📜 Post with us on Reddit
📝 Create a new article
🏭 Create a company page
🇬🇧 - in English
🇫🇷 - en Français (FR)
🇵🇹 - em Português (PT)
🇩🇪 - auf Deutsch (DE)
🇯🇵 - 日本語で (JA)
Sponsored articles

You can edit almost every page by Creating an account and confirming your email.

Bulgarian spy ring

From EverybodyWiki Bios & Wiki

Template:Prod llm/dated

Bulgarian spy ring
DateAugust 2020 - February 2023 (active period)
LocationUnited Kingdom, Germany, Austria, Spain, Montenegro
Also known as"The Minions"
TypeEspionage
MotiveFinancial gain; surveillance of Kremlin critics, journalists, and military targets on behalf of Russian intelligence
TargetChristo Grozev, Roman Dobrokhotov, Patch Barracks, Bergey Ryskaliyev, Kirill Kachur
ParticipantsOrlin Roussev, Biser Dzhambazov, Katrin Ivanova, Vanya Gaberova, Tihomir Ivanchev, Ivan Stoyanov; directed by Jan Marsalek
OutcomeSix convicted; combined sentences exceeding 50 years' imprisonment
InquiriesMetropolitan Police Counter Terrorism Command (Operation Skirp)
Arrests8 February 2023
ConvictedOrlin Roussev, Biser Dzhambazov, Ivan Stoyanov (guilty pleas); Katrin Ivanova, Vanya Gaberova, Tihomir Ivanchev (jury verdict, 7 March 2025)
ChargesConspiracy to spy (Official Secrets Act 1911); possession of false identity documents (Identity Documents Act 2010)
TrialNovember 2024 - March 2025, Central Criminal Court (Old Bailey)
VerdictGuilty
Sentence5 years and 3 weeks to 10 years and 8 months per defendant
The Central Criminal Court (Old Bailey) in London, where the trial and sentencing took place

The Bulgarian spy ring, sometimes referred to in British media as "the Minions", was a network of six Bulgarian nationals living in the United Kingdom who were convicted of spying for Russia between August 2020 and February 2023. The group was directed by Jan Marsalek, the fugitive former chief operating officer of the collapsed German payments firm Wirecard, who acted as an intermediary between Russian intelligence and the cell's UK-based leader, Orlin Roussev. Operating from a former guesthouse in Great Yarmouth, Norfolk, Roussev coordinated six espionage operations across the UK, Germany, Austria, Spain, and Montenegro, targeting investigative journalists, political dissidents, and a US military base.[1][2]

The six were arrested on 8 February 2023 by officers from the Metropolitan Police's Counter Terrorism Command in coordinated raids across London and Great Yarmouth in an operation codenamed "Operation Skirp".[3] Roussev, Dzhambazov, and Stoyanov pleaded guilty before trial, while Ivanova, Gaberova, and Ivanchev were found guilty by a jury at the Old Bailey on 7 March 2025 after a trial that began in November 2024.[4] On 12 May 2025, Mr Justice Nicholas Hilliard sentenced the six to combined terms exceeding 50 years, describing the case as involving "very serious" offences that undermined the United Kingdom's national security and its standing with allies.[5] Commander Dominic Murphy, head of the Metropolitan Police Counter Terrorism Command, described the network's activities as "espionage on an industrial scale".[2] The case attracted extensive international media coverage, with reporting in French, Spanish, Dutch, and other European media alongside the English, German, Bulgarian, and Russian coverage.[6][7]

Background

Jan Marsalek and Wirecard

Jan Marsalek, born on 15 March 1980 in Vienna, was the grandson of Hanz Marsalek, a Czech communist suspected of having spied for the Soviet Union while working as an officer for the Austrian state police.[8] Marsalek dropped out of high school in Austria and went on to work for a technology company in Bavaria before joining the German financial technology firm Wirecard in 2000, one year after its founding. He rose to become its chief operating officer by 2010.[9][8] When Wirecard collapsed in June 2020 amid revelations that approximately 1.9 billion euros supposedly held in Asian trustee accounts did not exist, Marsalek fled Germany. He is believed to have travelled through Belarus before settling in Russia, where Interpol subsequently issued a red notice for his arrest.[9]

A 2023 joint investigation by Der Spiegel, Der Standard, The Insider, and ZDF concluded that Marsalek had been recruited as a Russian intelligence operative since at least 2010. A later investigation revealed that he had been living in Russia under the false identity "Alexander Mikhailovich Nelidov" and had obtained Russian citizenship under that name in 2023. Leaked data placed his phone hundreds of times near the headquarters of Russia's FSB in Moscow between January and November 2024.[10]

Court documents revealed over 80,000 messages recovered from Roussev and Dzhambazov on the encrypted Telegram messaging app following their arrest. These messages shed light on Marsalek's lifestyle in Moscow, revealing that he partied with intelligence officers, obtained cosmetic surgery to disguise his identity, and told associates he wanted to "outperform James Bond".[11]

In Telegram messages presented during the London trial, Marsalek and Roussev discussed topics extending well beyond the spy ring's direct operations. In July 2022, Marsalek sent Roussev a selfie of himself dressed in full military combat gear bearing the "Z" symbol adopted by Russia's armed forces during the invasion of Ukraine. The pair also discussed plans to supply drones to Russia and weapons to Cameroon, expressed their admiration for Elon Musk, and talked about organising an airlift out of Kabul during the fall of Kabul in 2021.[12]

