Identifying FSB's Elusive "Elbrus": From MH17 To Assassinations In Europe

Previously in this series:

• In previous joint investigations with Der Spiegel and The Insider, Bellingcat identified the killer of a Zelimkhan Khangoshvili, a Georgian-Chechen asylum seeker shot at point blank in Berlin’s Kleiner Tiergarten last August, as Vadim Krasikov, a 54 year old Russian linked to at least two contract assassinations in Russia.
• Using metadata from Krasikov’s telephone communications prior to the murder, we determined that the Berlin assassination was planned and supervised by senior members of FSB’s secretive Spetsnaz division “Vympel”, tasked with overseas subversion and special operations.
• Retracing Krasikov’s movements in Moscow in the weeks before his trip to Berlin, we established that he received extensive pre-mission training at FSB’s Spetznaz training base outside Moscow, and repeatedly visited FSB’s anti-terrorist headquarters, leaving little doubt that the Berlin assassination was mandated by Russia’s main intelligence agency.
• In the meantime, Bellingcat has discovered additional evidence pointing to the likely role of accomplices assisting in the plotting and the getaway plans following the assassination in Berlin. A separate investigation into the possible accomplices is pending.

On 14 April 2020, Ukraine’s security service (SBU) announced the arrest of Lt. General Valeriy Shaytanov, deputy chief of the SBU’s own anti-terrorist division who had played a prominent role in negotiating ceasefires and prisoner exchanges with Russia-backed militants in Eastern Ukraine. In a public statement, the SBU alleged the general had been recruited before the start of the 2014 war by an FSB operative, Colonel Igor Egorov, during one of the Russian’s many visits to Ukraine as part of a joint Russian-Ukrainian anti-terrorism working group. The SBU’s press release also alleged that Col. Egorov was a highly decorated KGB, and later FSB, officer who had received a medal for his role in annexing Crimea in 2014.

The SBU’s announcement also included audio recordings of conversations between Shaytanov and Egorov, and a third unnamed person whom they appeared to be grooming for a contract killing of a Chechen national living in Kyiv. Based on the quality of the voices in the audio and the permutations of the talking parties, it can be assumed that the conversations were made in person and not by phone, and the recording device was carried by the third person. It is plausible that the unnamed person was working with the SBU in a sting operation.

According to the SBU’s narrative and the supporting audio materials, FSB’s Col. Egorov had tasked the would-be assassin with the murder of Adam Osmayev, a Russian national and ethnic Chechen who lives in exile in Ukraine and used to lead a battalion of Chechens fighting alongside Ukrainian forces against Russian and Russian-backed militants in Eastern Ukraine. In one particular conversation, Egorov can be heard instructing the contract killer to not refer to the target by name, and to the planned operation as a murder, to which the unnamed person responds with the burlesque suggestion to refer to the op as “sending the target to the Eternal Hunting Fields”, a traditional Native American reference to the afterlife popularized by old East German Western movies popular in the Soviet Union. Col. Egorov agrees with this code, and instructs the contractor to refer to the target as “Maradona”, a reference to Argentine footballer’s “captain” status in the 1986 World Cup. In another tapped conversation, Egorov appears to haggle over the fee for the murder, initially offering $100,000 but, without much protest, accepting the counter-proposal of $200,000 – and throwing in an offer for Russian citizenship and an “officer’s certificate that will guarantee your old-age pension“.

Screenshot from surveillance footage of Egorov and would-be killer in Hamburg

The SBU also published footage from apparent video surveillance of the latest meet-up between Col. Egorov and the would-be contract killer, which the SBU says took place in Hamburg, Germany, in February of this year. The location of the video – which shows Egorov typing into his phone as he walks alongside the other man whose faced is blurred – can easily be geolocated to Hamburg’s Gänsemarkt Passage shopping mall. The SBU’s press statement also alleges that previous meet-ups between Col. Egorov and the contracted executioner, as well as between him and Gen. Shaytanov, took place in Germany, France and Croatia.

Who Is Colonel Egorov, Really?

