The Atlanta Journal-Constitution
Busy Russian assassins An unexpected breakthrough
The poisonings of a Bulgarian arms dealer in 2015 helped Western intelligence agencies to discover Unit 29155.
SOFIA, Bulgaria — The Russian assassin used an alias, Sergei Fedotov, and slipped into Bulgaria unnoticed, checking into a hotel in Sofia near the office of a local arms manufacturer who had been selling ammunition to Ukraine. He led a team of three men. Within days, one man sneaked into a locked parking garage, smeared poison on the handle of the arms manufacturer’s car, then left, undetected, except for blurry images captured by surveillance video. Shortly after, the arms manufacturer, Emilian Gebrev, was meeting with business partners at a rooftop restaurant when he began to hallucinate and vomit.
The poisoning left Gebrev, now 65, hospitalized for a month. His son was poisoned, and so was another top executive at his company. When Gebrev was discharged, the assassins poisoned him and his son again, at their summer home on the Black Sea. They all survived, though Gebrev’s business has yet to recover fully.
The assassination attempts in 2015 were remarkable not only for their brazenness and persistence, but also because security and intelligence officials in the West initially did not notice. Bulgarian prosecutors looked at the case, failed to unearth any evidence and closed it.
Now Western security and intelligence officials say the Bulgaria poisonings were a critical clue that helped expose a campaign by the Kremlin and its sprawling web of intelligence operatives to eliminate Russia’s enemies abroad and destabilize the West.
“With Bulgaria, there was an ‘aha’ moment,” said one European security official, who spoke on condition of anonymity to discuss classified intelligence matters. “We looked at it and thought, damn, everything aligned.”
Entering his third decade in power, President Vladimir Putin of Russia is pushing hard to re-establish Russia as a world power. Russia cannot compete economically or militarily with the United States and China, so Putin is waging an asymmetric shadow war. Russian mercenaries are fighting in Syria, Libya and Ukraine. Russian hackers are sowing discord through disinformation and working to undermine elections.
Russian assassins have also been busy.
In October, The New York Times revealed that a specialized group of Russian intelligence operatives — Unit 29155 — had for years been assigned to carry out killings and political disruption campaigns in Europe. Intelligence and security officials say the unit is responsible for the assassination attempt last year against Sergei V. Skripal, a Russian former spy in Britain; a failed operation in 2016 to provoke a military coup in Montenegro; and a campaign to destabilize Moldova.
Western intelligence agencies now know the name of the unit’s commanding officer, Maj. Gen. Andrei V. Averyanov, and the location of its headquarters in Moscow. Based on interviews with officials in Europe and the United States, it is also now clear that the assassination attempts against Gebrev served as a kind of Rosetta Stone that helped Western intelligence agencies to discover Unit 29155 — and to decipher the kind of threat it presented.
Since the original Times story, more information has come to light, including the true identities of some of the unit’s members and other possible activities in Spain and France. This month, Germany expelled two Russian diplomats as punishment for the daylight assassination in Berlin of a former Chechen rebel commander, though it is unclear whether operatives from 29155 were involved.
Security and intelligence officials are still working to understand how and why the unit is assigned certain targets. Even now, investigators have not determined the precise motive in the Gebrev case. Most likely, intelligence officials say, Gebrev was a target because of the way his business rankled the Kremlin: his arms sales to Ukraine, his company’s intrusion into markets long dominated by Russia, and his efforts to purchase a weapons factory coveted by a Russian oligarch.
“I have been thrown to the wolves,” Gebrev said. “But why and how, I’m still asking myself.”
A visit to the afterlife
The poison took effect slowly. Gebrev first realized something was wrong on the evening of April 27, 2015, when his right eye suddenly turned “as red as the red on the Russian flag.” It felt, he said, as if someone had dumped a bucket of sand into his pupil.
The next evening, Gebrev went to his favorite restaurant on the 19th floor of the Hotel Marinela, a luxury hangout in Sofia, the Bulgarian capital, where the clientele can pose for selfies with the peacocks wandering freely around the bar. At dinner, Gebrev began to vomit and was rushed to a military hospital. There, he began to see explosions of vivid colors. Then, his field of vision suddenly turned to black and white.
