How GRU Sabotage and Assassination Operations in Czechia and Bulgaria Sought to Undermine Ukraine

• Bellingcat first reported on the presence of members from GRU Unit 29155 in Bulgaria at the time when a Bulgarian arms manufacturer collapsed into a coma following what was identified as poisoning by an unknown substance. At that same time, the entrepreneur’s son and the production manager of his factory were also poisoned. A possible second poisoning – again with overlapping trip to Bulgaria by members of GRU Unit 29155 –  appeared to have been attempted a month later, days after Gebrev and his son were released from hospital.
•  We have previously identified and described operations of an elite sabotage unit within GRU Unit 29155. This unit conducts clandestine operations overseas, and we have previously identified its involvement, in addition to the series of poisonings in Bulgaria, in the annexation of Crimea (2014), destabilization attempts in Moldova (2014), a failed coup in Montenegro (2016), WADA-linked surveillance operations in Switzerland (2016-2017), possible destabilization operations in Spain during the Catalonia independence referendum (2017) and the assassination attempt on former Russian spy Sergei Skripal in Salisbury, UK (2018).
• In the first part of this investigation, we identified a total of six operatives from this GRU unit who were directly or indirectly linked to the sabotage of ammunition depots in Czechia in October 2014 and, possibly, also in December 2014. Bellingcat also discovered that Gen. Andrey Averyanov – the commander of Unit 29155 – traveled undercover to Austria and likely on to Czechia during the time the operation took place. This marked the most senior involvement of a GRU officer in a clandestine operation identified thus far.
• This investigation was conducted in partnership with The Insider and Respekt

In the previous part of this investigation, Bellingcat revealed that the 2014 explosions of the Vrbetice munitions depot were the product of an unprecedented GRU mission in terms of scale and seniority of the participating officers. A minimum of six senior GRU undercover agents from Unit 29155 – including its commander and two officers under diplomatic cover – were deployed to Central Europe to facilitate the mission. At least two of the participants, Alexander Mishkin and Anatoliy Chepiga, received Russia’s highest state award – Hero of Russia –  and at least four team members received free apartments from the government in the immediate aftermath of the operation, further underpinning the importance of this mission to Russian authorities.

Two open questions remain the subject of speculation by the press: First, whether the sabotage operation in Czechia in 2014 is linked to the poisoning of the arms manufacturer Emilian Gebrev and two other Bulgarian citizens in the spring of 2015 – a connection made by the Czech authorities but challenged by Mr. Gebrev’s company Emco. Second, what might have been the underlying motivation of the sabotage operation – and of the subsequent attempt on Emilian Gebrev’s life.

Data analyzed by Bellingcat supports the hypothesis that the 2014 explosions in Czechia were part of a longer-term GRU operation aimed at disrupting Ukraine’s capabilities to procure weapons and munitions critical to its defense against Russian troops and Russia-sponsored militants in the war in Eastern Ukraine. The operation appears to have been initiated shortly after July 2014 when Russian authorities subordinated the disparate Russia-supported militant groups in the Donbas region of eastern Ukraine under central control and military supervision of the GRU. The mission, which appears to have been run by the subversion and sabotage sub-unit of GRU’s Unit 29155, included several contiguous operations among which were the explosions at the Vrbetice depots, the assassination attempt on Emilian Gebrev, and – with increasing likelihood – at least one of the three explosions at munition depots in Bulgaria in early to mid-2015.

This version of events is corroborated by the overlap of the small sabotage team in the Czech and Bulgarian operations; the team members’ contiguous assignments in the two countries; and the links to EMCO – an important factor in Ukraine’s defense strategy in 2014 and early 2015 – in both sets of operations. Moreover, telephone records analyzed by Bellingcat show that several members of Unit 29155 communicated actively with Russian military officers deployed to the Donbas, as well as with local militant commanders fighting against the central Kyiv government, in 2014 and 2015.

This hypothesis also lends itself to reason given that at that time, Russia’s only ongoing large-scale military activity was in Ukraine. A clandestine sabotage unit run by the Ministry of Defense would naturally be expected to prioritize diminishing defensive capabilities of Russia’s adversaries in wartime.

