An Officer And A Diplomat: The Strange Case Of The GRU Spy With A Red Notice

• In its original series of investigations in 2018, Bellingcat identified three GRU officers: Maj. Gen. Denis Sergeev, Col. Anatoliy Chepiga and  Col. Alexander Mishkin, M.D., linked to the March 2018 Novichok poisonings in Salisbury.
• In several follow-up reports, Bellingcat and its investigative partner The Insider disclosed the existence of a clandestine GRU team earmarked and trained for overseas disruptive operations and extraterritorial assassinations. This elite team is disguised as part of a larger GRU training unit referred to Military Unit 29155.
• In a report from 7 July 2019, we tracked the frequent travels of officers from this GRU team to Switzerland in the period 2016-2018, with an especially high concentration of concurrent trips to the area near Lake Geneva at the end of 2017 and early 2018.
• In two further investigations from 2019, we disclosed the link between this GRU unit and two poisoning attempts targeting Emilian Gebrev, a Bulgarian weapons manufacturer, his son, and his business associate in April and May 2018. We identified eight different GRU officers who had visited Bulgaria undercover in the months immediately preceding the poisoning, with three of these being in Bulgaria during each of the attempts.
• On 23 January 2020, Bulgarian prosecutors announced indictments and issued Interpol wanted alerts against three of the GRU officers previously identified by Bellingcat. Authorities also released surveillance footage showing one of them wearing a disguise and approaching several cars in an underground garage where the poison victims’ cars had been parked.

In this investigation conducted jointly with our partners Tamedia (Switzerland) and The Insider (Russia), we identify a key member of the recently indicted trio who, following the two failed assassination attempts in Bulgaria in 2015, was accredited to a diplomatic post under his real name in Switzerland. From his new base in Geneva, he continued to work for GRU under diplomatic cover, likely assisted various secret service operations in Switzerland, and may have taken part in the preparation of the Skripal poisoning.

As he was accredited by Russia through the end of 2020, this marks the first known case when a Russian diplomat is simultaneously wanted for attempted murder under an Interpol Red Notice. This GRU officer departed Geneva urgently midway through his four-year mandate following Bellingcat’s disclosures and identifications of members of this GRU unit published in late 2018.

He traveled and worked undercover in the period 2008-2015 under the assumed name of Georgy Aleksandrovich Gorshkov, born 1977. In fact, his real name, under which he was accredited to the World Trade Organization in Geneva, is Egor Aleksandrovich Gordienko, born 1979.

What We Know About Gordienko

Egor Gordienko was born in 1979 in Bolgrad, a small town near Odessa, where his father, a military unit commander, had been stationed as part of the 98th Airborne Assault Division. His family hails from Tyumen, a city in Western Siberia. At some point in the early 80’s, his father was relocated to Moscow and his family moved with him.

Undated older passport photo of Egor Gordienko. Right: Gordienko’s old apartment building and playground in the military town he grew up (photo credit: father’s VK page)

We have not been able to find out where Egor Gordienko’s received his early education, but based on the credentials of other members of the clandestine GRU unit, it is not unlikely that after receiving his schooling he graduated from the GRU Academy in Moscow. His first international trip was in January 2007, was conducted under his real name, Gordienko, and involved a 12-day stay in Cairo. While domestic travel records indicate that at this time he was already working for the GRU, his undercover identity had not yet been created. Based on the oldest undercover identity document we have discovered so far, the clandestine undercover team within Unit 29155 was created in its current form in 2009.

Gordienko’s first trip under his cover identity , as “Georgy Gorshkov”, a made-up persona two years older than his real age, was in September 2010 when he traveled to Barcelona, Spain. During the remainder of 2010, he managed to take trips in quick succession to Finland, Ukraine, and Turkey. In 2011 and 2012, he only traveled to Ukraine and Turkey.

In 2013, “Gorshkov” also visited Ukraine and Turkey, but also made two trips to Tajikistan, both times with other members of the clandestine team, which included “Sergey Fedotov”, i.e. the cover name for Denis Sergeev.

In February 2014, Gordienko traveled to Prague, and during July, October and November he made three long trips to Switzerland, France, and Italy, staying in the region for 45 days in the last quarter of that year.

During early 2014, Gordienko also made trips to Krasnodar and Crimea. Based on the pattern of his trips to Ukraine on the eve of the annexation of Crimea, and the known involvement of the clandestine GRU team in the annexation, we assume he also took part in that operation. Notably, in July 2014, Gordienko’s family was granted an upscale apartment in the same Moscow building where Alexander Mishkin and Vladimir Moiseev also received apartments at the same time. Based on the timing and lack of evidence of payment for these apartments, we assume that they were gifted to (certain) members of the clandestine team as an incentive in addition to a governmental award. As Mishkin and Chepiga received their apartments as part of the bestowal of the “Hero of Russia” award over their role in the Crimea annexation, it is logical to assume the same holds true for Egor Gordienko.

