Flash Report
The story behind
On February 15, 2015, three Russian nationals arrived in Sofia, Bulgaria and booked stays at two local hotels, albeit with an unusual request; the men wanted rooms with a view, but not of the city skylines or Mount Vitosha. They all wanted views of the same parking garage – the garage used by Emco Limited, a holding company owned by Bulgarian businessman and arms merchant Emilian Gebrev. After departing a few days later, the men returned in late April, using the same false aliases to travel as they had before – “Sergey Fedotov”, “Georgy Gorshkov”, and “Sergey Pavlov”. These repeat visitors were no ordinary tourists, but officers in the GRU, (the foreign military intelligence agency of Russian Armed Forces- specifically, from the agency’s clandestine overseas operations unit. In April, their mission shifted from observation to assassination.[1]
Once again, the three agents booked stays close to Emco’s offices, with “Pavlov” even requesting the same garage-view room as the first trip. And on the afternoon of 28 April, an unidentified man wearing a hat and gloves entered the parking garage the trio were so keenly interested in, lingered next to three cars owned by Gebrev, his production manager, Valentin Tahchiev, and his personal driver, and promptly departed.[2] What followed is common knowledge: that evening, Gebrev fell severely ill with symptoms of poisoning, and over the next few days, both Tahchiev and Gebrev’s son, Hristo, began to suffer from the same ailment. The Pirogov clinic, which treated Tahchiev, diagnosed the cause of the symptoms more specifically as “intoxication with an organophosphate substance”.[3] Video evidence released in 2020 by Bulgarian prosecutors now indicates that one of the three GRU operatives likely smeared the door handles of the cars in question with the poison, where it came into contact with the victims’ skin.[4]
At the time, the Kremlin’s affinity for the chemical warfare nerve agent, Novichok, which was infamously used to poison Sergei Skripal and his daughter Yulia in 2018 and Alexey Navalny in 2020, was largely unknown. Furthermore, it remains unclear exactly how much Bulgarian investigators working Gebrev’s case in 2015 knew about the three Russians’ presence. But even after GRU agents returned in May and conducted a second assassination attempt on Gebrev using the same methods and modus operandi, local authorities were still unable to produce any suspects or leads, and the case was closed in 2016 despite Gebrev’s attempts to prolong it.[5] Frustrated with the lack of progress, Gebrev sought out Verifin, a chemical lab in Finland accredited by the international Organisation for the Prohibition of Chemical Weapons (OPCW), and privately commissioned them to assist with the analysis. The lab’s tests showed metabolites in Gebrev’s system indicating contact with organophosphates, but the lab was unable to conclusively identify the poison.
The investigation remained on ice until 2018, when news broke of Sergey and Yulia Skripal’s poisoning in Salisbury with Novichok. Recognizing the similarities in the two incidents and the symptoms reported by the Skripals, Gebrev himself approached Bulgarian authorities to request that they reopen their investigation into his own poisoning, and UK authorities would later publicly notify their Bulgarian counterparts via official channels regarding the potential connection.[6] Prosecutors remained hesitant to initiate an investigation for months following this request, though, despite the fact that the incident had been logged by the Military Medical Academy, an official WMD-response facility, and verified by an accredited international lab.[7] This silence was only broken after a Bellingcat investigative report published on 9 February 2019 broke the news that “Sergey Fedotov”, one of the perpetrators of the Salisbury incident, was present in Sofia at the time of Gebrev’s poisoning.[8] Two days later, on 11 February, the Bulgarian Prosecutor General, Sotir Tsatsarov finally acknowledged that that his office was aware of the connection with Fedotov, though his statement seemed to dismiss the possibility of a Novichok-related agent being used for the poisoning.[9] On 14 February, Bellingcat investigators identified “Fedotov” as Denis Sergeev, a major general in the GRU,[10] and over the following months, they would continue to produce a litany of additional evidence regarding Sergeev’s accomplices and his role as part of the GRU’s Unit 29155, a clandestine intelligence squad tasked with carrying out subversive activities across Europe.[11]
It would be another year before Bulgarian prosecutors finally announced indictments for Sergeev and the other two GRU officers who accompanied him in February and April 2015, releasing key evidence including the group’s hotel record and the security camera footage of an individual entering the parking garage on 28 April.[12] Despite this progress, though, Bellingcat and other independent investigators have been able to identify several key shortcomings, bureaucratic setbacks, and missed opportunities which stymied Bulgarian prosecutors’ investigation and limited their ability to pursue the suspects. Perhaps most notably, a lack of proper coordination between the Bulgarian government investigators and the Verifin lab resulted in the loss of Gebrev’s samples before a new round of testing and analysis could take place.[13] According to Bellingcat researchers, prosecutors’ attempts to engage with OPCW were ‘timid’ at best, and mired by conflicting practices: “Bulgarian authorities insisted on the application of Bulgarian criminal code of procedure to the OPCW involvement, while the organization declined to comply and referred to existing regulation that necessitates a peer-to-peer approach”.[14]Furthermore, the fact that the prosecutors’ documentation refers to the GRU agents solely by their false cover identities rather than their real names has severely handicapped the investigation’s reach and staying power.[15]
