صاحب‌خبر - It began with a simple request, though it was written by one of the world’s most wanted men. “We’d be interested in a Bulgarian guy working for Bellingcat: Christo Grozev,” the author wrote at 7.46pm on 14 December 2020. Another message followed on Telegram: “Can we look into this guy or would it raise too many questions?” And so a spy ring of Bulgarians based in Britain but working for Russia began to form. The author was Jan Marsalek, a fugitive businessman accused of involvement in a €1.9bn fraud on the German payments company Wirecard – and an agent for Russia. Earlier that year he had fled to Moscow, and now he had time on his hands. The message’s recipient was Orlin Roussev, 47, an IT specialist and private investigator who had been based in the UK for several years – and somebody Marsalek appeared to know well. Their target was a high-profile investigative journalist who specialised in investigating Russia’s spy agencies. Earlier that day, Grozev and colleagues at the Bellingcat website had published a major investigation. They had implicated eight members of Russia’s FSB spy agency – and by inference Vladimir Putin’s Kremlin – of poisoning the Russian opposition leader Alexei Navalny with novichok, lacing his underpants, it later emerged, with the neurotoxin. graphic After hundreds of hours of surveillance of Grozev, and a few weeks before the spy ring was rolled up by British investigators, Marsalek messaged Roussev to say he did not find the journalist an appealing target but “apparently Putin seriously hates him”. What followed in the two and a half years after that first message was sent was not one plot, but several. At Marsalek’s direction and funding, Roussev built a network of Bulgarians whose activities stretched across Europe – from Vienna to Valencia, Stuttgart to Montenegro. Their work included intensive surveillance, magnified by talk of kidnap and murder, but there was also bluster and bravado, amateurish planning and chaotic mistakes. And in the background was a tangle of relationships, a love triangle and a fake cancer diagnosis. All three defendants told the court they had been manipulated, and two of the three even said they had thought they were working for Interpol, not Russian intelligence. Much of this played out in court seven at the Old Bailey during a three-month trial of three of those involved, described dismissively by Roussev as “the minions”. The defendants were each charged with a single count of espionage, which they denied – saying they had been manipulated. But the most revealing details emerged in the extraordinary dialogue – across 78,747 Telegram messages – between the ringleader, Roussev, and his boss, Marsalek, that police had been fortunate to find. The key breakthrough, officers acknowledged, was finding the messages on Roussev’s phone: the IT specialist had forgotten to press delete. Body-worn camera footage of Roussev’s arrest at his home, a former guesthouse in Great Yarmouth, shortly after 6am on 8 February 2023 shows officers finding hundred of thousands of pounds’ worth of IT equipment piled up in several rooms in what Roussev called his “Indiana Jones garage”. With police officers at his throat, Roussev boldly tried to claim “I think it’s the wrong place” – but the weight of evidence was such that he pleaded guilty to espionage before the trial began. In December 2020, when Marsalek asked Roussev to start collecting information about Grozev, Russia’s full-scale invasion of Ukraine was still more than a year away. In Britain, MI5 hoped that Russian spying was at a low ebb. After the UK had expelled 23 Russian diplomats іn 2018 after the poisoning of Sergei Skripal and his daughter, Yulia, Moscow was believed to no longer have any traditional embassy-based spies at its disposal. Keen to maintain its espionage activities however, the Kremlin concluded new methods were needed, recruiting criminals and the naive, often without training, to carry out its dirty work. Prosecutors and police concluded the spy ring was involved in six main plots. The first – and one of the two most important – was the intensive surveillance of Grozev across Europe, coupled with efforts to seize his laptop, a particular obsession of Marsalek’s. Grozev had worked with Navalny – before the latter’s ill-fated return to Russia – on the investigations exposing the poisoning plot and its links to the FSB, which had embarrassed the Kremlin. “Our friends are 95% certain Grozev is ‘managed’ by MI6,” Marsalek wrote in January 2022. Jan Marsalek. At Marsalek’s direction, Roussev first orchestrated the surveillance of a villa linked to Grozev in his native Bulgaria. The effort then expanded to Vienna, where the journalist lived, and then to following him to a Bellingcat conference in Valencia, Spain. A camera was trained on Grozev’s apartment in Vienna, though they discovered he was living at his father’s flat out of town. His post was intercepted. Marsalek and Roussev discussed hacking his