As his hallucinations intensified, he imagined angry, fantastical creatures that threatened to drag him away.
“I visited the afterlife three times, by my estimate,” he said in one of a series of interviews conducted over the past halfyear. “The doctors said they almost lost me.”
A day later, the company’s production manager, Valentin Tahchiev, was hospitalized, too. Days after that, Gebrev’s son, Hristo, who was being groomed to lead Gebrev’s company, Emco, was also rushed to intensive care.
“When they get rid of me and my son, the company will be destroyed,” Gebrev said later. “Who would sign contracts? Who has the rights?”
For the next month, as Gebrev recuperated in the hospital, Bulgarian authorities made little progress on the case. In a former Soviet satellite country with a long history of contract killings, the Bulgarian news media barely paid attention. The prosecutor general suggested that the elder Gebrev had been sickened by tainted arugula. Eventually, though, officials concluded that all three men had been poisoned.
In late May, Gebrev was released from the hospital and joined his son at the family vacation home on the Black Sea. There, the two men were poisoned again. This time, the symptoms were less dramatic and they drove themselves back to Sofia and checked into the same hospital for about two weeks.
Despite two poisonings, Bulgarian prosecutors failed to unearth any leads or evidence. Bulgarian intelligence agencies never reported detecting a Russian assassination team in the country, and possibly never realized it had been there.
“Anytime it’s linked to something with Russia, Bulgarian intelligence is very impotent,” said Rosen Plevneliev, who was Bulgaria’s president at the time of the poisonings. “Bulgarian intelligence is not willing to counter Russian intelligence and hybrid warfare.”
When the hospital failed to determine the substance used in the poisoning, Gebrev enlisted a Finnish laboratory, Verifin, which detected two chemicals in his urine, including diethyl phosphonate, which is found in pesticides. The other chemical could not be identified.
By the following summer, Bulgarian authorities had dropped the case. They apparently had no idea that Unit 29155 even existed. Neither did intelligence and security officials in the rest of Europe.
Yet as Gebrev’s case remained colder than cold, members of Unit 29155 were very busy, according to partial travel records reviewed by The Times. From 2016 to 2018, operatives made at least two dozen trips from Moscow to different European countries.
Their operation in Bulgaria most likely would never have been detected.
Then there was another poisoning.
In March 2018, a former Russian spy named Sergei V. Skripal was poisoned by a lethal nerve agent in the English town of Salisbury. He began ranting at a restaurant and fell into a coma before clawing his way back to life. It was the first recorded use of a chemical weapon in Europe since World War II, and it touched off a frantic investigation to determine the extent of the threat.
British prosecutors attributed the attack to assassins working for Russia’s military intelligence agency, known widely as the G.R.U. Working with European allies, British authorities analyzed travel records of known Russian operatives. One stood out, a man using a Russian passport with the name of Sergei Fedotov.
For five years, he had traveled extensively in Europe, visiting Serbia, Spain and Switzerland. He was in London a few days before Skripal was poisoned, leaving shortly after that attack, and British authorities have now identified him as the commander of the team that poisoned Skripal. It also turned out that he had been in Bulgaria in 2015, making three visits: in February; in April, when Gebrev was first poisoned; and again in late May, coinciding with the second poisoning.
Investigators from the Britain-based open-source news outlet Bellingcat have identified the man using the Fedotov alias as Denis V. Sergeev, a high-ranking G.R.U. officer and a veteran of Russia’s wars in the North Caucasus. British authorities confirmed the accuracy of the report.
The revelation that he was connected to the poisonings in both England and Bulgaria was critical in helping Western officials conclude that these were not one-off Russian attacks but rather part of a coordinated campaign run by Unit 29155.
In recent weeks, another operation possibly involving the man known as Fedotov has emerged in Spain. The highest criminal court there is investigating whether Fedotov and other Russian operatives might have had some involvement in protests that destabilized Catalonia in October 2017. Travel records show that he arrived in Barcelona a few days before the region held an independence referendum that month.
