Berlin Assassination: New Evidence on Suspected FSB Hitman Passed to German Investigators

• In a series of investigations in 2019 and 2020, Bellingcat, along with its investigative partners The Insider and Der Spiegel, identified the person suspected in the August 2019 assassination of Georgian asylum seeker Zelimkhan Khangoshvili in Berlin. The suspected assassin, who traveled to Berlin under the name of Vadim Sokolov, a Russian citizen, was arrested by Berlin police shortly after the killing and is currently on trial at the Berlin appellate court (Kammergericht).
• Our initial investigation found that the passport on which the arrested suspect traveled was state-issued, but linked to an inauthentic identity; and that a man with the particulars of “Vadim Sokolov” did not exist in Russian registries prior to 2019. We concluded that this cover identity – which had obtained a full set of matching presence in all kinds of Russian registries, including the tax registry, in 2019 – could only have been issued by the Russian authorities.
• Subsequently, we were able to match the suspect to the real identity of Vadim Krasikov, 56, a person whom Russian investigators placed on an international search in connection with a 2013 murder. The Interpol search warrant had been withdrawn in 2015. Our identification was based largely on geographically overlapping use of telephones used by “Vadim Sokolov” and Vadim Krasikov as well as on facial comparison of a black-and-white photograph of Krasikov to the arrest mugshots and visa application photos of “Vadim Sokolov”.
• Based on analysis of telephone metadata, we found that prior to his trip to Berlin, Vadim Krasikov had been communicating intensively with members of the Vympel group of companies – comprised primarily of former FSB Spetsnaz officers – and had visited secure FSB training facilities in the immediate eve of his trip to Germany.
• Largely in reliance of Bellingcat’s investigations, German prosecutors have indicted Vadim Krasikov as a killer who acted on behalf of the Russian state, and in particular the country’s security service – the FSB. The case is currently in trial phase at first-instance court in Berlin, and a verdict is expected in the first half of 2021. The prosecution believes that there is overwhelming forensic evidence that the detained suspect is in fact the assassin – including DNA match with items disposed of by the killer in the Spree river. However, the killing’s connection to Russian state largely hinges on the case that “Vadim Sokolov” and Vadim Krasikov are the same person. 
• The accused maintains that his name is Vadim Sokolov, that he was a tourist in Berlin, and that he is not aware of a Vadim Krasikov. The defense lawyers argue that the evidence of identity of the two personas is inconclusive, and is based solely on a facial comparison.

New data freshly obtained by Ukrainian law enforcement and passed on to German investigators strongly supports the key premise of Bellingcat’s identification, and removes more or less any residual uncertainty that “Sokolov” and Krasikov are the same person. This data was obtained during a special operation of Ukrainian law enforcement in Kharkiv, Ukraine’s second largest city and the hometown of Vadim Krasikov’s wife. According to sources of our investigative partner Spiegel, the new data has been passed to German law enforcement in the last few days. Spiegel obtained some of the documents and photographs from the new data set and shared them with Bellingcat.

Тhe new data includes photographs from what appears to be a 2010 wedding album of Vadim Krasikov and his current wife. They also include a marriage certificate, showing the husband’s name as “Vadim Krasikov”.

The color photographs, which have been reviewed by us, provide multiple new samples of Vadim Krasikov’s face from different perspectives, making a facial comparison significantly more reliable than by use of the original black-and-white photos that we previously obtained. The identity match using the new photographs in Microsoft’s Azure tool is even higher, with a matching factor of 0.88902 (this factor is very high given the 10 year difference between the photographs and the facial hair changes; similar comparisons using photos with a 10-year gap of the of the same person yield results between 0.75 and 0.9).

A screen grab of facial comparison results using the Microsoft Azure tool.

Crucially, the newly obtained collection of photographs includes an image of Vadim Krasikov sitting on a beach in a baseball cap and a tank top. Visible in the photograph is a large tattoo on his left shoulder. This tattoo is identical to the tattoo seen on the shoulder of “Vadim Sokolov”, from a police custody photograph obtained previously by the Dossier Center.