Igor Anatolyevich Egorov, passport photo

Bellingcat and The Insider had previously identified – but had not yet publicly disclosed – Col. Igor Anatolyevich Egorov as a senior officer from FSB’s elite Spetznaz force known as Department V, the successor to the KGB’s elite subversion and special operations unit Vympel. (We described Vympel’s origins and mission in more detail in our investigation into the murder of Zelimkhan Khangoshvili). In our previous investigations into the role of GRU undercover officers in supervising and aiding Russian and Russia-backed militants in Eastern Ukraine, we had stumbled upon this person, who in 2014 and 2015 had traveled extensively – under two different identities – as Igor Egorov (his real name), and as Igor Semyonov (his cover name), between Moscow and the three control centers for Russia’s military operations in the Donbass: Rostov, Simferopol, and Krasnodar.

In May 2018, Bellingcat identified and publicly disclosed the identity of one of the key Russian military supervisors (or kurator, in Russian special service parlance) in the Donbass, who had operated under the cover name “Andrey Ivanovich” and the call sign “Orion”. This operative was Oleg Ivannikov, a colonel from Russian military intelligence (GRU) who had previously served – under the cover name of Andrey Ivanovich Laptev – a two-year stint as the Defense Minister of the Russia-backed breakaway territory of South Ossetia.

Russian media publications as well as accounts of Russian mercenaries and volunteers have previously told of an FSB counterpart to GRU’s “Orion” based in Donbass in mid-2014 (the FSB and the GRU are known to be in long-standing cold war for funding, influence and “new territory”). Telephone intercepts recently published by the Joint Investigation Team (JIT) into the downing of MH17 provide evidence of this competition escalating into hot turf-wars between GRU and FSB proxies, and even Spetznaz detachments sent to fight each other for control of territory in Eastern Ukraine in mid 2014. This FSB kurator, who in July 2014 was reportedly based in Luhansk, a large city near the Russian border, went by the nom-de-guerre “Elbrus” – the name of a dormant volcano and Europe’s highest mountain located in the tempestuous Caucasus on the border with Georgia.

The earliest public reference to “Elbrus” came from the separatist blogger and war correspondent Boris Rozhin (“Colonel Cassad”), who in November 2014 first wrote about the failed attempt by two Moscow-installed military commanders – “Delfin” and “Elbrus” – to consolidate the more than 20 disparate and infighting pro-Russian armed groups in the self-declared “Luhansk People’s Republic” (LNR) in eastern Ukraine. In another post from January 2015, he wrote that “Elbrus” was based in Luhansk, and together with “Delfin” – based in Krasnodon – were tasked with, and failed in, creating a new joint army of the two pro-Russian unrecognized republics. A Novaya Gazeta investigation from February 2016 quotes local sources as describing “Elbrus” as a senior, retired FSB officer who was based in Luhansk in 2014. Finally, a March 2016 Meduza investigation into the kidnapping of the Ukrainian soldier Nadia Savchenko (who was subsequently tried and sentenced in Russia) quotes the LNR unit commander who says he personally detained Savchenko before the artillery shelling took place – so before the alleged crime over which she was charged in Russia. He then said he handed over her belongings to “Elbrus, who called himself the FSB advisor to the LNR leadership“.

E For Egorov, E For “Elbrus”

In early 2019, we hypothesized that Col. Egorov may in fact be the elusive FSB kurator “Elbrus”. For starters, his rank and travel itinerary closely tracked with that of the GRU’s Col. Ivannikov (“Orion”). Secondly, the two also mimicked each other’s operational security trade-craft – both would travel from Moscow to Rostov, Simferopol or Krasnodar under their true identities, but would sometimes double-book a return flight to Moscow both under their real name and under their cover identity – on two consecutive flights on the same date. We surmised that this was a decoy measure implemented for high-value secret service operatives in order to throw off potential enemy assailants from their tracks. Third, we had identified Col. Egorov as an experienced veteran from the KGB’s/FSB’s elite Vympel Spetsnaz unit. In fact, we discovered that – in an almost never-publicized capacity – Col. Igor Egorov serves as deputy chairman of the Vympel Veteran Association.

Our early hypothesis that Col. Egorov is in fact “Elbrus” received a strong boost when in November 2019, the JIT published a number of intercepted phone calls from the days just before the downing of flight MH17, which contained conversations between militants in the self-proclaimed “people’s republics” of Donetsk and Luhansk. In one conversation intercepted on 16 July 2014 (the day before the MH17 downing), a militant inquires from his comrade if he has already met with the – judging from the context – recently-arrived commander “Elbrus”. This militant goes on to explain that he knew “Elbrus” “back from the Crimea events” – ostensibly referring to the Crimea annexation project – and describes him as an officer from FSB’s Vympel Spetsnaz, named Igor. He also describes Igor “Elbrus” as having a speech impediment, which can also be identified in the audio recordings of Egorov published by the SBU.