Bulgarian Operation

On 11 February 2015, “Gorshkov” flew from Moscow to Sofia. Nine days later, he returned to Moscow, taking a flight from neighboring Greece. Bulgarian investigators assume that this was a reconnaissance trip in preparation for the assassination attempt on Emilian Gebrev. As we wrote previously, a number of other members of the same GRU team made “staggered” trips to Bulgaria in the first months of 2015, also likely as part of the operation’s preparatory phase.

On 24 April 2015, “Gorshkov” flew back from Moscow to Bulgaria, this time landing in the seaside resort of Burgas. Two other members of the team- “Sergey Fedotov” (Denis Sergeev) and “Sergey Pavlov” (Sergey Lyutenko) – flew in on or around the same day. The three rented a car and moved on to the capital Sofia, where, according to Bulgarian prosecutors, they stayed at the Hill Hotel, and expressly requested rooms with a view to the entrance of an underground garage to the side of the hotel. This was the garage used by Emilian Gebrev’s company, Emco.

At 13:57 on 28 April, one of the three — who is thought to be the senior-most team member, Denis Sergeev — can be seen in a wide-brim hat, shades, and gloves moving among cars in Emco’s underground garage and presumably spraying the targets’ car door-handles with a yet unidentified organophosphate poison.

Later that same evening, during a corporate dinner, Emilian Gebrev felt the early effects of severe poisoning, with the symptoms quickly worsening until he fell into a coma that evening. A blood and urine sample analysis conducted two months later by the OPCW-accredited Finnish laboratory VERIFIN showed that his vital functions had deteriorated severely, leading to, among other things, kidney failure. Gebrev was hospitalized at the Military Medical Academy in Sofia that same night, with his production director and son hospitalized with similar, albeit less severe, symptoms in the following few days.

As Gebrev was succumbing to the first symptoms of poisoning over dinner, “Gorshkov”, “Fedotov” and “Pavlov” took an evening flight from Sofia to Istanbul, and then took a connecting flight onward to Moscow that same night.

Gebrev did not die, nor did the two people who were also poisoned. Four weeks later, on 23 May 2015 “Fedotov” returned to Bulgaria, flying again to the seaside resort of Burgas. According to sources familiar with the investigation, he rented a car and disabled its GPS tracking system, making his movements in the next seven days unknowable. On 28 May 2015, “Georgy Gorshkov” also returned to Bulgaria, landing in Sofia.

On the night of 28 May Emilian Gebrev — who was then convalescing at his seaside home a few dozen kilometers south of Burgas — felt the onset of the symptoms he knew all too well. That same night, his son drove him back to the Military Medical Hospital in Sofia.

The next day “Gorshkov” and “Sergey Fedotov” drove from Sofia to neighboring Serbia, returning the rented car in Belgrade from where they both flew back to Moscow on 30 May.

“Georgy Gorshkov” never took another trip again.

A Diplomat Is Born

Shortly after the failed Bulgarian operation, the persona of “Gorshkov” appears to have been decommissioned. However, the real person behind it, Egor Gordienko continued his work for the GRU.

During 2016, he took several flights from Moscow to the Siberian city of Novossibirsk, Krasnodar and Crimea, but his first international trip was not until 2017.

On 27 January, he flew on a diplomatic passport from Moscow to Geneva. Judging from a 2018 list, seen by Bellingcat, of all foreign diplomats accredited to Switzerland, Egor Gordienko was accredited as third secretary to the Russian mission at the Word Trade Organization in Geneva. However, Gordienko’s name is not listed in any archived copy of the diplomatic lists published by the Russian Foreign Ministry. Several foreign diplomats based in Geneva told us they have no recollection of meeting Gordienko. However, an unidentified diplomat consulted by the Nightingale blog that first publicized Gordienko’s real name said that they recognized him based on the photograph of “Gorshkov” that was published by Bellingcat.

The Loneliness of the Long-Distance Runner

The only open-source trace of Egor Gordienko’s existence as a member of the Russian mission in Geneva comes in the form of online stats from two marathon runs in Geneva — one from the popular Antigel 5-km run from January 2018, where he apparently finished 90th, with a time of 33 minutes, and a second one from December 2018, where he and his family were signed up but none of them showed up. In both races he is listed as a member of the Russian Mission.

Egor Gordienko signed up for two public run events, one on in January 2018 and a second one in December 2018. He did not take part in the latter one.