At the same time, an analysis of correspondence between EMCO and the depot operator Imex from 2014 indicates that the target of the GRU sabotage operation may not have been (solely) Gebrev’s munition stock. The data reviewed by Bellingcat also sheds doubt on the Czech official version of events – most recently promoted by Czech president Miloš Zeman – according to which the GRU unit had planned for the explosion to occur on Bulgarian territory after repatriation of the munition purchased by EMCO.

Motivation for the GRU attacks at Czech Depots

Following the announcement of Czech authorities’ conclusions that the sabotage operations in Vrbetice were targeting inventories owned by Bulgarian arms manufacturer and trader EMCO – which, according to Czech official sources were intended for export to Ukraine – the company issued a press statement disputing this narrative. It said that at the time of the explosions it did not intend to move any inventory from the Vrbetice  depots to Bulgaria, nor to export it to any country at war  – be that Ukraine or Syria.

In previous communications with the media, EMCO has said that its sales of ammunition to Ukraine have been limited in scale and time.

These statements by EMCO appear to correspond with company documents and correspondence with the depot operator Imex Group, obtained and reviewed by Bellingcat. As of October 2014 EMCO did not plan to repatriate or sell off any of its inventory stored in Czechia. This was explicitly confirmed also by representatives of Imex contacted by Bellingcat’s Czech investigative partner Respekt.

However, as the Bulgarian company itself recognized as early as February 2019, it did sell ammunition to Ukraine in late 2014, and according to two sources that in 2014 and 2015 were close to Ukraine military procurement who requested anonymity to comment on a confidential matter, it played a crucial role in boosting Ukraine’s defense capability at a time when its territorial integrity was at stake. Crucially, according to these sources EMCO was one of only two EU companies that specialized in manufacturing state-of-the-art munitions compatible with Soviet-era weapons, especially in the large-bore (120 mm to 152 mm) range. According to one of the sources, in 2014 there were only two manufacturing plants that produced compatible munitions, and “the other company was under effective Russian control”, leaving EMCO as the only possible foreign-based provider of munitions for Ukraine’s army.

One of the sources also described a practice by Russian military intelligence which consisted of approaching arms traders who had ammunition compatible with Ukraine’s artillery, and offering them “significantly above market prices” to purchase their stock, in order to prevent Ukraine’s access to the market. The source also described three shiploads of munition manufactured or upgraded by EMCO that had been successfully imported into Ukraine, although the source did not specify if EMCO itself sold to Ukraine or if the ammunition came via a third party.

EMCO confirmed to Bellingcat that Ukraine imported its ammunition in the 120 mm to 152 mm range for Ukraine in the period December 2014 – February 2015, based on a contract signed on 10 November 2014. The company says part of the contractual commitment remained unrealized, as it says it abstained from shipping to Ukraine after the February 2015 signing of the Minsk-2 de-escalation agreement.

Bellingcat obtained a list of the munition that had been contracted with EMCO in November 2014 from one of the former Ukrainian procurement-linked sources. Most of the ammunition including the 5,000 large-bore 152 mm rounds was exported in January 2015, with the last shipment realized on 26 February 2015. Only the 152 mm rounds were manufactured by EMCO; while the rest of the ammunition was procured from other Bulgarian state-owned arms manufacturers.

The total value of the contract was over EUR 25 million ($30 million). However, not all of the contracted volume was sold to Ukraine. The last two line-items in the list – which accounted for nearly EUR 20 million of the contract’s value – were never exported.

When approached by Bellingcat, EMCO confirmed the veracity of the munition list including types and quantities. EMCO denied media reports that it has exported additional ammunition via third country routes.

First two images: Unexploded Bulgarian-made OG-7V RPG-missile with 2014 as the manufacturing date, reportedly found in the “DNR” after use by the Ukrainian Armed Forces in the summer of 2017. Other Bulgarian munitions, some of which also had 2014 as the manufacturing date, were also shown to the public by a separatist group in April 2017.

Regardless of the exact volume of exported munitions, the perceived importance of EMCO’s production as crucial for Ukraine’s defense needs during its war with Russia  – not only in terms of the already realized shipments but also in view of the total contract value – and of potential future imports – would likely have been sufficient to explain the GRU’s interest in sabotaging the company’s inventories, as well as their subsequent attempt on the lives of Emilian Gebrev and of EMCO’s production director.