wifi in Vienna – and they regularly debated kidnapping him or worse, though abduction plans did not develop. It “feels like we must poison him next, just to live up to past stories”, Marsalek wrote to Roussev in September 2021. Roussev found a way to obtain airline reservations and told Marsalek he was paying somebody at Swissport, which provides airport services, €1,000 a month to access the system. They monitored Grozev’s travel plans and worked out he was going to the Bellingcat event in Valencia in September 2021. Plans were made to follow him, but Roussev did not carry out surveillance himself – in fact, he was not described as having left the UK at all. To carry out the operations on the ground, Roussev needed a team. Biser Dzhambazov, 43, was a medical courier working in London and a close friend of Roussev. The operation’s number two, he called himself Max, or “Mad Max”. In his WhatsApp chats with Roussev, he called himself “Van Dam”, after Jean-Claude Van Damme, while his boss was “Jackie Chan”. Dzhambazov was described in the trial as a larger-than-life character, always laughing and joking – “the soul of the party”, one defendant said. Like Roussev, he pleaded guilty and did not appear or give evidence in the trial. In August 2021, as the surveillance of Grozev in Vienna was getting going, Dzhambazov’s personal life was becoming more complicated. He had known Katrin Ivanova, 33, a lab technician and the first defendant in the spy trial, since she was 17 and had lived with her for years. They worked at the same firm and lived in a one-bedroom flat in Harrow, north-west London. But that spring he had met the second defendant, Vanya Gaberova, 30, a beautician, and by August he was declaring his feelings for her – insisting his relationship with Ivanova was effectively over. View image in fullscreen A selfie of Vanya Gaberova and Biser Dzhambazov shown to the jury. It was not, and Dzhambazov ended up dating both women. (Neither of the women had met before the trial began; both ended up having to sit in the dock). When police moved to arrest Gaberova, also shortly after 6am on 8 February 2023, they found her in bed with a naked Dzhambazov in a flat near Euston that he and Ivanova were supposed to have moved into one day. He had falsely told both women he had brain cancer, and used the lie and his surveillance activities to create opportunities to spend time with Gaberova away from London, or by himself. Ivanova’s defence was that she had been manipulated by Dzhambazov, with whom she said she had been in an abusive relationship, though it was not violent. She told the jury she had no idea she had been spying for Russia, portraying herself as apolitical. Instead, she said she had been told Grozev was a corrupt journalist and she was going to help expose his relationship with an arms dealer. The chief prosecutor, Alison Morgan KC, used Ivanova’s personal life to try to show she was not a naive victim but somebody with her own judgment and agency. Morgan described Ivanova as a liar but “not a stupid person”, and she forced her to admit to the court that she had also been having an affair. “Who’s Stoyan?” Morgan asked. Ivanova demurred before admitting she had had an affair, but she fought back. Yes, she and Dzhambazov had had an open relationship, but she had told him what she had done, whereas he had “been in a parallel relationship with somebody for 18 months”, she said. After police arrested Ivanova at work, they recovered 11 fake passports and identity documents in the flat she shared with Dzhambazov – of which she said she was unaware – and several surveillance devices, which she acknowledged she had known about, though she said they belonged to Roussev. The most memorable of these was a spy camera hidden in a large modified plastic Coca-Cola bottle and another hidden in the flower of a Minion toy from the Despicable Me film series, both of which were passed to a curious jury for inspection. View image in fullscreen A spy camera hidden in a Coca-Cola bottle, recovered by police from a flat in Harrow, north west London, where Biser Dzhambazov and Katrin Ivanova lived Grozev was followed by Ivanova while taking a flight from Vienna to Montenegro in June 2022. To keep an eye on him, she wore a pair of surveillance glasses. Except, when it came to proving that he had got on the plane, she chose to photograph him on her mobile phone and send the picture to Dzhambazov. The process of monitoring was neatly recorded by the special glasses and the footage of Ivanova recording herself was obtained by police and played to the jury as an example, prosecutors said, of the level of surveillance of the journalist. Another target of interest to Marsalek was a Russian investigative journalist living in exile in the UK, Roman Dobrokhotov. Scanning of flight records by Roussev, with the help of the corrupt Swissport employee, had found the journalist was due to fly from Budapest to Berlin on 26 November 2021. “I absolutely LOVE that