Bulgarians Katrin Ivanova (33), Vanya Gaberova (30) and Tihomir Ivanov Ivanchev (39) were found guilty at the Old Bailey in London of spying on an “industrial scale”, putting lives and national security at risk.
They engaged in a series of surveillance and intelligence operations over three years in which they were referred to as the yellow characters from Despicable Me.
But instead of cartoon evil mastermind named Gru, the defendants acted as spies working for the Russian intelligence service, also known as GRU.
Using spy ties, cameras hidden inside Coke bottles and over 200 mobile phones, they emerged as the “largest spying investigation” for counter-terrorism in the UK.
Over the course of three years, five Bulgarian individuals, assisted by a host of others, carried out sophisticated surveillance on British soil and fed secrets back to their Russian handler, former Wirecard chief operating officer Jan Marsalek.
Describing the scale of the investigation as “unbelievable”, the Met Police said the group had accumulated 33 audio devices, 55 visual recording devices, 221 mobile phones, 495 SIM cards, 11 drones, 75 passports and 91 bank cards in various names.
They were able to gain access to confidential flight data to sit near a journalist, using a camera to obtain his phone pin
But perhaps even more fascinating was the incredible array of spyware this group had access to.
A false rock containing a camera, transmitters, surveillance devices hidden within a pen, adapted watches and two spy ties were among the spy gear found during a raid at the Great Yarmouth home of Orlin Roussev, one of the group’s two ringleaders.
Little is known about the defendants’ backgrounds, apart from the fact that Roussev was “highly technically skilled” and had mastered forging fake ID documents and hacking devices.
He had even bragged in his messages to Marsalek that he was becoming like the James Bond character Q, and described his room of spygear as his “Indiana Jones warehouse”.
Among the gadgets, officers found a minion toy with a camera hidden inside a fabric flower, as well as a picture and video of one of the women wearing spy glasses.
Remarkably, the second woman involved in the spy ring had been able to follow target Roman Dobrokhotov onboard a flight, filming him with a secret camera inside her shoulder strap and sending live updates to a group chat.
These updates included that he had two phones, used social media, listened to music, played Sodoku, and his pin for his mobile phone.
Noting this showed the “severity of the threat”, Commander Dominic Murphy, head of the Met Police’s Counter Terrorism Command unit, said: “They talked about how they were able to gain access to confidential flight data to sit near a journalist, using a camera to obtain his phone pin.
It was spying on an almost industrial scale on behalf of the Russian state and Russian intelligence
“The lengths they were willing to go to in this case were extreme. We never disregard the threat of Russia, many of our other jobs in this area relate to the threat posed by Russia.”
The remarkable extent of the spyware can be revealed after Ivanova, Gaberova, Ivanchev were all found guilty, while the group’s two ringleaders, Roussev and Biser Dzhambazov, had already admitted their role.
Commander Murphy described it as “probably the largest spying investigation I’m aware of and have been involved in over 20 years of counterterrorism”.
“It was spying on an almost industrial scale on behalf of the Russian state and Russian intelligence, it goes to the heart of freedom and national security,” he said.
“This group really were a serious threat and when they might have approached it quite lighthearted, they were carrying out sophisticated surveillance operations.”
Between 2020 and 2023, the group orchestrated six plots targeting Russian dissidents, investigative journalists and a Kazakhstani politician, as well as undertaking surveillance on a US airbase in Germany that trained Ukrainian soldiers.
Their handler, Marsalek, has been on the run since June 2020 and is wanted by Interpol and the German police after $2bn (€1.8bn) went missing from the financial services provider Wirecard.
After fleeing Germany, he is believed to be hiding in Moscow and has been involved with Russian intelligence since at least 2014.
The fourth operation involved staging a fake demonstration outside the Kazakh embassy in September 2022
Prosecutor Alison Morgan KC said there were six spying operations that involved “high-level espionage with high levels of deceit”.
The first operation, between September and November 2021, targeted Bellingcat investigative journalist Christo Grozev whose work on Russian affairs included uncovering Russian links to the 2018 Salisbury attack and the downing of a Malaysia Airlines plane in July 2014.
In November 2022 the second focused on UK-based Russian dissident Mr Dobrokhotov. Jurors heard he is an investigative journalist and founder of The Insider, a media organisation that was formerly based in Russia before he fled the country.
The third operation was on Kazakhstan former politician Bergey Ryskaliyev who fled to the UK and was granted refugee status.
Targeting the political dissident in November 2021 would have helped cultivate relations between Russia and Kazakhstan, it was claimed.
The fourth operation involved staging a fake demonstration outside the Kazakh embassy in September 2022 to create a pretence the spies had genuine intelligence about those responsible to pass on to Kazakhstan intelligence services to further curry favour, jurors heard.
Operation number five concerned Patch Barracks, a US military airbase in Stuttgart, Germany, in 2022, where Ukrainian soldiers were believed to be trained.
The sixth operation targeted Russian lawyer Kirill Kachur when he was spending time in Montenegro between September 2021 and January 2022.