Recruitment of Roussev

According to research by Bayerischer Rundfunk, Marsalek and Roussev had been in contact since at least 2015, when Marsalek was still a Wirecard board member. Emails obtained by BR showed that the pair exchanged information about secure, eavesdrop-resistant mobile phones as early as June 2015.[13] According to the Financial Times, the pair were introduced by a mutual acquaintance at the offices of Tim Levy, a London wealth adviser. Levy told the FT he met Roussev on two occasions and described him as "a nerd, a technical geek" with "no charisma", adding he had been "gobsmacked" to learn of his involvement in espionage.[14] In 2019, Marsalek arranged for Wirecard to transfer several tens of thousands of euros to companies associated with Roussev and Dzhambazov.[13] The espionage operations themselves began in August 2020, two months after Marsalek's arrival in Russia.[15]

Outsourcing of Russian espionage

The case was seen by British officials as part of a broader trend in which Russian intelligence services, particularly the GRU, began outsourcing espionage activities to proxy networks following the mass expulsion of suspected Russian intelligence officers from Western countries. These expulsions were triggered by the 2018 Novichok poisoning of Sergei Skripal in Salisbury and intensified after Russia's 2022 invasion of Ukraine.[9] A 2025 report by the Congressional Research Service noted that following the expulsion of over 750 Russian diplomats from Europe and the United States since 2022, Russia's intelligence services had "adapted by using proxies, organized crime groups, and other disposable agents", a model that "arguably increases Russian intelligence flexibility and deniability but may decrease effectiveness, as most proxies have little to no training".[16] A January 2026 insights paper by the Royal United Services Institute described a shift from Cold War-era reliance on trained intelligence operatives to a model characterised by "remote, freelance and highly deniable assignments" in what it termed the "gig-economy era" of Russian intelligence activity.[17] In October 2024, the head of MI5, Ken McCallum, publicly stated that the GRU was seeking to cause "mayhem" across Britain and Europe and was turning to "criminals, drug traffickers and proxies" to carry out its work.[9] Commander Murphy of the Metropolitan Police described the Marsalek-Roussev operation as "one of those clear examples of outsourcing".[9] The Crown Prosecution Service noted that prosecutions for espionage in British courts were "very rare", as cases involving foreign nationals had traditionally been dealt with through diplomatic expulsions.[18] Evidence presented at trial by Matthew Collins, the UK's deputy national security adviser, confirmed that the implosion of Russian intelligence networks after the Salisbury expulsions had forced Moscow to "increasingly lean on non-Russian nationals to conduct espionage".[14]

Members

The spy ring consisted of six Bulgarian nationals who had been living in the United Kingdom for more than a decade at the time of their arrest.[19]

Orlin Roussev (born 6 February 1978) served as the group's operational leader and was the primary point of contact with Marsalek. He moved to the United Kingdom in 2009 and worked in a series of technology roles, including as chief technology officer for a City of London financial firm.[20] According to his LinkedIn profile, Roussev claimed expertise in artificial intelligence, secure communications, and signals intelligence, and in 2012 founded an umbrella company called NewGenTech Ltd.[14] In messages to Marsalek, he used the codename "Jackie Chan" and referred to his premises as his "Indiana Jones warehouse".[21]

Biser Dzhambazov (born 21 April 1981), Roussev's deputy, was a medical courier living in Harrow, north-west London. He used the codenames "Mad Max" and "Jean-Claude Van Damme" and referred to his operatives as "the Minions", after the characters from the Despicable Me animated films who serve the villain Gru, a name that also served as a reference to Russia's GRU military intelligence agency.[22] Dzhambazov ran a Bulgarian community organisation alongside Ivanova that provided courses on "British values", and the pair worked for electoral commissions in London that facilitated voting in Bulgarian elections for citizens abroad.[20][18] In text messages to Roussev, Dzhambazov boasted of having a "very strong relationship" with Bulgarian President Rumen Radev and other senior Bulgarian politicians, connections he described as "iron clad".[23] Both Dzhambazov and Ivanova had joined the Bulgarian Socialist Party in early 2016.[24]

Katrin Ivanova (born 1 July 1991), a laboratory technician, was Dzhambazov's long-term partner and lived with him in Harrow. She was described by the prosecution as the group member most likely to have been deployed to operate an IMSI-catcher device at a US military base in Germany.[25]

Vanya Gaberova (born circa 1995, age 30 at sentencing) was a beautician who ran a salon called "Pretty Woman" in London. She was deployed as a "honeytrap" operative, tasked with approaching target Christo Grozev through social media.[26] During surveillance in Montenegro, Gaberova used Ray-Ban smart glasses to record footage of a target's compound in Budva, inadvertently capturing an image of herself conducting surveillance in a mirror she walked past; the footage was shown several times during the trial.[14]

Tihomir Ivanov Ivanchev (born circa 1986, age 39 at sentencing), a painter and decorator and competitive swimmer, was Gaberova's former boyfriend. He was described by the court as having ceased participating in the group's activities before the arrests of other members.[27]

Ivan Stoyanov (born 22 December 1991), a mixed martial arts fighter who had represented Bulgaria at judo and sambo and used the nickname "The Destroyer", lived in Greenford, west London.[28] He pleaded guilty on 26 November 2024.[2]

