Third Suspect in Skripal Poisoning Identified as Denis Sergeev, High-Ranking GRU Officer

Bellingcat previously confirmed that a third GRU officer was present in the UK during the time Sergey and Yulia Skripal fell into a coma, after what the UK authorities said was a deliberate poisoning with Novichok. In addition, Bellingcat established that this same officer traveled multiple times to Bulgaria during 2015, including a trip days before a Bulgarian arms trader and his son were severely poisoned with a yet-unidentified poison.

Following a four-month joint investigation with our investigative partners The Insider (Russia) and Respekt (Czechia), Bellingcat can now reveal the true identity and background of this GRU officer, who operated internationally under the cover persona of Sergey Vyacheslavovich Fedotov. In fact, this person is Denis Vyacheslavovich Sergeev, a high-ranking GRU officer and a graduate of Russia’s Military Diplomatic Academy.

Additional research in this investigation was also made by newspaper Helsingin Sanomat (Finland).

Notably, we have established that in the last two months, Russian authorities have taken the unusual measure of erasing any public records of the existence of Denis Sergeev, as well as of Anatoly Chepiga and Alexander Mishkin, the main two suspects in the Skripal poisoning. These unprecedented actions cannot plausibly be taken without direct involvement of the Russian state, and add further credibility to the UK government’s assertion that the Skripal poisoning operation, and the subsequent cover-up, were coordinated at a state level. Additional details on these concerted efforts to purge public records of Chepiga, Mishkin, and Sergeev’s identities will be detailed in the next part of our investigation, scheduled to come out next week.

Who is Denis Sergeev?

Denis Vyacheslavovich Sergeev was born in Usharal, a small militarized town in what was at the time Soviet Kazakhstan, near the Soviet-China border. Both Denis Sergeev and his cover identity “Sergey Fedotov” were born on 17 September 1973. He served in the army in the southern Russian city of Novorossiisk in the Krasnodar Region.

At some point between 2000 and 2002, he was transferred to Moscow and enrolled at the elite Military Diplomatic Academy, popularly known in Russia as the “GRU Conservatory”. The Military Diplomatic Academy churns out 100 elite intelligence officers each year, ranging from spies in diplomatic and military attache covers to illegals.

We have not established what Denis Sergeev’s service prior to the Academy involved; however, it is known that recruitment into the Academy takes place among military officers with the minimum rank of captain who have excelled at their military service, traditionally in Spetsnaz or navy units. Like all other graduates, Sergeev would have finished the Academy with a minimum rank of lieutenant-colonel. While we have no confirmation of his current military rank, the time served and the nature of his assignments since graduation indicate he currently holds a minimum rank of full colonel, and possibly major-general.

Denis Sergeev is married and has an adult daughter.

2004 to 2012 Period

During this period, which possibly overlapped with his last years at the Military Diplomatic Academy, Denis Sergeev, under his real identity, served as shareholder and/or managing director of eight Russian companies. These companies, all of which were liquidated between 2007 and 2012, were sham corporations with names mimicking names of other large companies registered in Russia. In most of the companies, Sergeev was the sole shareholder, while in two he was co-shareholder with other people, some of whom we also identified as GRU officers.

We established that during 2009, Denis Sergeev obtained a personal loan from a Russian bank in the amount of just over one million USD. The allocation of such a large loan to a person who – as seen from his credit record (obtained from a leaked Russian credit history collection) – had no real estate and no personal vehicle – is extraordinary.  The loan appears to have been extended on the strength of Denis Sergeev’s personal income in his declared role as “specialist” working for a company called Loreven Style Ltd specializing in consulting services.

In a 2010 census, Sergeev listed Loreven Style Ltd as his employer, and indicated a Riga-based company address. There are no records of a company with such name ever existing, either in Riga or anywhere. Two phone numbers listed as contacts are not in service.

It is not certain what the function of the many sham companies incorporated by Sergeev was, and whether it was linked to the loan amount of $1 million apparently obtained from a Russian bank. A review of some of the other shareholders in these companies  – some of which also with GRU links – shows that they too incorporated dozens of companies with similar profiles, all of which have since been liquidated. It is plausible that these companies may have been used for money laundering purposes, or as cover corporations providing “respectable employment” to other GRU undercover officers, for instance in the context of visa applications. Bellingcat will continue to investigate these companies’ purpose and potential use by the GRU within or outside Russia.

The Birth of Sergey Fedotov

In 2010, Denis Sergeev received his alter ego, “Sergey Vyacheslavovich Fedotov”. A new, valid passport was issued under this name, by the same “770001” passport desk in Moscow that issued cover passports to Mishkin, Chepiga other GRU operatives, and “VIP” citizens, as previously detailed by Bellingcat.