Keith Rockwell, WTO’s  Director of External Relations, confirmed to our investigative partner Tamedia that a person named Egor Gordienko was indeed accredited to WTO by the Russian Federation in 2017 on a term that was due to run until 2020 but was terminated prematurely in 2018. Mr. Rockwell said he did not know Mr. Gordienko nor his actual function, and stated that any of the WTO member governments can register any individual as part of their diplomatic mission, subject to authorization by the host country. A spokesperson for the Swiss foreign ministry also confirmed that Gordienko was accredited in January 2017, and that his accreditation was rescinded on 31 October 2018.

We attempted to get a clarification on Egor Gordienko’s function at the WTO from the Russian Mission. Tamedia’s query elicited a response from the Russian Mission’s press officer, Daria Rudakova, who wrote that, “We have no information of the above-mentioned person”. A follow-up email pointing to the oddity of a random stranger unknown to Russian officials being accredited to the WTO, and running marathons on behalf of the Russian Mission, remained unanswered. Our partner, The Insider, called Rudakova to follow up on this strange case of diplomatic amnesia. The press officer asked for several hours to investigate the matter, and then proceeded to stop answering her phone.

Potential Tasks in Geneva

It is not yet known what Egor Gordienko’s main mission in Geneva may have been. Our review of phone metadata of his Russian phone (which he used primarily while in Russia) shows that in 2017 and 2018 he was in close working contact with Sergeev, Chepiga, Mishkin, and other members of Unit 29155. Thus, we can assume Gordienko’s interests in Switzerland were similar to those of the other GRU team members, or that he provided a supporting role under diplomatic cover.

Based on our tracking of Denis Sergeev’s mobile phone movements in Geneva, Sergeev appears to have visited the WTO compound on occasion, but this was clearly not his, and not the GRU’s, main interest. Given frequent e-sightings of him at the Lausanne branch of the World Doping Association, the Lausanne Polytechnic Institute, as well as the frequent trips to locations near the ski slopes, it is more likely that those locations, among others, would have been of interest to Gordienko as well. Without metadata for Gordienko’s Swiss mobile number, we are not able to analyze his movements in the same way we did this for Denis Sergeev.

However, it is notable that from December 2017 to February 2018, a constellation of several GRU officers from Unit 29155 traveled to Geneva, including Col. Anatoly Chepiga and Col. Alexander Mishkin, as well as the ubiquitous General Sergeev, whose last trip to Geneva was in late January. On many occasions, these officers several times postponed the return dates for their trips back to Moscow, indicating they were waiting for something to happen, or someone to arrive.

These trips occurred only two months before a crucial operation — the poisoning of the former GRU double agent in Salisbury — suggesting a possible link between the two operations.

Even more indicative of a link may be the trip of at least one officer from Unit 29155 to Geneva late in February 2018, just days before the Salisbury operation. GRU officer Nikolay Ezhov, travelling under his cover identity of Nikolay Kononikhin, arrived in Geneva on 21 February 2018. He had no return ticket, implying that he did not know how long his assignment might last. Ticketing records show that on 1 March 2018, he appeared at the airport at 22:30 and bought a last-minute ticket for a plane to Moscow departing only an hour later. It was that same evening that Sergeev, Mishkin and Chepiga bought their last-minute tickets to fly into London the next day.

Nikolay Ezhov was one of the GRU officers involved with the preparation for the Bulgarian poisoning in 2015, and he stayed in Sofia for approximately two weeks in February and March, presumably tracking and collecting reconnaissance on the target. While his presence in Geneva might well have been part of a different mission, the very small clandestine team of Unit 29155 is unlikely to have had the capacity to work on two important overseas operations at the same time.

Notably, upon his return to Moscow for the summer recess on 4 July 2018, three months after the Skripal operation, Gordienko immediately called Sergeev, Mishkin, Chepiga and Ezhov, in this exact sequence.

Meanwhile, the Swiss Foreign Ministry told Tamedia they were not aware of Egor Gordienko’s activities outside his accredited diplomatic function.

Postus Interruptus

At 8:21 p.m. on 25 October 2018, Egor Gordienko bought a last-minute ticket to Moscow for a flight departing at 10:40 that night. He bought a two-way ticket with a return flight for 31 October. However, he never returned to Geneva, and never traveled outside Russia again.

Flight records show he arrived at Moscow’s Sheremetyevo airport at 2:45 a.m. His phone metadata shows that at 7:05 a.m. he was already at the GRU headquarters at Khoroshevskoe Chausse 76B. At that time, he called his boss, General Andrey Averyanov, the commander of Unit 29155. He stayed at the HQ address for the whole day, and after 5 p.m. he began calling all his colleagues in sequence, presumably to inform them that he was back for good.