Westminster access

A BBC investigation published in May 2025 revealed that at least three members of the spy ring had attended a Brexit-related debate inside the Palace of Westminster in May 2016. Photographs found on social media showed Roussev, Dzhambazov, and Ivanova seated in a Commons committee room alongside representatives of European political parties, including the Bulgarian Socialist Party and members of the Social Democratic Party of Romania. They were photographed behind Georgi Pirinski, then a Member of the European Parliament for the BSP and a former chair of the Bulgarian National Assembly. Roberto Speranza, who later became Italy's Minister of Health, was also present at the event. The use of the committee room had been sponsored by Lyn Brown, then the Member of Parliament for West Ham and later created Baroness Brown of Silvertown by Prime Minister Keir Starmer. Brown told the BBC she had "absolutely no memory" of the event and did not believe she had "met or spoken to the three individuals".[29][30]

Operations

Police recovered approximately 78,747 Telegram messages between Marsalek (operating under the pseudonym "Rupert Ticz") and Roussev, as well as over 200,000 messages overall across the group. These messages formed the core of the prosecution's case and revealed six distinct espionage operations conducted between August 2020 and February 2023.[31][13]

Surveillance of Christo Grozev

The most prominent operation targeted Christo Grozev, a Bulgarian investigative journalist who worked for Bellingcat and was the lead investigator behind reports identifying the Russian operatives responsible for the 2018 Salisbury Novichok attack and the 2020 poisoning of Alexei Navalny. The operation began in December 2020, when Marsalek wrote to Roussev: "We'd be interested in a Bulgarian guy working for Bellingcat: Christo Grozev. Can we look into this guy or would it raise too many questions?"[15] Marsalek had personal knowledge of Grozev from his Wirecard days, telling Roussev: "I'm very familiar with them: Wirecard was processing a large part of their payments and we had access to the flight booking data as well."[9]

At Marsalek's direction, Roussev first orchestrated surveillance of a villa linked to Grozev in Bulgaria, before expanding the operation to Vienna, where the journalist lived, and then to following him to a Bellingcat conference in Valencia, Spain.[15] In Valencia, Gaberova attended the conference, photographed Grozev, and ate breakfast at his hotel as part of an attempted honeytrap approach that also included sending him a Facebook friend request. In WhatsApp messages to the group, Roussev described Grozev as "hooked and in love" with Gaberova.[20][26] Marsalek and Roussev also discussed stealing Grozev's computer, kidnapping him and transporting him to Russia, and even killing him or burning down his house.[4][32]

The group located Grozev's father's apartment in Vienna and surveilled it. After Grozev's father died unexpectedly, Austrian police impounded the body for forensic examination, though the results were never communicated to Grozev.[32] Separately, the spy ring succeeded in stealing Grozev's laptop from his Vienna apartment and couriering it to Moscow for analysis. However, when it arrived, Marsalek wrote to Roussev in July 2022: "Sadly... it isn't very exciting." Grozev later told police he had not even noticed the laptop was missing.[14] Late in 2022, Marsalek expressed doubt about the value of continuing the operation, writing: "Personally I find CG [Grozev] not to be a very valuable target but apparently Putin seriously hates him."[14]

In a related development, Austrian former intelligence officer Egisto Ott was arrested in March 2024 and subsequently convicted in May 2026 of spying for Russia. Prosecutors established that Ott had provided Grozev's Vienna address to Marsalek, who then arranged the break-in at the journalist's apartment. Ott was sentenced to four years and one month in prison.[33]

Surveillance of Roman Dobrokhotov

A second operation targeted Roman Dobrokhotov, the founder and editor-in-chief of the investigative outlet The Insider, a Russian journalist based in the West whose work had also exposed Russian intelligence operations. Roussev secured access to a travel industry booking system showing that Dobrokhotov would be travelling from Budapest to Berlin in November 2021. Ivanova was booked onto an adjacent seat on the flight, where she used a camera hidden in the shoulder strap of her bag to record surveillance footage. Peering over his shoulder, she memorised his iPhone PIN code and reported it back to Roussev. Her camera also captured details including that Dobrokhotov had two phones, used social media, listened to music, and played Sudoku.[34][14] Dobrokhotov later told the Financial Times he had been unaware of being followed, and noted that the stolen PIN code was in fact incorrect.[14]

When discussing this operation, Marsalek told Roussev: "I would love to kidnap the guy now even more."[26] He also warned Roussev to pull his team back during one phase of surveillance in Montenegro, saying: "We don't want our team to run into another team by accident", suggesting that other Russian intelligence units were also monitoring Dobrokhotov.[9]

In March 2025, shortly after the spy ring's conviction, Dobrokhotov told The Observer that he had received a fresh warning from police the previous spring about ongoing surveillance attempts against his family. "These attempts are ongoing," he said, though the details were withheld at his request.[35]

Surveillance of Kirill Kachur

A third operation, from September 2021 to 2022, targeted Kirill Kachur, a former investigator in the Investigative Committee of Russia who had left the country in 2021 and was charged in absentia with embezzlement by Russia in November 2022. He was later designated a "foreign agent" by the Kremlin. The operation was conducted by all six members of the group in Montenegro, where Kachur was spending time. The spy ring rented a villa near Kachur's location at a cost of 5,000 euros per month, used drones for surveillance, and members of the group liaised directly with officers of the Russian intelligence service on the ground, one of whom was given the codename "Red Sparrow".[36][3][37]