During his visits to Bulgaria two years earlier, Fedotov was joined by other officers. For the April 2015 poisoning, it was two men using the aliases Georgi Gorshkov and Sergei Pavlov, according to two European security officials, who requested anonymity to discuss sensitive intelligence matters. The man using the Pavlov identity also visited London a year before the Skripal poisoning, possibly in preparation for the attack.
Armed with new evidence provided by the British, the Bulgarian prosecutor general, Sotir Tsatsarov, reopened the case in October 2018. Almost immediately, investigators discovered fresh clues. Before the initial poisoning, Fedotov and two other operatives from Unit 29155 had checked into the Hill Hotel, in the same complex where Gebrev has his office. They insisted, prosecutors now say, on rooms with views of the entrance to an underground parking garage where Emco executives kept their cars.
In the garage, prosecutors discovered grainy surveillance video that showed a well-dressed figure approaching Gebrev’s gray Nissan, as well as the cars owned by Gebrev’s son and by the production manager. The figure appears to smear something on the handles of all three cars. Western intelligence officials have surmised that the substance was a poison.
This month, the office of Tsatsarov, the prosecutor general, confirmed the existence of the video — but said that its poor quality prevented investigators from identifying the well-dressed figure. Tsatsarov, whose term ended last week, has sent the video for analysis by the Federal Bureau of Investigation.
Travel information shared with The Times shows that all three assassins with Unit 29155 left Bulgaria on April 28, as Gebrev lay in the hospital imagining monsters trying to tear him apart.
Bad arugula?
There is little doubt that Gebrev’s profession — the manufacture and sale of munitions and light weapons — places him in a risky field, especially in Bulgaria. In recent years, the Kremlin has grown increasingly alarmed as smaller countries have nibbled away at Russia’s dominance in the arms industry. At a meeting in June with high-ranking security officials, Putin warned that Russia’s position in the industry was threatened.
“New factors, complicating our work with our partners in military and technical cooperation — including competitive fights and increasingly aggressive use of unscrupulous methods of political blackmail, and sanctions — demand attention and an adequate response,” Putin said. “We need to do everything we can to preserve Russia’s leading position in the world arms market.”
Bulgaria now sells about $1.3 billion in weapons annually, a relatively modest figure for the sector but a sum that has not gone unnoticed by Moscow. Tihomir Bezlov, a security analyst, says he believes that is what made Gebrev a target.
“This is really big trouble for Russia,” said Bezlov, of the Center for the Study of Democracy in Sofia. “We don’t produce planes and tanks, but in this area of light weapons, this is serious competition.”
Gebrev’s business grew out of the collapse of communism. When a scramble ensued for control of weapons factories, the new Bulgarian government blocked Russian buyers and doled out export licenses to men like Gebrev. He has since moved into areas long dominated by Russia, including the Indian market, where he describes himself as “a niche player.”
“While Russia is exporting ammo worth billions of euros, we are exporting for millions or hundreds of millions,” Gebrev said. “But never mind, we’re winning tenders and they’re dreaming and thinking that the markets belong to them.”
Emco, Gebrev’s company, also made sales to Ukraine, Russia’s enemy. At the outset of Ukraine’s war with Russian-backed separatists in 2014, Emco signed a contract with the Ukrainian government to supply artillery ammunition, according to Sergii Bondarchuk, a former head of one of Ukraine’s state-controlled arms companies.
Gebrev also was entangled with another project that might have displeased Moscow. Shortly before he was poisoned, Gebrev tried to buy Dunarit, a large arms production plant in Bulgaria coveted by a Kremlin-backed oligarch.
Unlike many wealthy businessmen in Bulgaria, Gebrev has no bodyguard and prefers to drive himself. But he remains jumpy. Last fall, a surveillance camera at his home captured infrared images of a spectral figure with a mask snooping around outside.
“I would be the happiest man on earth if the poisoning didn’t take place and I felt sick because I had eaten some bad arugula,” he said later. “I don’t see myself as so important that someone would try to kill me.”