Targeted Depots

If EMCO did not plan to export ammunition from its storage in Czechia to Ukraine, as both EMCO, IMEX, and company correspondence seen by Bellingcat suggests, the question arises: why did the GRU attack the Vrbetice depot No. 16 and destroy, among others, EMCO’s inventory?

IMEX representatives confirmed that Emco was one of a total of four companies that stored their muntion at this depot in 2014 (two were Bulgarian and the remaining two were Czech). In the days leading up to the explosion, the two Imex employees who perished had been re-labeling the crates of one of the two Czech owners. According to Imex, only this stock had been intended to be removed from storage in the subsequent days, but no export plans were known.

Similarly, the ammunition stored at depot No 12 which exploded on 3 December 2014, held stock owned by several companies, also including EMCO. None of this inventory was meant to be exported in 2014, Imex told us.

The absence of any plans for EMCO to repatriate its stock throws into doubt the allegations by Czech authorities that the GRU had planned to detonate EMCO’s munitions at a later date, once the stocks had been moved to Bulgaria.

It is therefore possible that the GRU did not specifically target EMCO’s munition inventory, but all supplies stored at Vrbetice as a preventive measure against EU arms traders exporting to Ukraine. This is a plausible hypothesis, given that Czechia and Bulgaria have both exported munitions to Ukraine.

An alternative explanation may lie in the fact that GRU had incorrect information and expectations about EMCO’s intentions in relation to its inventory stored in Vrbetice. Correspondence between the company and the Imex Group from early October 2014, obtained by Bellingcat, shows that Imex did try – unsuccessfully – to convince the Bulgarian company to pick up and repatriate its munitions.

In a letter dated 3 October 2014, Imex’s CEO Petr Bernatik wrote to EMCO’s chairman, Emilian Gebrev, to complain that EMCO had not yet taken possession of the munitions the company had previously purchased from the Czech arms trader. It requested payment of overdue storage fees, and urged EMCO to repatriate its stock from the depots by 15 October 2014. Notably, Bernatik also informed Gebrev that Imex had been approached by “several customers” interested in most of EMCO’s stock stored in Czechia – approximately 10,000 of EMCO’s 120 mm mortar rounds and over 16,000 of its big-bore 152 mm rounds (according to other letters exchanged between the two companies, this represented all of EMCO’s stocks in Czechia apart from approximately 5,000 125 mm tank shells).

Bernatik asked Gebrev if he would sell this stock back to IMEX for a further sale to the undisclosed clients:

Full letter from 3 October 2014

In a response from 7 October 2014, Gebrev snubbed Imex and informed them that he did not wish to sell the available stock. He also wrote that he did not plan to transport the stock to Bulgaria, and offered to move it to another Czech depot operator if Imex was unwilling to continue to store it:

Full letter from 7 October 2014

Bellingcat’s Czech investigative partner Respekt approached Imex Group and inquired whether the “interested customers” referred to in the 3 October 2014 letter were those presumed to be representing the People’s Guard of Tajikistan. As Czech police and media reported, these prospective buyers were in fact the GRU agents Alexander Mishkin and Anatoliy Chepiga, who used fake Moldovan and Tajik identities when registering their interest in visiting the Vrbetice depot.

Entry for Mishkin’s flight booking from Moscow Sheremetyevo to Prague, 8 October 2010, under his cover identity “Alexander Petrov”

Imex replied that this matter is subject to ongoing criminal investigations and that the company is not allowed to answer this question without approval from the prosecutors. However, the timing of the unsolicited offer (which, according to EMCO, was unusual and did not occur before or after this incident), as well as the fact that one day after EMCO’s refusal, six members of the GRU unit confirmed their flight bookings to Czechia, suggests that the “offer” may have been part of the GRU’s modus operandi to try and prevent sales to Ukraine by making preventative offers, as described by the Ukrainian source. EMCO’s denial to enter a sale discussion may have triggered the GRU’s (apparently incorrect) conclusion that this stock was already pre-committed for a sale to Ukraine.