airline system,” Marsalek wrote when Roussev told him the news, and he said he would “love to kidnap” him. Roussev was able to book tickets for Ivanova to sit in seat 4B next to Dobrokhotov. Ivanova covertly filmed the reporter during the flight, coolly placing her phone on record and leaving it in a pocket in a TK Maxx bag. She even managed to see and memorise the pin to unlock his phone. “Our agent was very, very observant,” Roussev wrote to Marsalek. Ivanova told the jury she took on the job simply because she was asked to by Dzhambazov. “I was supporting a partner,” she told the court, and insisted she felt no fear in secretly recording the reporter. skip past newsletter promotion Sign up to First Edition Free daily newsletter Our morning email breaks down the key stories of the day, telling you what’s happening and why it matters Enter your email address Sign upPrivacy Notice: Newsletters may contain info about charities, online ads, and content funded by outside parties. For more information see our Privacy Policy. We use Google reCaptcha to protect our website and the Google Privacy Policy and Terms of Service apply. after newsletter promotion By this stage, Dzhambazov’s relationship with Gaberova was in full swing. The beautician told the court he made her believe he worked for Interpol and produced a fake badge and photo ID. She had told him “my dream is to be police” and enthusiastically went along with his story. He had told her he had a lot of free time on his surveillance jobs and invited her to Valencia in September 2021, where he was planning to follow Grozev. For her, it would be a “free holiday”, she said. Their relationship started there, Gaberova told the court. Dzhambazov told her he would break up with Ivanova, who was arriving in Valencia the next day. Ivanova came and went, and the new couple stayed on at the luxury Valencia Palace hotel, where they had been able to book a room – going €1,900 over budget. Unbeknown to the Bellingcat team, they watched Grozev, who breakfasted every day at 9am. At one point, Dzhambazov asked Gaberova to follow Grozev, she said. He told her Interpol often used untrained people to help because they did not stand out in a crowd. Dzhambazov had “an answer for everything”, Gaberova told the court. View image in fullscreen Jurors were shown this mundane surveillance image taken of Christo Grozev having breakfast at the Valencia Palace hotel. She said Dzhambazov also asked her to befriend Grozev on Facebook, having told her he was “a bad journalist”. She did and he accepted the request. Unbeknown to her, once they heard of it in late September 2021, this development got Marsalek – with whom none of the three defendants communicated – and Roussev excited. In messages read out in court, they said they thought they could somehow lure Grozev into a honeytrap. “I hope she doesn’t fall in love with him,” Marsalek wrote, saying he had had that problem before. In reply, Roussev argued: “You are using the wrong type of girls,” and that Gaberova was “very very assertive and strongly independent … true sexy bitch”. Chain of messages between Roussev and Marsalek discussing defendant Vanya Gaberova Like Ivanova, whom she had not met before their arrest, Gaberova said in court she had been manipulated by Dzhambazov and that she had largely been duped into believing he worked in Interpol’s economic crime department and she was helping him. After a while, she said, she did become suspicious about his brain cancer story, but she tearfully told the court she believed him again after he sent her images of himself with what was obviously toilet paper around his head. He told her he was recovering from surgery and she believed him. “I thought it was like a bandage in a hospital,” she said. View image in fullscreen A screengrab from Telegram of Dzhambazov, wearing what appears to be loo roll on his head, while on a video call with Vanya Gaberova. But she struggled to explain what she had been doing in Montenegro on another surveillance operation aimed at a Russian in exile, and insisted she had accepted Dzhambazov’s story about Interpol and requests for help – such as befriending Grozev on Facebook – at face value. Before her arrest she had thought nothing was amiss, she said, but when pressed by Morgan in court during cross-examination, she responded with an emotional outburst: “Seeing this now, I was manipulated, used, exposed – everything.” The third and final defendant in court was Gaberova’s ex-boyfriend Tihomir Ivanchev, a painter and decorator, who was arrested a year after the two women. The most peripheral of the three, he said he was recruited by Gaberova and Dzhambazov to help with the surveillance of Grozev in Montenegro. Unlike the two other defendants, who chose to undergo cross-examination from Morgan, he did not give evidence, but he was the only one to have given a detailed police interview. Ivanchev described his recruitment by Dzhambazovin a conversation outside a pub in the