality scan of his latest passport photo. We discovered that the border-crossing records had been meddled with, likely in order to frustrate a possible external investigation.

Due to the fact that we had a copy of "Gorshkov"'s travel records from the 2014-2016 flight database, we were able to compare the two sets and identified a pattern of data manipulation: all travel records during the Bulgarian operation time-frame had been fast-forwarded three years into the future, showing 2014 trips as having occurred in 2017, and so on. We knew that the correct dataset was the one from the offline flight database, as it had been leaked in 2016, before our identification of the first member of the clandestine GRU team.

After reverse-engineering the border crossing records to match the non-manipulated offline-data set, we found that "Gorshkov"'s last trip under this cover identity was the return trip from the second Bulgarian trip in 2015. Unlike all other members of Unit 29155 identified by us, he never traveled in 2016, 2017 or 2018. This outlying status made us believe he may have been "de-commissioned" from active service or, indeed, might have died.

Our standard approach to identifying the real identity of GRU officers brought no results. There were no people with the same first name and birth date as "Gorshkov" registered to any Moscow addresses known to be linked to GRU or Spetsnaz bases. We searched for any similar combinations of names and birth dates but to no avail. The identification project for "Gorshkov" had come to a dead end.

Nearly a year later, after our positive identification of Gen. Andrey Averyanov as the commander of unit 21995, we identified his telephone number via a Moscow car registration database leaked in 2018. We then obtained Averyanov's call records from a whistleblower working at a mobile operator.

While analyzing his records we identified a number that, according to the caller-id app GetContact, belonged to a person named Egor Gordienko. We looked up this person's name in an offline Russian residential database, and found four Moscow residents with this name combination. None of them were registered at the known GRU addresses, but one of them had a birth date of 2 February 1979. The similarity between the birth dates of 2 February 1977 (Gorshkov) and 2 February 1979 (Gordienko) and the overlap between the first letters in the name led us to the working hypothesis that Gordienko is in fact be the officer behind the "Gorshkov" alias.

At this point, we obtained the border-crossing data for Egor Gordienko, which contained a recent photograph. A facial comparison between this photo and "Gorshkov"'s photo gave us a sufficiently high match factor to conclude this was the same person.

Mesajı Paylaş
Çoklar diye korkma
Azız diye çekinme...


Two Russians Arrested for Assassination Attempt on Chechen Dissident Blogger

Two Russian citizens have been arrested in Sweden suspected of a hammer attack last month on a  blogger critical of Chechen strongman leader Ramzan Kadyrov, media reported Saturday.

A district court in the central Swedish town of Gavle on Friday ordered a Russian woman in her thirties held in custody, suspected of being an accessory to the attempted murder of Tumso Abdurakhmanov on February 26.

A 29-year-old Russian man was previously detained by the court for attempted murder.

After the alleged attack, Abdurakhmanov posted a video showing the assailant, whom he had apparently overpowered, covered in blood. He also brandished the hammer that he said the assailant wanted to kill him with.

The Chechen blogger claimed the man was sent by Russia to kill him.

"We're working on trying to establish the motive... and of course we'll take into consideration the remarks made by the plaintiff," prosecutor Therese Jansson told daily Svenska Dagbladet.

Abdurakhmanov, 34, has lived in exile since 2015 after receiving what he describes as threats to his life from Chechnya.

According to Swedish daily Dagens Nyhether, he has been living in hiding in Sweden since 2019, after being denied asylum in Poland.

His YouTube video blog critical of Kadyrov has some 75,000 subscribers.

The attack comes amid growing concern over the security of Chechen dissidents living in Europe and elsewhere after repeated reports of attacks.

Initial suspicions of attempted murder of the assailant by Abdurakhmanov have been dropped, the prosecutor said. Mesajı Paylaş
Çoklar diye korkma
Azız diye çekinme...

Paylaş delicious Paylaş digg Paylaş facebook Paylaş furl Paylaş linkedin Paylaş myspace Paylaş reddit Paylaş stumble Paylaş technorati Paylaş twitter