Left, a tattoo on the arm of Vadim Sokolov. Right, a picture of Vadim Krasikov.

The near-perfect match is not only based on the exact same pattern of the tattoo and its identical placement on the same spot on the left upper arm in both photographs. A close-up comparison of the skin under the tattoo shows multiple overlapping skin artefacts, such as freckles, moles and scars.

A comparison of tattoos detailed in pictures of Vadim Sokolov and Vadim Krasikov.

Importantly, the German indictment documents as well as a police file describing the arrested “Sokolov” refer to a second tattoo – of a snake – on his lower right arm. This is compatible with a tattoo partially visible on the lower right arm of Krasikov’s beach photo.

A second tattoo on the arm of Vadim Krasikov.

The new photographs provided by Ukrainian authorities to German prosecutors present a new set of data points that make the identification of the accused as Vadim Krasikov even more robust than before. Furthermore, they provide an important second independent source for this verification. Notably, many of the wedding album photographs show Krasikov in the presence of his wife, his parents and in-laws – thus linking the person from the photographs to the name of Vadim Krasikov that is seen in the marriage certificate.

New Indications of an FSB link

As reported in our previous investigations, in the months following the killing of Khangoshvili and the arrest of Vadim Krasikov, metadata of the telephone previously used by Krasikov shows that that number continued communicating with a burner number which had not called Krasikov before the Berlin trip.

Our working hypothesis was that following his departure, Krasikov’s number was used by his wife – this was corroborated by the geolocation data that showed the phone stayed within the home base of Krasikov’s apartment, and occasionally moved in sync with his wife’s phone number. Krasikov’s telephone moved in the direction of Domodedovo airport on 6 December 2019 and was turned off permanently at approximately noon on that day. Our assumption was that the burner number belonged to one of Krasikov’s supervisors from the Vympel group – Evgeny Eroshkin, a senior former FSB special operations officer.

By tracing the burner number’s geolocation on that day, we discovered that it also moved towards Domodedovo airport, and later that day reappeared in Simferopol – the main city and airport on the Crimean peninsula.

By analysing the flights between Domodedovo and Simferopol airports on that day, we were able to narrow down the potential flights to only one that matched the switch-off and switch-on times of the burner number. We then obtained the passenger manifest of this flight.

In the passenger list, we discovered, as we suspected, Evgeny Eroshkin – confirming our hypothesis that he was the owner of the burner number. We also identified two other passengers – appearing to be a woman and her daughter. The woman and the child’s first names matched those of Krasikov’s wife and daughter, however the last name was different (per our editorial policy we do not publish names of relatives of our investigation subjects).

Notably, the birth date of the woman was exactly one year older than that of Krasikov’s wife.

This is a pattern of false-identity creation that appears to be preferred by the FSB; and we have previously identified and reported on this in the case of the FSB poison squad that tailed Alexei Navalny. The passport number on which the woman traveled had a prefix of 45 that means that it would have been issued in Moscow.

We verified if a person with this name and birthdate exists in any Russian databases, and the result was negative. This, together with the naming and birthdate pattern, plus the full match of the child’s birthdate with that of Krasikov’s child, corroborated our hypothesis that the Russian authorities had issued a new identity to Vadim Krasikov’s family, and had provided them with an FSB “handler”. Indeed, travel data for Mr. Eroshkin shows that he traveled from Moscow to Crimea at least once every month since that initial trip in December 2019, and used this burner phone almost exclusively for communication with a new burner number that we believe is used by Ms. Krasikova.

