GRU "murderous eight" at the heart of poisoning Emiliyan Gebrev with Novichok

A team of eight officers, members of unit 29155 of the Russian military intelligence (formerly known as GRU), is at the heart of poisoning Bulgarian businessman Emiliyan Gebrev in 2015, show the results of a joint investigation carried out by websites Bellingcat, The Insider and Der Spiegel magazine.

The investigative sites have repeatedly reported that the GRU officers were implicated in Gebrev’s poisoning attempt but now their team has managed to identify the real names and the cover names of unit 29155 agents (read more about the activity of unit 29155 here) and to throw more light on the occurrence circumstances and the possible motivation behind the attempt on Gebrev’s life. 

On 28 April 2015, Emiliyan Gebrev felt a burning sensation in his eyes. His sight failed and he started seeing bright coloured stripes, like those on an old TV set. Fortunately there were many people around as everything happened during a reception which Gebrev threw for his partners.

The businessman was urgently admitted to hospital. His son, who at that time was at the other end of the city, felt approximately the same symptoms, as well as Gebrev’s production manager who was also far away from the scene. The only circumstance that the three cases share in common is the fact that in the morning of the same day all three of them were at the company’s head office based in the Orbita hotel in Sofia.    

Later (already in 2019) the investigators identified on the hotel’s parking camera footage the GRU officer Denis Sergeev (cover name Sergey Fedotov). He was the same Sergey who arrived in Great Britain along with “Boshirov” and “Petrov” on the day when Russian-British double agent Sergey Skripal and his daughter were poisoned. Meanwhile the lab of the Helsinki University specialising in chemical warfare managed to establish in Gebrev’s urine and blood samples traces of organophosphates which evidenced that there was an attempt to kill the businessman with a nerve agent similar to Novichok.   

With this in view, all questions as to who stands behind the assassination become irrelevant. However, according to what The Insider, Bellingcat and Der Spiegel managed to get at having in mind all the facts, Sergeev was not the only executive agent and at least eight GRU officers took part in the operation.

Judging by the ticketing database the group of poisoners came to Bulgaria on three occasions. For the first time (likely it was the first attempt or “groundwork” for the main operation) it was in February of 2015. Initially three of them arrived: Sergey Fedotov (real name Denis Sergeeev), Sergey Pavlov (Sergey Lyutenko) and Georgi Gorshkov (Piotr Borissov). They stayed in Bulgaria for a week, from 15 to 22 February and then were changed by Ivan Lebedev (Ivan Terentiev), Nikolay Kononikhin (Nikolay Ezhov) and Alexey Nikitin (Alexey Kalinin). These trio also stayed for about a week (from 26 February to 8 March). In turn, they were replaced by Vladimir Popov (Vladimir Moiseev) known for his invilvement in the failed coup attempt in Montenegro. He remained in Bulgaria for another five days – from 6 March to 11 March.

The team came for a second time to carry through the poisoning operation. Fedotov, Pavlov and Gorshkov arrive on 24 April and leave on the day of the assassination, 28 April.

For the third time Fedotov came together with Danil Stepanov (Danil Kapralov) on 23 May.

They stay in Bulgaria for a week as Gorshkov joins them in the last two days. It is not clear if this is a coincidence but in May Gebrev felt bad again and was again admitted to hospital.

There’s one curios detail – apart from being a GRU-trained officer Danil Kapralov is also a medical doctor, which he shares in common with Alexander Petrov (Mishkin), one of the poisoners of Skripal in Salisbury.

How the poisoners were identified

As the investigative sites Bellingcat and The Insider previously reported, foreign travel passports are issued to the officers of GRU (and other Russian services working abroad) every several years and their serial numbers are consecutive. That is why when a passport of one of the officers is identified it is not difficult to see the similar passport numbers of his teammates. As for the real names, they can be easily established because the “shrewd conspirators” of GRU more often than not leave to their undercover agents their original birth data, hence their names can be readily found in the Russian databases.

After the recent disclosures by Bellingcat and The Insider the GRU officers saw how easily they can be spotted in the available databases and started to take painstaking care about their clandestine security. They began to replace their photos and other data in their cover personae’s files. However, they shouldn’t have done it because in the long run in the files of men there appeared female photos and the passport data of completely different people, which only helped to conclude that these are the files of spies.

Comparing the photos (no yet replaced) in the available Russian databases with the photos which the GRU agents made when they applied for Schengen visas in some instances we can clearly see that one and same person matches the real name and the cover name. Here are two photos, for example – on one of them is Nikolay Kononikhin (born 01.01.1978 and on the other – Nikolay Ezhov (born 01.01.1978). Isn’t it a perfect coincidence!

The same applies to the photos of Sergey Lyutenko (born 09.12.1981) and Sergey Pavlov (born 09.12.1981), as well as those of Danil Stepanov (born 23.03.1983) and Danil Kapralov (born 23.03.1983).

The face of Sergeev/Fedotov is known from numerous other publications, but his photo for a Schengen visa is of better quality and so it can be used as additional evidence.       

Why Gebrev was poisoned

The investigation is yet to find out what are the real motives behind Gebrev’s poisoning, so far they are not clear even to the victim. Gebrev’s company exports arms although not at a scale that could cause problems for the Kremlin. For instance, Gebrev did export weapons to Georgia during the 2008 war, but, according to Geberev himself, his supplies accounted for not more than 10% of the bulk Bulgarian arms supplies for this country. He is also adamant that he has never supplied weapons to Ukraine, directly or indirectly, after the outbreak of the conflict with Russia in 2014.

According to one of the leads, GRU targeted Gebrev as a result of provocation which made the Kremlin suspect that he was selling arms to the US allies in Syria. In 2015, several of the Bulgarian producers competed for the US defence contracts for arms supplies to the Syrian insurgents. Gebrev maintains that his Company Emco didn’t take part in it as his main customers, India and the countries of North Africa, asked for largescale supplies and all of his resources were focused on fulfilling these export commitments. So, a day before the poisoning (27 April) the Bulgarian Ministry of Foreign Affairs filed an export license application for a shipment of arms to Azerbaijan (allegedly intended for Syria). Gebrev claims that it was forged by his competitor (he believes he knows who it was but refuses to name him). Gebrev thinks that his competitor has very close connection with the Kremlin and tried to eliminate his business presenting the forged export license to Moscow.     

The Insider, Bellingcat and Der Spiegel have thoroughly studied the correspondence between the Bulgarian foreign ministry and the embassy of Azerbaijan and found out that initially Emco was the company which had to deliver weapons on 5 May. However, in the next letter the names of other suppliers, Transmobile and Alguns are mentioned instead of Emco.  

There is one problem though: the fact is that GRU (read more about GRU activity here) started to prepare the operation already in February, i.e. the forged document could not be the motive for the assassination. If the incident with the forged export license application has some bearing on poisoning at all, it means that either the forgery was one of the numerous provocations on the part of the competitors or GRU itself had forged the document to furnish grounds for the assassination (in that case the real motivation behind the poisoning remains moot).

Similar articles