Gebrev’s poisoning was not the first misfortune to befall him in recent years that revealed Russian connections upon closer inspection, however. In October 2014, several months prior to his near-fatal brush with a chemical weapon, an ammunition dump in Vrbetice, Czechia exploded under suspicious circumstances, destroying a large amount of ammunition owned by EMCO, Gebrev’s holding company.[16] According to evidence collected by Bellingcat, the operation was conducted by no fewer than “six senior GRU undercover agents from Unit 29155 – including its commander and two officers under diplomatic cover”, including Maj. Gen. Denis Sergeev and Lt. Col. Egor Gordienko, two of the GRU operatives who would later travel to Bulgaria on 15 February in order to begin surveillance on Gebrev.[17] The GRU team’s motive for destroying the ammunition dump is disputed, with Czech authorities asserting that EMCO’s stocks were targeted because they were destined for Ukraine, where an armed conflict against Russian-backed separatists had begun earlier in 2014.[18]
EMCO disputes this claim, but concedes that it did supply Ukraine with munitions from late 2014 to early 2015. As noted by CSD, Bulgaria is the second-largest exporter of ammunition in Eastern Europe after Russia,[19] and according to Bellingcat, EMCO’s supply of armaments to the government in Kyiv was of particular importance at this juncture: “EMCO was one of only two EU companies that specialized in manufacturing state-of-the-art munitions compatible with Soviet-era weapons”, while the other company was under effective Russian control, leaving Gebrev’s company as “the only possible foreign-based provider of munitions for Ukraine’s army”.[20] While there is no definitive proof that EMCO’s key role in the flow of foreign arms to Ukraine led directly to the GRU’s campaign against Gebrev, this hypothesis does assist in providing an explanation for the Kremlin’s apparent fixation with the arms merchant.
The Disinformation Campaign Begins
In the twelve-month interim between Bellingcat’s initial publication pinpointing “Fedotov” as a connection between the poison attacks in Salisbury and Sofia, Kremlin-controlled media worked to weave a web of disinformation and false narratives regarding the circumstances of the poisoning, the men thought to be involved, and Gebrev himself. After conducting an examination of 38 misleading Gebrev-related articles across five popular Russian news outlets over a period from February 2019 to August 2022,[21] CSD has determined that the most common disinformation tactics used by Russian outlets reporting on Gebrev are to cast doubt on the facts of his poisoning and question the veracity of Western accounts of the incidents. This goal is generally accomplished through the usage of a wide variety of supporting disinformation narratives, such as questioning the chemical agent that was used in the assassination attempt,[22] painting the incident as part of an anti-Russian smear campaign by Western forces,[23] and making light of the incident by mocking and ridiculing the West’s accusations as part of a “plot from a comic book” aimed at portraying the GRU’s covert operations unit as a “wild bogeyman”.[24]
The Pro-Kremlin Disinformation Campaign Surrounding Emilian Gebrev:
The first spike of disinformation-containing articles covering the incident in Russian media came in February 2019, just as Bellingcat revealed its initial findings and compelled Bulgarian prosecutors to address the matter publicly. On 11 February, Sputnik International confidently claimed that no traces of chemical weapons were identified in Gebrev’s urine by the Finnish lab Verifin, which only identified an organophosphate pesticide, along with one other unknown substance.[25] Bellingcat’s own interviews with chemical weapons experts, however, including with Vil Mirzyanov, a former Soviet chemist who helped develop Novichok, indicate otherwise. According to Mirzyanov, at the time of the poisoning, the tests used by Verifin were “not suited to identify the use of Novichok, which is not а part of the banned list of substances under the Chemical Weapons Convention (CWC)”.[26] Accordingly, the Finnish lab’s inability to conclusively identify Novichok in Gebrev’s 2015 samples cannot be taken as proof that the nerve agent was not present. In a concerning parallel, this particular narrative largely echoes the statement made by Bulgaria’s Prosecutor General on the same day, who seemed to dismiss the Novichok theory by arguing that “no chemicals in the CWC lists of banned substances were found in extensive testing”.[27] This argument misleads the reader by ignoring the nuance of the CWC’s prohibition on chemical weapons; these weapons are not defined in terms of specific substances, but by the purpose for which toxic chemicals are used. Therefore, even if the substance used to poison Gebrev was not listed on the CWC’s verification schedules, it can still be considered a chemical weapon if it was used for the purpose of inflicting bodily harm.