The Czech authorities believe that the explosions at the Vrbetice depot were triggered prematurely, and the GRU’s plan had been to specifically detonate EMCO’s ammunition at a later date when the GRU believed the stock would have been in Bulgaria. However, Czech officials have not yet presented the evidence leading them to such a conclusion. It is unlikely that this finding is based on discovery of any delay-action or remote-triggered explosive devices found on the crime scene, because the massive explosions would have likely left no discernible trace of any electronic device. It is possible that such a conclusion is based simply on an assumption that a plan existed to repatriate the inventory to Bulgaria. Indeed, as seen from the correspondence between EMCO and Imex, the Czech company appeared to be unwilling to store the Bulgarian stock further and invited Gebrev to arrange for its pickup. Nevertheless, EMCO’s response appears to negate such repatriation plans.

Moreover, a subsequent letter by Imex to EMCO from November 2014 indicates that even after the explosions, EMCO had not initiated any removal of (any surviving) ammunition to Bulgaria.

Full letter from 11 November 2014

 

All of this casts doubt on the Czech authorities’ hypothesis that the GRU had intended to delay the explosion until the munitions were back in Bulgaria.

The GRU’s hunt for Emilian Gebrev

Whether or not the GRU intended to blow up the munitions in Czechia or in Bulgaria, and whether or not EMCO’s stock was the only target of their sabotage, what is beyond doubt is that the same sub-group of Unit 29155 that was linked to the Vrbetice explosions subsequently shifted its main focus to Bulgaria, and in particular to Emilian Gebrev.

Image: Bellingcat / Yordan Tsalov

As we previously reported, on the eve of the Czech operation of 25 September 2014, two members of Unit 29155, Denis Sergeev and Egor Gordienko, flew to the vicinity of GRU’s logistical base near the French-Swiss border. Once there, they interacted frequently with Gen. Andrey Averyanov, commander of Unit 29155. On the morning of 13 October 2014, as the sabotage operation in Vrbetice was entering its critical phase, these two agents did not join their colleagues in Czechia, but instead returned to Moscow. The day before, travel records show, Emilian Gebrev had landed in Moscow, accompanying his wife, who was suffering from late-stage cancer, for urgent medical treatment. The two agents stayed in Moscow during the couple’s sojourn there. Due to the long time elapsed since then, Bellingcat has not obtained geolocated telephone records to shed light on whether Sergeev and Gordienko were engaged in surveillance on Gebrev (technically, the GRU has no mandate to conduct operations on Russian territory).

Nevertheless, it was exactly these same two officers (accompanied by a third undercover officer – Sergey Lyutenko) – who flew to Bulgaria on 15 February and – according to findings of Bulgarian investigators – stayed for a week at the Hill hotel adjacent to EMCO’s offices, with at least one of the three requesting a room with a view to the entrance of the company’s underground garage. In a subsequent visit of the three GRU undercover officers – from 24 to 29 April, they again stayed within  sight of Gebrev’s office – at the Kempinski Hotel – with one of them booking a room overlooking EMCO’s building.

A week after the trio’s departure on 22 February, a new shift of colleagues from the same GRU unit arrived in Sofia. This team included one of the key members of the Czech sabotage operation: Nikolai Yezhov, the officer who had accompanied Gen. Averyanov during his stay in Austria and Czechia, and had returned to Russia only on 3 November, just over two weeks after the first, and a month before the second explosion at Vrbetice .

Like with the previous shift, the trio stayed at a hotel near EMCO’s offices, and again requested rooms with an appropriate view. A notable addition to this second shift was Col. Ivan Terentyev, traveling under the cover identity of “Ivan Lebedev”. As seen from Terentyev’s CV obtained by Bellingcat, at that time he served as the commander of special operations of unit 29155 – in effect Gen. Averyanov’s deputy for covert operations. Like Gen. Averyanov, his deputy Col. Terentyev was not a frequent clandestine traveler – and his presence in Sofia in 2015 once more underpinned the importance of this mission to the GRU’s leadership.

Col. Ivan Terentyev, aka “Ivan Lebedev”, photograph accompanying a resume used by Terentyev to apply for a government position in 2019, obtained by Bellingcat.

This trio again stayed in Bulgaria ten days, and returned to Moscow on 8 March 2015.