In February 2022, Dzhambazov forwarded to Ivanova a message stating: "They are offering a 500,000 euro reward plus 150,000 euro operating costs for this one's head," followed by: "They said that if Kiril dies from an incident during his capture no one will get cross." Roussev proposed that his father, whom he described as a pilot, could fly a private plane for the abduction: "The kidnap part is easy... but then [for] transport part I suggest a private flight."[38][14] No abduction took place, although chilling evidence emerged during the trial: on 9 September 2022, Roussev messaged Dzhambazov with "personal compliments to our team and thanks from ALFA" (a reference to the Alfa Group, a special forces unit within the FSB), stating that "yesterday... they captured Kiril and his boss at the FSB, where they have been looking for him for 5 years." The Evening Standard reported that the inference was that an FSB unit had kidnapped Kachur and another man in Montenegro and spirited them across the border into Russia, possibly assisted by information provided by Roussev's spy ring. An anonymous SO15 witness told the trial that investigators had hoped to obtain a statement from Kachur but were unable to locate him.[3]

Patch Barracks operation

Patch Barracks near Stuttgart, a target of the spy ring's surveillance operations

From autumn 2022, members of the group carried out surveillance on Patch Barracks, a US military base near Stuttgart, Germany, where Ukrainian soldiers were believed to be undergoing training on the Patriot air defence system. The cell planned to deploy an IMSI-catcher, a sophisticated device capable of intercepting mobile phone signals, to capture the telephone numbers of Ukrainian soldiers at the base. This information was intended to allow Russian intelligence to track the soldiers once they returned to Ukraine and identify Patriot missile firing positions.[4][25][39]

Group members photographed doorbells and nameplates on buildings near the base and searched property websites for rental apartments in the vicinity.[13] Two IMSI-catcher devices were recovered from Roussev's guesthouse: a larger unit known as the "Razor II", valued at approximately 120,000 pounds sterling, and a smaller concealable device called "Stealth", worth around 40,000 pounds. The Razor II had been modified to include a battery for portable deployment and a Wi-Fi interface for remote communication. Both were described in court as "law enforcement grade" equipment not previously known to have fallen into criminal hands.[40] The operation was halted only by the group's arrest in February 2023.[13] Charles Prichard, a spokesman for the United States European Command, confirmed the command was "following developments in the case" but declined to discuss specific force protection measures.[39]

Kazakhstan operations

The spy ring conducted two separate operations connected to Kazakhstan. The first, in 2021, involved surveillance of Bergey Ryskaliyev, a former governor of Atyrau Region who had fled to London after being accused of large-scale embezzlement and sentenced in absentia to 17 years in prison, and who had been granted asylum in the United Kingdom. Surveillance included discussion about dressing up as Deliveroo drivers to gain access to his west London properties and using ambulances as "perfect cover" to disguise their activities.[41][42]

A second Kazakhstan-related operation in 2022 was a disinformation and influence campaign. The spy ring created a fictitious opposition group called "Truth on the Steppes" (TOTS), ostensibly opposed to Kazakh President Kassym-Jomart Tokayev, and planned to stage a protest at the Kazakh embassy in London. The protest was to involve spraying 100 litres of pig's blood on the embassy building by drone, to be filmed and published with the claim that it represented "the blood of the innocent Kazakh people, which the president has on his hands". Marsalek also prepared a letter-writing campaign to public officials in Europe and the United States, urging them to impose sanctions on Kazakhstan and Tokayev's family.[41][3] Moscow's objective was to fabricate intelligence about an opposition group in London and share it with Kazakh intelligence services to gain favour with Tokayev's government. The protest was never carried out, but the broader operation coincided with Russian efforts to pressure Kazakhstan into deporting Mikhail Zhilin, a Russian intelligence officer who had defected in September 2022 in opposition to the invasion of Ukraine. Zhilin was indeed forcibly returned to Moscow in December 2022.[3]

Arrest and evidence

On 8 February 2023, more than 100 officers from the Metropolitan Police Counter Terrorism Command conducted coordinated raids on four addresses in London and one in Great Yarmouth as part of Operation Skirp. Officers wore balaclavas to preserve their anonymity, which Commander Murphy described as essential when "going up against Russia and China, going up against advanced adversaries".[21] Roussev was arrested at the Haydee guesthouse, where police body-worn camera footage showed him "scared and startled" when officers burst in. Dzhambazov was found naked in bed with Gaberova at her flat in Euston rather than at his shared home with Ivanova in Harrow. A sixth suspect, Ivanchev, was arrested at a later date.[3][22][21]

The search of Roussev's guesthouse took more than a week. Police recovered what Commander Murphy described as an "Aladdin's cave" of spy equipment spread across three rooms: 221 mobile phones, 495 SIM cards, 88 audio and visual recording devices, 11 drones, 16 radios, Wi-Fi eavesdropping devices and jammers, two IMSI catchers, and 65 fake identity documents in 55 different names, including 75 passports and 91 bank cards. In total, 3,540 exhibits were seized from all addresses, including 1,650 digital items.[21][40] Many of the surveillance devices had been built or adapted by Roussev himself, who boasted in messages to Marsalek that he was becoming like the James Bond character Q.[40] Spy cameras had been concealed inside sunglasses, pens, neckties, wristwatches, a cigarette lighter, a car key fob, pendant necklaces, earrings, a Coca-Cola bottle, a computer mouse, a smoke detector, a coat hook, water bottles, and a Minions stuffed toy. Some devices contained SIM cards allowing them to stream live footage directly to other members of the ring.[40][34]