This same false assertion based on Verifin’s initial 2015 results would go on to become one of Russian outlets’ most frequently deployed disinformation narratives regarding Gebrev’s case in the months and years ahead, as the authors of the articles in question seized on the official Bulgarian government source which had disseminated the misinformation as proof of its credibility. An article published in November 2019 by popular Russian outlet Vzglyad is replete with disinformation regarding Gebrev’s case and the Bellingcat investigators who helped publicize it; in particular, the article seizes on the Finnish lab and its identification of the pesticide chlorpyrifos, quoting Prosecutor General Tsatsarov’s own misleading statement regarding the chemical: “They tried to poison Gebrev not with Novichok, but with chlorpyrifos, a remedy for garden pests that is sold in any agricultural store”.[28] This statement is presented as definitive proof that Novichok was not involved, and by calling into question one aspect of the Novichok poisoning narrative, Vzglyad therefore attempts to discredit the entire basis of the story. Once again, the actual substance of the CWC’s chemical weapons provisions is twisted and ignored in a manner that best suits the author of the disinformation, in an attempt to garner credibility by misrepresenting the words of a respected international source.
As before, misleading or misinformed statements by Prosecutor General Tsatsarov directly assisted Russian propagandists in their efforts, with his own words being held up as a ‘debunking’ of the Novichok theory by Bulgarian political scientist Petko Ganchev.[29] Russian outlets continued to seize upon the “pesticides” disinformation narrative moving forward, with a January 2020 article by RT falsely asserting that investigators had determined that the poisoning was caused by pesticide in a salad Gebrev ate on 28 April.[30] This ‘poison salad’ narrative has remained popular ever since.
Another of the most commonly deployed disinformation narratives by official Russian sources such as the Russian Foreign Ministry is the claim that the allegations regarding Gebrev are simply part of a widespread anti-Russia information operation by the West, a tactic which plays into longstanding allegations of Russophobia. Russian Foreign Ministry spokeswoman Maria Zakharova claimed in August 2022 that the accusations are part of a “large-scale campaign launched by the West against Moscow” supported by the governments of Bulgaria and the Czech Republic,[31] making reference to Prague’s accusations of Russian involvement in the Vrbetice ammunition dump explosion; this was the same claim she had made a year earlier in July 2021. Both times, Zakharova either implied or outright stated that elements in the Bulgarian government were aligned against Russia, casting the prosecutors’ allegations in the poisoning incident as an part of an overarching conspiracy.[32]
Finally, the personal character of Gebrev himself is frequently called into question in Russian media coverage of the poisoning, with some articles attempting to distract from the assassination attempt by pointing to his business disputes with other Bulgarian businessmen as a potential motive, and others going so far as to label him as a “James Bond villain” using Western intelligence agencies in an attempt to clear his name and distract from his crimes.[33]
It should be noted that many of the articles involved in spreading these disinformation narratives were published within the same 2-3-day windows across different outlets, reflecting both the close coordination between Kremlin-affiliated sources and the intensity with which these outlets push the Kremlin’s scripts. As demonstrated by the graphic above, the disinformation campaign regarding Gebrev’s poisoning seemed to peak in late 2019 and early 2020, with most of the relevant articles having been published in that timeframe; this coincides with the intensification of Bellingcat’s investigation into the Gebrev poisoning and Bulgarian prosecutors’ announcement of indictments against the three Russians in question, sparking renewed interest in the case. Another minor peak occurred in early 2021, shortly after Bellingcat published additional investigative reports on the 2015 poisoning and 2014 munitions depot explosion.