From the remainder of the conversation, which is peppered with disparaging comments about Elbrus’s strategic warfare skills (“these guys only know how do conduct special operations, but have no clue about general warfare”), it becomes clear that Elbrus was brought in from Russia with a decision-making role above local commanders in the military chain of command. Given that his arrival was just prior to the tragic shoot-down of MH17 by a Russian BUK missile, such role makes Elbrus a person of interest in the MH17 investigation, which would explain in part the publication of the intercepts by the JIT.

Two Similar Chechen Targets

In our previous investigations, we determined that the FSB used current and former members of its Vympel/Department V Spetsnaz units to carry out the extraterritorial assassination of Zelimkhan Khangoshvili in Berlin. The new disclosure that the FSB’s Col. Egorov, also a Vympel operative, was plotting the assassination of another Chechen living in exile, suggests that these operations are part of a longer running strategy of extraterritorial eliminations. The parallels between the two targets are not trivial.

On one hand, Russia has formally accused both Khangoshvili and Osmaev of being terrorists: Khangoshvili over supposed crimes during his participation in the Second Chechen War in the early 2000s, while Adam Osmaev was initially charged with plotting to assassinate Chechnya’s ruler Ramzan Kadyrov in 2007, and later Vladimir Putin in 2012 (he denies both charges, and after serving 2 years in pretrial detention in Ukraine awaiting extradition to Russia, was released by Ukrainian courts in April 2014). On the other hand, both targets had taken part in active warfare against Russian forces – Khangosvili had taken part in the Second Chechen war and had formed a volunteer combat unit in the Georgian-Russian War in 2008 (although this unit never saw military action); while Adam Osmaev was an officer, and since February 2015, the commander of a military unit comprised of ethnic Chechens who fought in key battles against Russian forces and pro-Russian militants in Eastern Ukraine in 2014 and 2015. Both Khangoshvili and Osmaev had been targets of multiple previous assassination attempts. Khangoshvili had been shot at and targeted by bombs in Georgia and Ukraine before he was finally killed in Germany, while Osmaev was the target of two assassination attempts in Kyiv in 2017 – the second of which killed his wife and comrade-in-arms, the Chechen-Ukrainian Amina Okueva.

It is unclear if the FSB’s targeting of these two ethnic Chechens is mainly due to their earlier involvement in the Second Chechen War, or due to their more recent involvement in military operations against Russia in the Georgian and Ukrainian wars (despite Russian official claims, there is no public evidence that the two were involved in actual acts of terrorism). It is equally plausible that they simply fit the pattern of high-profile Chechens that have the potential to mobilise secessionist Chechen forces, and are thus seen as posing risks to the Russian state.

Hiding In Plain Sight

Despite the fact that Col. Igor Egorov played a crucial role in the annexation of Crimea and in Russia’s incursion into Eastern Ukraine – both of which are unlawful under international law – he has been able accumulate impressive mileage as an international traveler. Unbothered by Western law enforcement or intelligence services, Egorov has crisscrossed the European Union, and traveled to the Middle East and Asia on almost a monthly basis since the start of the war in Ukraine.

We have obtained and reviewed travel data for Egorov that shows he has purchased a total of 481 airline tickets since 2011, with most flights to hotspot destinations in Russia such as the Caucasus or Ukraine-adjacent airports. Notably, he has made 37 international trips since 2014, most of which are to EU countries. He traveled at least 11 times to Germany – mostly to Frankfurt, Munich and Hamburg, with the latest trip to Hamburg being 10-12 February 2020. It was likely during this trip that he was secretly videotaped, as seen in the SBU press materials. He also frequently flew to Croatia and France – and indeed, SBU’s release alleges that these two countries were also used during 2019 as meet-ups between Egorov and his two Ukrainian assets.

Other notable destinations include Montenegro – with four trips to the coastal town of Tivat, none of which long enough to qualify as a vacation getaway. His longest stay was during a five-day trip in September 2016, one month before the failed coup in the mountainous Balkan state. Outside of Europe, Egorov traveled repeatedly to Tel Aviv, and once to Singapore. A trip to Jordan’s capital Amman took place 3 weeks after Jordan’s King Abdullah II visited the Kremlin to discuss, among others, Russian-Jordanian military cooperation and Syria-related security issues.