At Ivanova and Dzhambazov's flat in Harrow, police found several forged passports bearing Marsalek's photograph, issued in the names of Belgian, Bulgarian, and French nationals.[4] Across all locations, the forged documents included passports from the United Kingdom, Bulgaria, France, Italy, Spain, Croatia, Slovenia, Greece, and the Czech Republic. The documents had been used to open twelve bank accounts in Britain, though the group does not appear to have used them for international travel.[43][13]

Upon arrest, Roussev denied involvement in any espionage, telling police: "No James Bond activity on my end, I guarantee you."[22]

Trial and conviction

Charges

On 21 September 2023, the Crown Prosecution Service authorised charges against five of the six suspects. Roussev, Dzhambazov, Ivanova, Stoyanov, and Gaberova were charged with conspiring to collect information intended to be "directly or indirectly useful to an enemy for a purpose prejudicial to the safety and interest of the state" between 30 August 2020 and 8 February 2023, contrary to Section 1 of the Criminal Law Act 1977. Roussev, Dzhambazov, and Ivanova were additionally charged with possession of false identity documents with improper intention, contrary to Section 4(1) of the Identity Documents Act 2010. Ivanchev was later added as a sixth defendant.[18][2]

Proceedings

The trial opened on 28 November 2024 at the Central Criminal Court in London before Mr Justice Nicholas Hilliard. Roussev and Dzhambazov had already pleaded guilty to conspiracy to spy. Stoyanov pleaded guilty on 26 November 2024 to spying contrary to Section 1(1)(c) of the Official Secrets Act 1911. None of the three appeared in person during the trial, though Roussev was frequently referenced.[2][44]

The prosecution, led by Alison Morgan KC, presented evidence drawn from the decrypted Telegram messages and seized equipment. Morgan told the jury: "They were targeting people and places where the information that they obtained would be of particular use to Russia. It was highly sensitive information. By gathering the information and passing it on to the Russian state, the defendants were putting many lives at risk."[44] She warned the jury that defence counsel would emphasise the "amateurish antics" of the defendants, adding: "But it's not funny at all... They were not stupid. This was high-level espionage with very high stakes."[26]

During the trial, Ivanova, Gaberova, and Ivanchev denied the charges. The two women claimed Dzhambazov had deceived and manipulated them. Gaberova told the court she had believed she was working on legitimate operations linked to Interpol, and that Dzhambazov had shown her fake Interpol identity cards bearing his name and photograph "many times".[45] Ivanova stated she had believed Grozev was "a corrupt journalist" linked to an arms dealer, and that she had never been trained to use an IMSI catcher and had never heard of such a device until after her arrest.[25][38] Gaberova's barrister, Anthony Metzer KC, argued that she had been "controlled, coerced into this conspiracy" by Dzhambazov, who had falsely claimed to have cancer.[22] Ivanova's defence barrister, Rupert Bowers KC, sought to cast doubt on the reliability of the Telegram chats, characterising Marsalek and Roussev as "hapless fantasists, sitting in their various bedrooms or wherever, sending these messages".[14]

Verdict

After more than 32 hours of deliberation, the jury at the Old Bailey returned unanimous guilty verdicts against all three defendants on 7 March 2025. Ivanova was additionally convicted of possessing false identity documents under Section 4(1) of the Identity Documents Act 2010.[4][46]

Sentencing

A four-day sentencing hearing took place from 7 to 12 May 2025 at the Old Bailey before Mr Justice Nicholas Hilliard. The sentencing was broadcast on television.[27][47] In his remarks, Mr Justice Hilliard stated that using the United Kingdom as a base for espionage operations was a "very serious offence" that "undermines this country's standing with allies" and that "targeting journalists undermines freedom of the press, one of our core democratic values". He noted that conspiracy to spy carried a maximum sentence of 14 years, but afforded credit to Roussev, Dzhambazov, and Stoyanov for their guilty pleas.[5]

The sentences were as follows:[2][48]

Defendant Sentence Notes
Orlin Roussev 10 years and 8 months Pleaded guilty. Involved in all six operations. Confiscation order of £180,768 also imposed.
Biser Dzhambazov 10 years and 2 months Pleaded guilty.
Katrin Ivanova 9 years and 8 months (plus 15 months concurrent for false documents) Convicted by jury. Judge accepted she would not have become involved without meeting Dzhambazov but had "thrown in her lot" with him "by free choice".
Tihomir Ivanchev 8 years Convicted by jury. Ceased participation before other arrests.
Vanya Gaberova 6 years, 8 months, and 3 weeks Convicted by jury. Judge noted she found spying "exciting and glamorous".
Ivan Stoyanov 5 years and 3 weeks Pleaded guilty. Sentence reduced by 15% for early plea.

Mr Justice Hilliard noted that all defendants were "motivated by money" and had lived "very comfortably" on the substantial sums they received. He said the risk to their targets was "obvious" and that Roussev would have been aware of the "extreme actions" Russia had taken against those it regarded as enemies of the state. He ordered that each defendant would serve half of their sentence in prison, after which they would be subject to automatic deportation to Bulgaria.[5][27]

Reactions

Christo Grozev submitted a victim impact statement that was read during the sentencing hearing, in which he stated: "Learning only in retrospect that foreign agents have been monitoring my movements, communications and home, surveying my loved ones over an extended period, has been terrifying, disorientating and deeply destabilizing. The consequences have not faded with time; they have fundamentally changed how I live my daily life and how I relate to the world around me." In a separate interview with The Guardian, Grozev said: "They may have come across as muppets, but it's clear that their plans could have been incredibly dangerous." He noted that he had been unable to return to Vienna or any Schengen country and had been living in a state of "permanent displacement".[22][32]