autumn of 2021. He said he was not shown any fake ID by Dzhambazov, but was persuaded that he worked for Interpol when Dzhambazov showed him some pictures of faked passports from his phone. Ivanchev said he was asked to help Dzhambazov, though there was no training and no equipment was provided. Ivanchev was asked to go to Vienna where he would take some pictures relating to the surveillance of Grozev on his own phone, for which he would be paid €200 a day plus expenses – though this was cut to €150 after he was accused of being lazy. “There was too much pressure for this money,” he told police. Tihomir Ivanchev, 39, a painter and decorator living in Enfield north London, was arrested a year after his two co-defendants. “Who are Interpol to you?” one of the interrogating officers asked, deadpan. In reply, an embarrassed-sounding Ivanchev didn’t have much to say, offering: “From the movies,” and: “Just, uh, chasing criminals,” before he acknowledged his involvement, “right now the dumbest thing I have ever done in my life”. If Marsalek was the scheming general, Ivanchev was like a fresh Russian soldier sent to Ukraine – untrained and deployed without much consideration for his future. The final and most serious plot that unfolded in court related to planned surveillance of the US Patch barracks in Stuttgart. By now it was October 2022 and the war in Ukraine had been running for more than half a year. At the plot’s heart was a highly sophisticated, military-grade Razor II surveillance device costing an estimated £120,000. The size of a toaster, the device is capable of capturing the International Mobile Subscriber Identity (Imsi) numbers that uniquely identify each mobile phone on a network – and the plan was to covertly use it in Germany. After the verdicts, investigating officers said they had never seen such a device in criminal hands before. “On an entirely separate note, can we use the IMSI catcher in Germany? We need to spy on Ukrainian [sic] at a German military base,” Marsalek wrote to Roussev on 19 October 2022. The belief was that Ukrainian soldiers were being trained to use Patriot air defence systems there, and by placing the Imsi catcher nearby it could mop up mobile numbers belonging to the soldiers. Fast-forward a few months and if the numbers obtained could now be found in a concentration in Ukraine, it could point to the location of a Patriot battery, a significant piece of military intelligence. A day later, Roussev set up a WhatsApp group, with Dzhambazov as a member, outlining plans for observation “of the entrance to a training regiment for Ukrainian soldiers” and to try to find a flat to rent and cars to hire. Dzhambazov flew out to Stuttgart with Ivanova, and on 31 October the pair walked around the perimeter of the base, with her filming on her mobile phone. In her evidence, Ivanova said this was when she first openly raised concerns with Dzhambazov. She told the court she was happy to go to Germany because it was a rare chance to see her father, and she said she was baffled to be asked to visit the base. “Multiple times I was questioning him: ‘What are we doing here?’,” she said, but her concerns were dismissed. “You are being a headache with your questions,” he had said, she recounted. In any event, the pair took video of the site’s perimeter that day and the day after. The car to contain the Imsi catcher was rigged up with a large red button at the front on the left above the air conditioning vent. Prosecutors said this was to power up the surveillance device. Reconnaissance completed, the planning for the audacious operation continued. “Our friends here have asked to ask you/the team to be extremely careful,” Marsalek warned in early December. Roussev managed to buy a left-hand-drive Chrysler for £4,200 in cash from a secondhand dealer in the UK. A plan was made to secrete the Imsi catcher within and power it with an extra car battery. Police found the car in a community garage attached to Dzhambazov and Ivanova’s flat in Harrow, and it had been rigged up with a large red button at the front. “It might as well say ‘press go for Imsi’,” Morgan theatrically told the court. Police believe the plan appeared to be technically sound, but it was foiled days before it was due to be carried out by the pre-dawn arrests of Roussev, Dzhambazov, Ivanova and Gaberova. Investigators traced more than €210,000 of money flowing from Roussev to the others involved, principally indirectly via Dzhambazov. For all the soap opera of relationships and behind-the-scenes boasting, Cdr Dom Murphy, the Met’s head of counter-terrorism, said the spy ring’s activities were sophisticated, they engaged frequently “in lifestyle surveillance”, and “the concern is what is it [the information obtained] going to be used for”. Today, Grozev lives in New York, away from his family, because Europe is no longer safe enough. And as the events described at the Old Bailey demonstrate, Russia’s threatening efforts persist and increase.∎​