[1] “Post-Mortem of a Triple Poisoning: New Details Emerge in GRU’s Failed Murder Attempts in Bulgaria”. Bellingcat, 4 September 2020.
[2] Ibid.
[3] Ibid.
[4] “ГРУ-шник Денис Сергеев (он же – Сергей Федотов) наносит “Новичок” на машину Емельяна Гебрева”, The Insider, 3 September 2020.
[5] “Post-Mortem of a Triple Poisoning: New Details Emerge in GRU’s Failed Murder Attempts in Bulgaria”. Bellingcat, 4 September 2020.
[6] Countering Hybrid Threats in Bulgaria, Policy Brief No. 118. CSD, 2022
[7] Ibid.
[8] “Third Skripal Suspect Linked to 2015 Bulgaria Poisoning”. Bellingcat, 7 February, 2019.
[9] Rakuszitzky, Moritz. “Third Suspect in Skripal Poisoning Identified as Denis Sergeev, High-Ranking GRU Officer”. Bellingcat, 14 February 2019.
[10] Ibid.
[11] “The Dreadful Eight: GRU’s Unit 29155 and the 2015 Poisoning of Emilian Gebrev”, Bellingcat, 23 November 2019.
[12] “Post-Mortem of a Triple Poisoning: New Details Emerge in GRU’s Failed Murder Attempts in Bulgaria”. Bellingcat, 4 September 2020.
[13] Ibid.
[14] Ibid.
[15] Ibid.
[16] “How GRU Sabotage and Assassination Operations in Czechia and Bulgaria Sought to Undermine Ukraine”. Bellingcat, 26 April 2021.
[17] Ibid.
[18] Verseck, Keno. “Is Russia behind the 2014 Czech munition depot blasts?” Deutsche Welle, 20 April 2021.
[19] Countering Hybrid Threats in Bulgaria, Policy Brief No. 118. CSD, 2022
[20] “How GRU Sabotage and Assassination Operations in Czechia and Bulgaria Sought to Undermine Ukraine”. Bellingcat, 26 April 2021.
[21] Five major Russian online news sources in both Russian and English were searched (TASS, RT and Sputnik in both English and Russian, RIA Novosti and Vzgliad in Russian only), utilising pre-selected keywords (Gebrev, EMCO, Bulgaria, poison, Novichok agent, pesticide). The results were reviewed manually, and 38 articles containing disinformation narratives directly linked to Gebrev’s poisoning case were selected over a period ranging from 11 February 2019 to 3 August 2022 (TASS – 9 articles, Vzglyad – 14, RT – 5, Sputnik – 3, RIA Novosti – 7
[22] “Прокуратура Болгарии обвиняет троих россиян в покушении на убийство”. RT, 23 January 2020.
[23] “Захарова: история про отравление Навального окончательно рассыпалась из-за доклада ОЗХО”, Tass.ru, 10 July 2021.
[24] “US Media Invents Poverty-Stricken Top Secret Russian Unit Tasked With ‘Destabilizing Europe’”. Sputnik International, 9 October 2019.
[25] “Alleged Third Suspect in Skripal Case Visited Bulgaria in 2015 – Prosecutor”. Sputnik International, 11 February 2019.
[26] Rakuszitzky, Moritz. “Third Suspect in Skripal Poisoning Identified as Denis Sergeev, High-Ranking GRU Officer”. Bellingcat, 14 February 2019.
[27] Ibid.
[28] Moshkin, Mikhail. “Новый скандал с «Новичком» в Европе преследует три цели”. Vzglyad, 24 November 2019.
[29] Ibid.
[30] “Прокуратура Болгарии обвиняет троих россиян в покушении на убийство”. RT, 23 January 2020.
[31] “Гебрев заявил, что снаряды на сгоревшем в Болгарии складе были для Африки”. RIA Novosti, 1 August 2022.
[32] “Захарова: история про отравление Навального окончательно рассыпалась из-за доклада ОЗХО”, Tass.ru, 10 July 2021.
[33] Bavirin, Dmitri. “Болгарский злодей хочет «отмыться» за счет России”. RIA Novosti, 3 August 2022.