“Fedotov” was given a birth date matching the one of the actual person Denis Sergeev. His place of birth was moved from Kazakhstan to the village of Apushka in the Ryazan region of Russia. As in the case of the other undercover passports issued to Mishkin and Chepiga, the “reason” for issuance of the new passport was stated as “unsuitability for use” of the previous passport. As in the other cases, the previous passport listed never actually existed.

“Sergey Fedotov” was also assigned a residential address and an employer. The new Moscow address in fact belonged to an unrelated family bearing the same family name (we were unable to contact the family to find out if they were aware of their cohabitation with the GRU officer, due to the fact that all four of their phone numbers were disconnected).

The employer, listed as a company called “Business-Courier”, could not be established definitively. There are more than 25 Russian companies that carry or had this name, including ones that were liquidated in the same period as the batch in which Denis Sergeev was a shareholder.

In a 2017 census, “Sergey Fedotov” listed his income as the equivalent of USD $1000 per month. He did not list an employer in this census.

An International Man of Mystery

Using four different airline booking, PNR, and border-crossing databases, Bellingcat has collated and analyzed travel records for the persona “Sergey Fedotov” for the period of 2012-2018. He used two different (consecutive) passports during this period–both of which were issued by the same 770001 passport desk and had numbers from batches that we have identified to include other GRU undercover officers.

Fedotov’s itinerary shows extensive travel to destinations across Western and Eastern Europe, Central Asia, and the Middle East.  In the period of 2012-2013, his destinations included Ukraine and Tajikistan.

In 2014, Fedotov traveled to Czechia, Italy, and Switzerland. Notably, during his first trip to Prague at the end of January 2014, he traveled alongside “Alexander Petrov”, the cover persona of Dr. Alexander Mishkin, one of the key suspects in the Skripal poisonings. The two stayed in Prague eight days, until 2 February 2014, when they flew back to Moscow. Bellingcat’s investigative partner Respekt has established that during this trip, “Fedotov” and “Petrov” stayed at the four-star Best Western Meteor Plaza Hotel, where they shared a room.

“Fedotov” made two subsequent trips to Western Europe during the rest of 2014, visiting Milan, Geneva, and Paris. His last trip that year was from 12 November to 1 December 2014, when he traveled to and from Paris.

Bulgarian Events

In February 2015, Fedotov made his first trip to Bulgaria. On 15 February 2015 he flew from Moscow to Belgrade in neighboring Serbia. On the next day he traveled on to Bulgaria, and stayed there until February 22, when he flew back from Sofia to Moscow.

His second trip, which was previously reported by Bellingcat, was in April 2015. He landed in the seaside resort of Burgas on a direct flight from Moscow on 24 April 2015. While he had bought a return flight from Sofia to Moscow on 30 April 2015, he did not use that ticket. Instead, on the evening of April 28 at 20:20, he flew from Sofia to Istanbul, where he bought an onward ticket to Moscow that same night.

It was earlier that same day, April 28, that the Bulgarian arms manufacturer and trader Emilian Gebrev collapsed during a dinner event with his trading partners from Poland at an upscale Sofia restaurant. Mr. Gebrev’s health deteriorated fast and he slipped into a coma. He was treated for poisoning from an unidentified substance at the Military Medical Hospital in Sofia. A source from the medial institution who wished to remain anonymous confirmed to Bellingcat and its investigative partners that Mr. Gebrev’s state was “touch and go” for over two weeks, with his chances of survival at times deemed to be very low. Gebrev’s son and the commercial director of one of his manufacturing companies also fell ill with signs of poisoning in the days following his own collapse, albeit with lesser symptoms.

Following his release from hospital, and given that the poison had not been identified, Emilian Gebrev requested a forensic medical analysis from two European labs accredited by the OPCW. One of them – the Helsinki-based Verifin – conducted a detailed analysis on urine samples from Mr. Gebrev and his son. As previously reported, this analysis found traces of organo-phospate poisoning, with two distinct types of agent discovered in the sample of Patient 1, who is presumed to be Mr. Gebrev. One of the types was broadly identified by Verifin as a pesticide, while the other was not identified.

In a statement to the press on 11 February 2019 in the wake of Bellingcat’s first publication pinpointing “Fedotov”‘s presence in Buglaria during the time of Gebrev’s poisoning, Bulgaria’s General Prosecutor confirmed Fedotov’s concurrent presence in the country. He also confirmed that Bulgarian authorities have re-opened investigation into Gebrev’s 2015 poisoning, which had been closed in 2016 when no suspect had been identified. Mr. Tzatzarov said that the investigation had been reopened after Mr. Gebrev had written to the prosecutors in October 2018, having seen coverage of the Novichok poisonings in the UK and suspecting he may have been targeted in similar circumstances. Mr. Tzatzarov also confirmed that Bulgarian and UK law enforcement had been cooperating on the case since October 2018. He, however, appeared to discount the hypothesis that the 2015 poisonings in Bulgaria may have been linked to poisoning agents of the Novichok family, which he substantiated with the fact that “no chemicals in the CWC (Convention of Chemical Weapons) lists of banned substances were found in extensive testing”.