Security minister Dan Jarvis said: "These substantial sentences should send a clear warning to anyone seeking to threaten our security, harm the UK, and compromise the safety of the public." He described the case as "a stark reminder of the increasingly complex threat we face from hostile states who wish to undermine us".[2]

Frank Ferguson, Head of the CPS Special Crime and Counter Terrorism Division, stated that by "targeting individuals in the UK fleeing persecution as well as journalists opposing the Russian regime", the group had "undermined the message that the UK is a safe country for those people".[1]

Andrei Soldatov, a Russian journalist and intelligence expert, offered a broader interpretation of the case's significance, telling the Financial Times: "The very fact that you conduct this kind of operation already serves a purpose, and the purpose is to raise the stakes, to raise the costs of protection." He argued that Russia's intelligence agencies did not need to conduct "really successful operations" but merely needed "to indicate that they are willing to do it".[14]

The Russian embassy in London did not comment on the case. The Kremlin has consistently rejected allegations of espionage operations in the United Kingdom.[12]

Wider network and related cases

Subsequent reporting revealed that the spy ring's network extended beyond the six convicted individuals. According to The Telegraph, Marsalek's network of agents was "far larger" and extended to the United States, Germany, Austria, Israel, Italy, Switzerland, France, Croatia, Hong Kong, and Turkey. The Bulgarian spy ring's activities could be traced as far back as 2015, and investigators reported that Marsalek held a diplomatic passport from Uzbekistan.[48]

Two additional Bulgarian nationals were identified in connection with the cell but were not charged in the UK proceedings. Cvetelina Gencheva, who resided in Sofia, is alleged to have used her employment in the airline industry to obtain private flight details of targets, and to have supported the surveillance of Dobrokhotov in Berlin. Tsvetanka Doncheva lived in Vienna in an apartment across from Grozev's residence and photographed his home for the cell's use.[5]

In Austria, the case intersected with the prosecution of Egisto Ott, a former intelligence officer who had worked for Austria's now-defunct Federal Office for the Protection of the Constitution and Counterterrorism (BVT). Ott was arrested in March 2024 and charged with, among other offences, collecting secret information and personal data from police databases between 2017 and 2021 for the purpose of transmitting them to Marsalek and Russian intelligence. Vienna prosecutors established that Ott had also supplied Marsalek's network with a SINA-S laptop, hardware used by European Union governments for secure communications, in exchange for 20,000 euros. He was convicted and sentenced in May 2026.[33][49]

In November 2025, the United Kingdom's National Crime Agency disclosed that two money-laundering networks known as "Smart" and "TGR", which used cryptocurrency to transfer funds for criminal organisations and sanctioned individuals, had been used by Russian intelligence services to finance the Bulgarian spy cell. The NCA stated that persons connected to Russian intelligence attempted to use the Smart network to fund the Bulgarian operatives during the summer of 2023, after most members of the group had been arrested. The money-laundering scheme was also alleged to have been used by entities ranging from Russian oligarchs to the Kinahan cartel, an Irish cocaine trafficking organisation linked to multiple contract killings.[50]

Significance

The case was described by the Metropolitan Police as "one of the largest and most complex" enemy intelligence operations to be uncovered on United Kingdom soil.[1] Legal commentators noted its significance not only for national security but for what it revealed about the changing nature of Russian intelligence operations, in which espionage is increasingly "outsourced" to non-professional proxies recruited through financial incentives rather than ideology. The Lexology legal analysis described the case as remarkable for the "opaque nature" of the operations, which had been "conducted from two-bedroom flats in Harrow".[19]

The Frankfurter Allgemeine Zeitung and tagesschau in Germany emphasised the Wirecard connection, noting that the case provided further evidence that the collapsed payments firm had served as a vehicle for Russian intelligence activities during its years of operation.[51][13] The Zeit reported that the spy ring was involved in six major operations across Europe, and that Marsalek served as the intermediary between Russian intelligence and the cell's operational leader, while never being charged in the London proceedings. Commander Murphy stated that Marsalek was "a significant person of interest" and that there were "ongoing investigations across the board, both here and overseas", but added that Marsalek was not currently wanted by British police, noting: "That's not to say he won't be."[52][9]

The Spanish newspaper El Mundo described the trial as "the largest espionage trial in the United Kingdom" and noted the unprecedented public disclosure of Russian intelligence tradecraft through the Telegram messages presented as evidence.[53] The French broadcaster BFMTV reported that according to Marsalek, Russian President Vladimir Putin "really hated" Grozev and had discussed killing him with a hammer.[6] The Dutch public broadcaster NOS noted that the case revealed how Russian intelligence had shifted its methods to using "contractors" operating under civilian cover rather than trained intelligence officers.[7]

The Bulgarian media outlet Darik News and others covered the sentences extensively, noting the unprecedented nature of a case in which six Bulgarian nationals received heavy prison terms abroad for espionage.[54] The Spanish news agency EFE reported on the case for Latin American audiences through Infobae, noting that members had concealed their espionage activities behind ordinary professions as beauticians, health workers, and decorators.[55]