Remarkably or coincidentally, Col. Egorov flew to Croatia just after Vadim Krasikov flew to Paris on route to his operation in Berlin. Egorov returned to Moscow on 23 August 2019, immediately after Khangoshvili’s assassination. We will continue investigating possible links between this trip and the Berlin operation.

No Borders For Old FSB Men

Given Egorov’s senior role within the FSB’s subversion-focused Vympel / Department-V, and likely role in unlawful military operations in Ukraine including possible chain-of-command role in causing the downing of MH17, it is hard to believe that he was able to roam freely around Europe. Data from a visa processing database in Russia reviewed by Der Spiegel shows that in December 2016, Egorov applied for and received a multi-entry, four-year visa issued by France and valid for the Schengen area. As he traveled around Europe also before December 2016, it is clear that he had had a previous Schengen visa before that. In the application for his French visa, Egorov had identified as purpose for the travel “visits to friends and family”, but had listed the name and phone number of a French hotel as the only contact reference.

As we previously reported, Khangoshvili’s assassin Vadim Krasikov, using a passport under the fake identity of Vadim Sokolov (a non-existent persona with no digital or documentary footprint) had also received a French Schengen visa on which he flew to Paris, Warsaw and Berlin. Contacted by our Russian partner The Insider, a spokesperson for the French consulate in Moscow told us that given the huge number of applications from Russia, consular services are unable to vet all information claimed by visa applicants, or to authenticate the veracity of supporting documentation. At the same time, the official claimed that consular officers do routinely verify applicants’ employment data, and in Krasikov’s case had indeed double-checked with his (fake) employer that he did indeed work there.

From the visa documents reviewed by us, it is unclear what occupation Egorov had claimed in his application. Egorov has a nearly non-existent digital footprint, with no social media accounts in his name. Corporate registries show him as owner and “liquidator” of a company named “Cente for Specialized Equipment”, founded in 2012 and currently in liquidation. It is thus very plausible that this company – which has no digital footprint other than its corporate registration data – was set up by Egorov as an employment front namely to be able to receive visas.

There is little doubt that by the time Egorov applied for his visa in 2016, he was still de facto working for the FSB, rather than a retired officer engaging in commercial activity. A review of his travel within Russia shows continued trips to Chechnya, Rostov and Crimea under both his real and his fake identity – the latter not possible for a former secret-service officer – through December 2019.

Although Egorov roamed throughout Europe unperturbed on a French visa for the last four years, there is evidence that at least in the last few months French authorities had caught up with him – or had been tipped off by a foreign service (likely Ukraine’s SBU). A police alert record seen by our investigative partner Der Spiegel shows that no later than March 2020, French law enforcement had sent a “track but do not arrest” alert on Egorov to Schengen police, referencing a “cross-border criminal investigation”.

Evading Arrest In Germany

There is uncertainty as to the degree of coordination between the Ukrainian security service and European law enforcement or intelligence services in relation to the SBU sting operation. Ukrainian sources interviewed by us on condition of anonymity have claimed that Ukraine had requested Egorov’s arrest during his latest visit to Hamburg but that Germany declined to detain him. Both Ukrainian and German sources claim that the sting operation were conducted jointly, and the video surveillance was implemented by a German intelligence service. The diverging opinions emerge on the subject of why Egorov was not arrested. One theory proffered by a German law-enforcement source requesting anonymity is that there were plans to arrest the FSB colonel during his next trip, when he was expected to be procuring the cash for the Ukrainian hit job. This trip did not materialize, however, due to the impending coronavirus crisis and restrictions on movements.

Indeed, booking records obtained by Bellingcat show that Col. Egorov had purchased one additional plane ticket to Germany – planning to fly from Moscow to Frankfurt on 4 March 2020 and stay there until 9 March 2020. However, on the evening of 28 February he cancelled these bookings.

Whether triggered by the Coronavirus restrictions that were beginning to take shape by end of February, or by a leak of sensitive operational information, this booking cancellation likely saved Col. Igor Egorov him turning up as a valuable witness, or possibly suspect in court in at least one European country.