Notably, the passport number issued for the new, fake identity of Vadim Krasikov’s wife shows that it is not a regular number issued in 2019. The numbering of the passport (45044201**) indicates that it was issued in Moscow in 2004 or early 2005 (long before Ms. Krasikova moved from Ukraine to Russia in 2009). More importantly, the passport number appears to be from a series of sequentially numbered passports issued to FSB undercover operatives. For instance, a number from the same series and only a few numbers apart was used by “Sergey Lukashevich”, a cover persona who in 2015 served as Minister of State Security of the “Donetsk People’s Republic”. Multiple media reports and witness testimony confirm that the so-called Ministry of State Security was staffed by FSB undercover operatives.

A screengrab showing travel details and passport number of “Sergey Lukashevich”.

Other passports from the same numbering range belong to other non-existing personas, some of which flew on joint bookings with members of the closest entourage of former Ukrainian president Yanukovich.

These new findings corroborate even further our previous conclusion that the FSB had a direct involvement in the preparation and commissioning of the Berlin assassination, and in the cover-up of the evidence after the killing. This, apparently, includes issuing cover identities for Krasikov’s family members and moving them to Crimea, where they appear to be in direct contact with an FSB handler.

The FSB Handler

Based on leaked 2017 employment data, Evgeny Eroshkin, born 1963, is an employee of Vympel Sodeystvie, one of the many Vympel-named private security companies formally owned by Eduard Bendersky. As written earlier, Bendersky is a former FSB Spetsnaz commander who owns a cluster of security-themed companies that boast of being able to “resolve any issue as complex as it may be” and being incorporated by former FSB special service officers. A review of recent airline travel data shows that in 2015 and 2016 Bendersky flew on joint bookings with Col. Gen. Alexey Sedov, Director of FSB’s 2nd Service.

Evgeny Eroshkin, photo from visa application.

In the months before the Khangoshvili assassination, Evgeny Eroshkin communicated by phone intensively with two of the suspects in the murder case: the accused, Vadim Krasikov, and the second suspect Roman Demyanchenko. As described above, our findings indicate that he also communicated frequently and traveled with Krasikov’s presumed wife after Krasikov was detained in Germany, implying that he had at least some degree of involvement in the preparation and clean-up operation after the Berlin attack.

However, data from a 2019 visa application submitted by Eroshkin suggests he may have had plans for more than just a remote involvement in this operation. Data from Schengen’s visa database seen by us shows that on 27 February 2019 Eroshkin applied – under his real name – for a Schengen visa at the Consulate of Greece in Moscow. He requested a multi-entry visa to travel to Europe in the period from 26 April 2019 until 26 October 2019.

However, the Greek consulate did not honor this request, and on the following day – 28 February 2019 – granted him a one-time visa valid only for 17 days during the period from 26 April to 27 May 2019.

Travel records for Eroshkin show that he chose not to use this visa, and did not travel to the Schengen area. Instead, on the day he received the shorter-than-expected visa, he initiated his first phone call to Vadim Krasikov. They had 28 phone interactions in the following five months, the last one just days before his trip to Berlin.

Relevance of Findings

The newly obtained data provided by Ukrainian authorities to the German investigators may become a crucial component in the prosecution’s case. If the new data makes its way to the evidence file of the ongoing court case – which is nearing its final phase – it may be enough to convince the court that “Vadim Sokolov” does not exist, and that on the eve of the assassination, the Russian state issued fake identity documents to Vadim Krasikov. This would strengthen the prosecution’s case that the killing was commissioned by the Russian state. The court will then have to weigh the voluminous – while circumstantial – evidence that Krasikov acted on behalf of the Russian state against the defendant’s continued silence.

In the latest court hearing earlier this week, the court heard from a police officer to whom the defendant had earlier said that his mother could confirm his identity as “Sokolov”. The presiding judge offered the accused to provide name and contact details for his mother so she could be contacted to testify that he is who he says he is. The defendant’s lawyer quickly intervened and said that his client will continue to use his legal right to remain silent.

If a court verdict does corroborate the prosecution’s indictment, a new set of diplomatic sanctions from Germany are expected. The German government has already committed to further, harsher sanctions against Russia if the court verdict confirms the accusation of state involvement in Khangoshvili’s assassination.