On 31 October, Egor Gordienko did drive to the airport after all. However, he did not to take his return flight to Geneva, but to pick up his family, who were also returning home. The family’s names on the 1 December run status website would remain without run-times.

It is not exactly certain why Gordienko left suddenly on 25 October 2018. However, it is almost certain that the premature departure was triggered by the waterfall of disclosures on the identity and modus operandi of the clandestine team he was a member of. Only a couple weeks earlier, Bellingcat had identified his colleagues, “Boshirov” and “Petrov”, as Col. Chepiga and Dr. Mishkin, and days earlier his direct superior “Fedotov” had also been outed as Denis Sergeev. And earlier that same day, we had published a lighter story: a case study on how we were able to exactly chrono-locate a 2014 photograph Col. Chepiga had posted from Prague. Little did we know then that Egor Gordienko, a.k.a. “Georgy Gorshkov”, had been in Prague on that same day.

The Search for Gordienko                  

Our search for the real identity of “Gorshkov” was one of the longest and most difficult GRU identification projects. We became aware of a GRU officer traveling under the alias of “Georgy Gorshkov” in October 2018. This became possible following the discovery of another senior GRU officer, “Sergey Fedotov”, who had traveled to the United Kingdom during the time when Sergey and Yulia Skripal were poisoned with Novichok.

Using a leaked offline database of flights of Russian citizens in the 2014-2016 period (available as a torrent download from a number of Russian websites), we searched for co-travelers of “Fedotov” having similar passport number series. One of the persons we identified was “Georgy Gorshkov” born 2 February 1977, who had flown with ‘Fedotov” to and from Bulgaria during the time Emilian Gebrev and his son had been poisoned in April 2015.

“Gorshkov”’s passport differed in only the last two digits form “Fedotov”’s and after their Bulgarian operation, both had returned to Moscow on the same flight from neighboring Serbia.

We then tried to obtain a copy of “Gorshkov”’s passport file from a whistleblower with access. We were informed that no such passport file existed, which is consistent with our understanding that Russian security services had begun purging passport files of cover identities following our disclosure of the identities of Col. Mishkin and Col. Chepiga.

We were able to obtain a copy of “Gorshkov”’s Russian border crossing records from a different whistleblower. These also contained a poor-quality scan of his latest passport photo. We discovered that the border-crossing records had been meddled with, likely in order to frustrate a possible external investigation.

Due to the fact that we had a copy of “Gorshkov”’s travel records from the 2014-2016 flight database, we were able to compare the two sets and identified a pattern of data manipulation: all travel records during the Bulgarian operation time-frame had been fast-forwarded three years into the future, showing 2014 trips as having occurred in 2017, and so on. We knew that the correct dataset was the one from the offline flight database, as it had been leaked in 2016, before our identification of the first member of the clandestine GRU team.

After reverse-engineering the border crossing records to match the non-manipulated offline-data set, we found that “Gorshkov”’s last trip under this cover identity was the return trip from the second Bulgarian trip in 2015. Unlike all other members of Unit 29155 identified by us, he never traveled in 2016, 2017 or 2018. This outlying status made us believe he may have been “de-commissioned” from active service or, indeed, might have died.

Our standard approach to identifying the real identity of GRU officers brought no results. There were no people with the same first name and birth date as “Gorshkov” registered to any Moscow addresses known to be linked to GRU or Spetsnaz bases. We searched for any similar combinations of names and birth dates but to no avail. The identification project for “Gorshkov” had come to a dead end.

Nearly a year later, after our positive identification of Gen. Andrey Averyanov as the commander of unit 21995, we identified his telephone number via a Moscow car registration database leaked in 2018. We then obtained Averyanov’s call records from a whistleblower working at a mobile operator.

While analyzing his records we identified a number that, according to the caller-id app GetContact, belonged to a person named Egor Gordienko. We looked up this person’s name in an offline Russian residential database, and found four Moscow residents with this name combination. None of them were registered at the known GRU addresses, but one of them had a birth date of 2 February 1979. The similarity between the birth dates of 2 February 1977 (Gorshkov) and 2 February 1979 (Gordienko) and the overlap between the first letters in the name led us to the working hypothesis that Gordienko is in fact be the officer behind the “Gorshkov” alias.

At this point, we obtained the border-crossing data for Egor Gordienko, which contained a recent photograph. A facial comparison between this photo and “Gorshkov”’s photo gave us a sufficiently high match factor to conclude this was the same person.

Facial match between passport photos of “Georgy Gorshkov” and Egor Gordienko using Microsoft Azure AI Face Verification