How an alleged Russian spy ring stole NATO and EU secrets from Bulgaria

Secretly shot video tells the story of an alleged spy ring at work in Bulgaria’s capital.

A woman in a white jacket arrives at the Russian embassy in Sofia; she is seen in animated conversation with someone unidentified. Inside a government office, a surveillance camera catches a man counting money at his desk, apparently the reward for his espionage. And in an intercepted phone call, the alleged leader of the group is heard telling an accomplice how his father cried when Stalin died. Then they talk money.

The recordings, made by Bulgarian investigators, were released on Friday as prosecutors announced charges against six Bulgarians – several of them senior or former defense officials – on suspicion of spying for Russia.

Prosecutors alleged that the group “posed a serious threat to national security by collecting and handing to a foreign country state secrets of Bulgaria, NATO and the European Union.”

They also released a memo allegedly written by the group’s leader, in a mixture of Bulgarian and Russian, setting out the spy ring’s priorities, which included gathering information on NATO meetings, EU policy towards Russia and intelligence on Ukraine and Belarus.

According to prosecutors, of particular interest to the spies was the recently inaugurated NATO Maritime Coordination Center in Varna, on Bulgaria’s Black Sea coast.

A woman leaves the Russian embassy in the Bulgarian capital, Sofia, with what prosecutors claim is a bag full of cash.

The group’s apparent unmasking came days before US Secretary of State Antony Blinken’s first visit to NATO – with Russia very much on the agenda - and amid signs that the Biden administration is intent on taking a tougher stance towards Moscow than that pursued by former President Donald Trump.

“The days of the United States rolling over in the face of Russia’s aggressive actions … are over,” Biden said last month.

A State Department spokesman tweeted last week that the US was “attentively watching” the Bulgarian investigation and that it “stands with Bulgarians against these malign activities.”

Russian opposition leader Alexei Navalny delivers a speech during a demonstration in Moscow on September 29, 2019. - Thousands gathered in Moscow for a demonstration demanding the release of the opposition protesters prosecuted in recent months. Police estimated a turnout of 20,000 people at the Sakharov Avenue in central Moscow about half an hour after the start of the protest, which was authorised. The demonstrators chanted "let them go" and brandished placards demanding a halt to "repressions" of opposition protesters. (Photo by Yuri KADOBNOV / AFP) (Photo by YURI KADOBNOV/AFP via Getty Images)

Related article Russian opposition leader Alexey Navalny dupes spy into revealing how he was poisoned

Prosecutors said the woman arrested, who has not been named, has dual Bulgarian-Russian nationality and served as the intermediary with the embassy. In return she purportedly received cash for the group’s operations. Prosecutors also said she is the wife of the spy ring’s leader. They referred to him as “The Resident” and said he is a high-ranking former member of Bulgaria’s defense ministry.

Several of those arrested held senior positions at Bulgaria’s Defense Ministry and in the Military Intelligence Service, suggesting the alleged conspiracy may have had access to highly-classified information.

The country’s chief prosecutor, Ivan Geshev, described the espionage as “unparalleled since 1944.”

On Monday, the Bulgarian government followed up by announcing the expulsion of two Russian diplomats, bringing to eight the total number of Russian officials kicked out of Bulgaria since late 2019. Last December, Russia’s military attaché in Sofia was expelled following allegations that he had gathered information on US service members stationed on Bulgarian territory during military exercises.

Over the weekend, Bulgarian Prime Minister Boyko Borissov asked Moscow to stop its spying operations in Bulgaria. But mindful of Bulgaria’s shared Slavic heritage with Russia – and its dependence on Russian energy – Borissov added: “Friendship is friendship, we have always demonstrated that.”

For its part, the Russian embassy in Sofia responded that the “tireless attempts to drive a wedge into the Russian-Bulgarian dialogue and once again demonize our country are obvious.”

An operative is caught on camera appearing to swap cash for different currencies.

Until 1989, Bulgaria was one of the most loyal members of the Soviet-led Warsaw Pact. Now, as a member of NATO and the European Union, western analysts say it’s a favorite target for Russian espionage. If Vienna was the epicenter of post-World War II espionage in Europe, Sofia might lay claim to that dubious title today.

As a NATO member, Bulgaria occupies some critical real estate adjacent to the Black Sea. NATO aircraft fly from bases in Bulgaria in patrols over the area, which has seen more military activity by both Russia and the Alliance since Moscow’s annexation of Crimea in 2014. Last year, six USAF F-16s operated from Bulgaria’s Graf Ignatievo Air Base.

Russians close to the Kremlin have backed pro-Russian groups in Bulgaria. One of those groups – the Russophiles National Movement – is led by Nikolai Malinov, who was charged by Bulgarian prosecutors in 2019 with spying and laundering money for Russian organizations. His case is yet to come to trial, and Malinov has maintained his innocence.

Related article SolarWinds hackers gave themselves top administrative privileges to spy on victims undetected, DHS says

Bulgarian prosecutors allege that he wrote a document outlining “the steps that need to be taken to completely reform Bulgaria’s geopolitical orientation, moving it away from the West and bringing it closer to Russia.”

While awaiting trial, Malinov was allowed to leave Bulgaria for a trip to Moscow, where he was presented with the Russian Order of Friendship by President Vladimir Putin.

Bulgaria’s prosecutor-general claimed Malinov provided intelligence to a group in Russia called the Double Headed Eagle Society, which is run by oligarch Konstantin Malofeev. Malofeev is a champion of the Russian Orthodox Church and runs a TV network in Russia. He has previously suggested that Vladimir Putin should be made the Tsar of Russia.

In 2019, Malofeev was banned from entering Bulgaria for ten years because of his association with Malinov, which he has acknowledged as close. They had tried but failed to purchase a Bulgarian television network.

Malofeev was previously sanctioned by the US and European Union for financing separatist military groups in eastern Ukraine. He has denied that accusation.

Alexey Navalny talked to CNN at a secret location in Germany but says he will return to Russia.

Related article CNN-Bellingcat investigation identifies Russian specialists who trailed Putin's nemesis Alexey Navalny before he was poisoned

Last year Bulgarian prosecutors also charged three Russians in absentia, in connection with the poisoning of a Bulgarian weapons dealer in Sofia in 2015 using a substance believed to be the nerve agent Novichok. One of them was identified as Sergei Fedotov, allegedly an officer in Russian military intelligence. Previous attempts by CNN and other media organizations to reach Fedotov have been unsuccessful.

The investigative group Bellingcat has identified Fedotov as one of three Russian intelligence agents alleged to be linked to the poisoning of former Russian spy Sergei Skripal and his daughter in England in 2018.

Russia routinely denies allegations of spying in Bulgaria. Last year, Sergei Ivanov – spokesman for Russia’s foreign intelligence service – accused US intelligence services of launching a campaign against people in eastern Europe who wanted good relations with Russia. Bulgaria, he told Russian media, had become the epicenter of this campaign.

The latest arrests have sparked another crisis in relations between Moscow and Sofia, which have traditionally been close because of a shared Slavic and Orthodox culture.

But if Bulgarian prosecutors are right, the Kremlin regards Bulgaria as an inviting target – a back door into intelligence about NATO and the European Union, and weapons reaching Ukraine.