The Diplomatic Pouch 2.0

As reported earlier, the third visit by this GRU unit that year turned near fatal for Emilian Gebrev, his son and EMCO’s production director. On 23 April 2015, Sergeev, Gordienko and Lyutenko returned to Sofia. According to investigators, Lyutenko booked what now appeared to be his favorite room with a view at the Hill Hotel – room No. 305 – and the other two found accommodation within walking distance. On 28 April 2015, one of the three – presumably Sergeev – was captured on security camera footage meandering, in cinematic disguise, among the cars in the underground garage where Gebrev and his employees kept their cars. Several hours later Gebrev, his son, and his production manager would collapse with symptoms of severe organo-phosphate poisoning. A second poisoning attempt appears to have been made a month later – during which two of the three GRU officers mentioned above were again present in Bulgaria.

Bulgarian investigators are convinced that on 28 April 2014, one of the three GRU officers applied a lethal toxin of the organo-phosphate group – to which Novichok belongs – to the door handles of cars used by Gebrev and his production director, Mr. Tahchiev. Emilian Gebrev’s son is likely to have been exposed to the toxin through incidental contact with his father’s car on that day. Investigators have not yet discovered how the toxin was brought into the country.

One possible answer to this lingering question may lie in one more, previously undisclosed trip by a member of Unit 29155 to a location near the crime scene. In the previous part of this investigation we reported that two members of the GRU sabotage unit traveled under diplomatic cover to Budapest on the eve of the Czech depot explosions, and returned to Moscow the day before the sabotage took place.

One of these same two GRU officers – Col. Alexey Kapinos – traveled on the eve of the April poisonings, again under diplomatic cover, to a location that is just over three hours’ drive from Sofia. On 25 April 2015, Col. Kapinos flew to Thessaloniki airport in Greece. At this point, his colleagues Sergeev, Gordienko and Lyutenko were already in Sofia, 300 km away. The Russian border crossing records, seen by Bellingcat, shows that Kapinos stated “visit of diplomatic establishment” as the purpose of his trip. The return ticket bought by Kapinos was for 28 April 2015. That was the day on which the three Bulgarians were poisoned.

Ticket bookings for Col. Alexey Kapinos

Bulgarian border records do not keep track of diplomats crossing into the country, thus it has not been possible to ascertain if Kapinos crossed into Bulgaria on 25 April. However, what is certain is that Kapinos did not take the planned return flight from Thessaloniki, casting doubt on his “diplomatic mission visit”. In fact, on the evening of 28 April 2015, at 8:55, he surfaced far away in Finland at Helsinki airport, from where he took an Aeroflot flight to Moscow, according to Russian border records. The whereabouts of Kapinos between his arrival to Thessaloniki on 25 April and his appearance in Helsinki on the evening of the poisoning (28 April) has not yet been established.

Awards and Apartments

Bellingcat has been able to establish that many of the participants in the contiguous Czech and Bulgarian operations received various prestigious military awards in the period from November 2014 until May 2015. Bellingcat has previously reported that both Mishkin and Chepiga received Russia’s highest military and political award, “Hero of Russia”, bestowed via secret presidential decrees at the end of 2014. Photographs of Gordienko and Terentyev show that by May 2015 the two had received a number of medals, including the Order of Courage. А CV of Lyutenko seen by Bellingcat shows that he received this medal in 2015. Furthermore, we have confirmed that at least four members of the GRU team who took part in these two operations – Mishkin, Chepiga, Gordienko and Vladimir Moiseev (who used the cover identity “Vladimir Popov” during a GRU operation in Montenegro) – received free apartments, three of which in the same apartment complex in Moscow, in the period between November 2014 and May 2015.

Real estate entries for the new Moscow apartments of (left to right): Mishkin, Gordienko and Moiseev

These apartments were previously owned by the municipality of Moscow. Under Russian law, the recipients of Hero of Russia awards are entitled to various fringe benefits, including municipally-owned apartments. It is therefore likely that not only Mishkin and Chepiga, but other members of the two GRU operations received Hero of Russia awards, even further underpinning the high priority of these missions to the Kremlin.

This investigation was in conducted in partnership with The Insider Russia and Respekt

Christo Grozev, Pieter van Huis and Yordan Tsalov served as the primary researchers for Bellingcat.