See also

References

  1. ↑ 1.0 1.1 1.2 "Six Bulgarians jailed after spying for Russia in UK". The Guardian. 12 May 2025. Retrieved 7 June 2026.
  2. ↑ 2.0 2.1 2.2 2.3 2.4 2.5 2.6 "UPDATED WITH SENTENCE: Members of Russian spy ring jailed for more than 50 years total". Crown Prosecution Service. 12 May 2025. Retrieved 7 June 2026.
  3. ↑ 3.0 3.1 3.2 3.3 3.4 3.5 "Bulgarian spy ring a 'treasure trove' of evidence about Putin's spy war on Britain". Evening Standard. 7 March 2025. Retrieved 7 June 2026.
  4. ↑ 4.0 4.1 4.2 4.3 4.4 "Bulgarians convicted in UK of being Russian spies working for Wirecard fugitive". Reuters. 7 March 2025. Retrieved 7 June 2026.
  5. ↑ 5.0 5.1 5.2 5.3 "'Minions' spies sentencing live: Ringleader of Bulgarian spy cell jailed for nearly 11 years". BBC News. 12 May 2025. Retrieved 7 June 2026.
  6. ↑ 6.0 6.1 Vincent Gautier (7 March 2025). "Royaume-Uni: trois Bulgares surnommes "les Minions" juges coupables d'espionnage au profit de la Russie". BFMTV (in français). Retrieved 7 June 2026.
  7. ↑ 7.0 7.1 "Drie Bulgaren in Londen schuldig bevonden aan spionage voor Rusland". NOS (in Nederlands). 8 March 2025. Retrieved 7 June 2026.
  8. ↑ 8.0 8.1 "Europe's 'most wanted' uncovered as Russian spy boss on the run". Daily Express. 8 March 2025. Retrieved 7 June 2026.
  9. ↑ 9.0 9.1 9.2 9.3 9.4 9.5 9.6 9.7 "Wirecard Fugitive Jan Marsalek: From Financial Fraudster to Russian Spymaster". U.S. News & World Report. 7 March 2025. Retrieved 7 June 2026.
  10. ↑ "Fugitive Wirecard Executive Living in Moscow Under False Identity, Investigation Reveals". The Moscow Times. 17 September 2025. Retrieved 7 June 2026.
  11. ↑ "Honeytraps and high tech: Russian spy ring members jailed in the U.K." NBC News. 12 May 2025. Retrieved 7 June 2026.
  12. ↑ 12.0 12.1 "Russian spy ring leader jailed in UK for nearly 11 years". CNN. 12 May 2025. Retrieved 7 June 2026.
  13. ↑ 13.0 13.1 13.2 13.3 13.4 13.5 13.6 "Großbritannien: Hohe Haftstrafen für "Marsalek-Spione"". tagesschau.de (in Deutsch). 12 May 2025. Retrieved 7 June 2026.
  14. ↑ 14.00 14.01 14.02 14.03 14.04 14.05 14.06 14.07 14.08 14.09 14.10 "The Wirecard fugitive, Russian intelligence and a Bulgarian spy ring". Financial Times. 7 March 2025. Retrieved 7 June 2026.
  15. ↑ 15.0 15.1 15.2 "'The dumbest thing I've ever done': spy trial's tales of scheming, bluster and tangled relationships". The Guardian. 7 March 2025. Retrieved 7 June 2026.
  16. ↑ Russia's Foreign Intelligence Services (PDF) (Report). Congressional Research Service. 3 December 2025. Retrieved 7 June 2026.
  17. ↑ "Responding to Russian Sabotage Financing". Royal United Services Institute. 14 January 2026. Retrieved 7 June 2026.
  18. ↑ 18.0 18.1 18.2 "Five Bulgarians living in UK charged with spying for Russia". The Guardian. 21 September 2023. Retrieved 7 June 2026.
  19. ↑ 19.0 19.1 "The Russian spy cell operating next door". Lexology. 27 May 2025. Retrieved 7 June 2026.
  20. ↑ 20.0 20.1 20.2 "Bulgarians guilty of spying for Russia in the UK". BBC News. 7 March 2025. Retrieved 7 June 2026.
  21. ↑ 21.0 21.1 21.2 21.3 "The 'Indiana Jones' spy treasure trove hidden in plain sight on a Great Yarmouth street". Evening Standard. 7 March 2025. Retrieved 7 June 2026.
  22. ↑ 22.0 22.1 22.2 22.3 22.4 Gavin Blackburn (12 May 2025). "Bulgarian boss of Russian spy ring gets more than 10 years in prison, UK judge says". Euronews. Retrieved 7 June 2026.
  23. ↑ "UK-based Russian spy ring linked to 'highest echelons' in Bulgaria, trial told". The Independent. 30 January 2025. Retrieved 7 June 2026.
  24. ↑ "Българските шпиони в Лондон са били на събитие с политици от БСП в британския парламент". Boulevard Bulgaria (in български). 5 May 2025. Retrieved 7 June 2026.
  25. ↑ 25.0 25.1 25.2 "Woman accused of stealing Ukrainian soldiers' mobile numbers, court hears". The Guardian. 28 January 2025. Retrieved 7 June 2026.
  26. ↑ 26.0 26.1 26.2 26.3 Mark Hollingsworth (12 May 2025). "How a Bulgarian spy ring waged Putin's hybrid war on British soil". The Independent. Retrieved 7 June 2026.
  27. ↑ 27.0 27.1 27.2 "Българите, уличени в шпионаж в Лондон, отиват в затвора". Под тепето (in български). 13 May 2025. Retrieved 7 June 2026.
  28. ↑ "Six Bulgarians who ran Russian spy ring out of guesthouse on east coast of England are jailed". Sky News. 12 May 2025. Retrieved 7 June 2026.