Bellingcat and its reporting partners approached several experts on chemical weapons for further comments on the possible poison used in Bulgaria, based on the symptoms described and the full report from Verifin.

All consulted experts, including Vil Mirzyanov, who worked on the development of Novichok as part of the Soviet Unioin’s secret chemical weapons program, concurred that the Verifin report cannot conclusively prove or disprove whether Novichok, or a similar substance, was used in the poisoning of Mr. Gebrev. Speaking to Bellingcat, Mr. Mirzyanov said that standard OPCW-standard compliant tests like the analysis conducted by Verifin are not suited to identify the use of Novichok, which is not а part of the banned list of substances under the CWC. Mr. Mirzyanov confirmed that a repeat test by the same laboratory, targeted specifically at the possible metabolysed traces and artifacts left by Novichok poisoning, is likely to prove or disprove the Novichok theory.

Verifin has confirmed to our reporting partner Helsingin Sanomat that it holds patient samples for a minimum of five years, which would mean that Mr. Gebrev’s samples are available for re-testing at least until June 2020. Verifin has confirmed to the reporting team that if requested by the patient, a custom-tailored analysis could be performed.

“Fedotov” returned to Sofia on a direct flight from Moscow once more, on 23 May 2015. He left the country on 29 May 2015 by car, crossing into Serbia in the company of two Russian citizens. According to sources in Bulgarian law enforcement interviewed by our reporting partner in Bulgaria, Capital.bg, one of the two companions had been present in London during the poisoning of the Skripals in March 2018. Fedotov flew from Belgrade to Moscow on the next day, 30 May 2015. This return visit to Bulgaria broadly coincided with Mr. Gebrev’s release from hospital, and subsequent reentry with renewed poisoning symptoms.

2016 and 2017 Hotspots

Following his Bulgaria trips, Fedotov made one more trip five-day trip to Turkey in August 2015.

During 2016, he traveled to London twice. His first visit was at the end of March, and he stayed in London six days until 1 April 2016. He returned to London for a four-day visit on 14 July 2016. Notably, or perhaps entirely coincidentally, these two trips were shortly before and after the Brexit referendum.

On 5 November 2016, Fedotov flew to Barcelona, and left back to Moscow from Zurich six days later. He returned to Barcelona one more time: on 29 September 2017, two days before the Catalunya independence referendum. Once again, by coincidence or otherwise, Fedotov remained in Spain during the October 1 vote, and flew back via Geneva to Moscow on 9 October 2017. He flew back to Geneva one more time three weeks later, on October 30, and returned to Moscow on 8 November 2017.

The Skripal Poisoning

At the end of 2017, Fedotov took a trip to Armenia. He stayed there between 23 December and 2 January 2018.  Only a week later, he flew to Zurich on January 10 and returned from Geneva on 17 January 2018. This would be his last trip before the London visit during which the Skripals were poisoned.

Traveling as “Fedotov”, Denis Sergeev arrived in London early in the morning of 2 March 2018, leaving Moscow at 7:00 on Aeroflot flight SU 2580. The other two suspects, Mishkin and Chepiga, would arrive on a later flight that afternoon.

It is unclear what Fedotov’s role may have been, if any, in the preparation and execution of the poisoning operation. We could also not establish if he traveled to Salisbury on any of the days he was in the UK. He had booked a return flight on Aeroflot’s SU 2579
from Heathrow to Moscow in the afternoon of March 4, the day on which Sergey and Yuliya Skripal collapsed unconscious.

However, he never boarded that flight. PNR records seen by Bellingcat and its investigative partners show that despite checking in to that flight around noon on March 4, “Fedotov” was a last minute no-show. Instead, using transportation that has yet to be identified by us, he made his way to Rome, and boarded a flight at 15:30 that same day back to Moscow.

In the next part, set to be published next week, we will detail how we identified Denis Sergeev, despite concerted efforts by Russian authorities to purge all public records of him and the two Skripal poisoners, Anatoliy Chepiga and Alexander Mishkin.

Correction: the itinerary graph above contains one incorrect destination entry for the last trip of 2017. The destination was Geneva, Switzerland, and not Yerevan, Armenia. The original data was obtained from border crossing records which reflect the traveler’s own declaration of destination. Subsequently obtained travel and telephone records show that Fedotov (Sergeev) traveled to Geneva, but reported Yerevan to border authorities, possibly for opsec reasons.