  29. ↑ "Investigation reveals how Russian spies accessed Brexit debate in Parliament". Daily Express. 5 May 2025. Retrieved 7 June 2026.
  30. ↑ "Българи, осъдени за шпионаж, присъствали на събитие в британския парламент". News.bg (in български). 5 May 2025. Retrieved 7 June 2026.
  31. ↑ "The spymaster, the ringleader and the 'minions': who's who in the Russian spy ring". The Guardian. 7 March 2025. Retrieved 7 June 2026.
  32. ↑ 32.0 32.1 32.2 "'They came across as muppets': Christo Grozev on being target of Bulgarian spy ring". The Guardian. 10 March 2025. Retrieved 7 June 2026.
  33. ↑ 33.0 33.1 "Austrian Former Domestic Intelligence Officer Spied for Russia, Court Finds". U.S. News & World Report. 20 May 2026. Retrieved 7 June 2026.
  34. ↑ 34.0 34.1 Holly Evans (12 May 2025). "Spy ties and Coke bottle cameras: Inside the Bulgarian gang's James Bond-style spyware". The Independent. Retrieved 7 June 2026.
  35. ↑ "Revealed: second Kremlin spy ring targeting Russian dissidents discovered in UK". The Guardian. 8 March 2025. Retrieved 7 June 2026.
  36. ↑ "Bulgarian trio convicted of conspiring to spy for Russia". Crown Prosecution Service. 7 March 2025. Retrieved 7 June 2026.
  37. ↑ "Who were the targets of Russian spy ring dubbed 'the Minions'?". Sky News. 7 March 2025. Retrieved 7 June 2026.
  38. ↑ 38.0 38.1 "Woman accused of spying for Moscow questioned over plan to kidnap Russian wanted by Kremlin". The Guardian. 27 January 2025. Retrieved 7 June 2026.
  39. ↑ 39.0 39.1 "Bulgarians on trial in UK spied on US base in Stuttgart, prosecutors say". Stars and Stripes. 29 November 2024. Retrieved 7 June 2026.
  40. ↑ 40.0 40.1 40.2 40.3 "Russian spy found hiding in Great Yarmouth hotel 'boasted he was becoming James Bond character Q'". Daily Mirror. 9 January 2025. Retrieved 7 June 2026.
  41. ↑ 41.0 41.1 "Bulgarian Spy Ring Attempted to Threaten Kazakh President's Western Ties". Times of Central Asia. 7 May 2025. Retrieved 7 June 2026.
  42. ↑ "UK-based spy ring guilty of passing secrets to Russia". The Independent. 7 March 2025. Retrieved 7 June 2026.
  43. ↑ "Главу российской шпионской сети в Лондоне приговорили к 10 годам тюрьмы". The Moscow Times (in русский). 12 May 2025. Retrieved 7 June 2026.
  44. ↑ 44.0 44.1 "Bulgarians spied on US base and dissidents for Russia, UK court told". Reuters. 28 November 2024. Retrieved 7 June 2026.
  45. ↑ "Alleged spy tells trial she thought she was helping police". BBC News. 30 January 2025. Retrieved 7 June 2026.
  46. ↑ "Three Bulgarians found guilty of spying for Russia from UK base". Al Jazeera. 7 March 2025. Retrieved 7 June 2026.
  47. ↑ "Royaume-Uni: six Bulgares coupables d'espionnage au profit de Moscou dans l'attente de leur peine". L'Express (in français). 7 May 2025. Retrieved 7 June 2026.
  48. ↑ 48.0 48.1 "Bulgarian Spy Ring Sentenced: Questions Linger Over Possible Unprosecuted Crimes and Future Threats". Times of Central Asia. 14 May 2025. Retrieved 7 June 2026.
  49. ↑ "An espionage scandal rocks Austria, laying bare alleged Russian spying operations across Europe". Associated Press. 8 April 2024. Retrieved 7 June 2026.
  50. ↑ "Българските шпиони във Великобритания - в мрежа за пране на милиарди долари". FrogNews (in български). 21 November 2025. Retrieved 7 June 2026.
  51. ↑ "Agenten von Jan Marsaleks Spionagering für Moskau verurteilt". Frankfurter Allgemeine Zeitung (in Deutsch). 7 March 2025. Retrieved 7 June 2026.
  52. ↑ "Spionage: Britisches Gericht verurteilt Spionagering um Jan Marsalek". Die Zeit (in Deutsch). 7 March 2025. Retrieved 7 June 2026.
  53. ↑ Maria Sierra (12 May 2025). "Londres encarcela al cabecilla de una red de espionaje y a sus cinco complices". El Mundo (in español). Retrieved 7 June 2026.
  54. ↑ "Ръководителят на шпионската група от българи получи тежка присъда във Великобритания". Darik News (in български). 12 May 2025. Retrieved 7 June 2026.
  55. ↑ "Seis bulgaros, culpables de espiar para Rusia en el Reino Unido". Infobae (in español). EFE. 7 March 2025. Retrieved 7 June 2026.


This article "Bulgarian spy ring" is from Wikipedia. The list of its authors can be seen in its historical and/or the page Edithistory:Bulgarian spy ring. Articles copied from Draft Namespace on Wikipedia could be seen on the Draft Namespace of Wikipedia and not main one.


Retrieved from "https://en.everybodywiki.com/index.php?title=Bulgarian_spy_ring&oldid=6206493"
License CC BY-SA 3.0
Powered by MediaWiki