Putin’s Spies for Hire: What the U.K.’s Biggest Espionage Trial Revealed about Kremlin Tactics in Wartime Europe

In early 2023, in the sleepy English seaside town of Great Yarmouth, a covert operation was quietly revving into gear. Second-hand Chryslers and a Mercedes Viano van were being transformed into mobile spy units — outfitted with tinted windows, cloned foreign license plates, and kitted out with military-grade surveillance tech. International mobile subscriber identity (IMSI) catchers — devices that mimic mobile towers to intercept phone data — were to be placed into the blacked-out cars and powered by their batteries. Behind it all was a middle-aged Bulgarian man holed up in a cluttered, three-story, former guesthouse, working tirelessly to configure the IMSIs and build hidden cameras disguised as bottles, fake stones, and a birdhouse, which would allow him to monitor the operation in real time.

Soon, he planned to deploy his operatives to ferry the refitted vehicles across Europe. Their destination: Patch Barracks just outside Stuttgart, Germany — an unassuming U.S. military base housing U.S. European Command and Special Operations Command Europe. Their mission: to circle the base for a months-long surveillance operation designed to grab the ID numbers of mobile phones belonging to Ukrainian soldiers. One year into Russia’s full-scale invasion, these soldiers were believed to be training in the operation of U.S.-made Patriot air defense systems. The ultimate goal: deliver targeting intelligence to Putin’s security services, which could be used to kill the operators and destroy the critical missile batteries.

The operation never got off the ground. On February 8, 2023, as the team was preparing to set off for Stuttgart and begin months of clandestine surveillance around the key U.S. base, the plan was abruptly halted. Officers from SO15, Scotland Yard’s elite counterterrorism and counter-espionage command, moved in, arresting most of the suspects in a coordinated sweep across the United Kingdom. By November 2024, six Bulgarian nationals stood before the Old Bailey — the storied London court known for trying the Kray twin gangsters, an ensemble of Cold War terrorists, and the infamous Portland Spy Ring. During the pre-trial hearings, the group’s top three operatives stepped forward, each with a nervous smirk, and pleaded guilty. The remaining three faced a three-month trial. On  March 7, 2025, the jury returned its verdict: guilty. The group was convicted of conspiring to collect information that would be directly or indirectly useful to Russia, explicitly referred to as an enemy during the trial, and of endangering public safety and the U.K.’s national security interests.

This was the largest spy ring ever tried in the United Kingdom. I attended the trial alongside two dozen journalists. The 80,000 Telegram messages, financial, travel records, and court testimonies offered unprecedented access to the inner workings of modern espionage networks, providing a rare glimpse into the Kremlin’s evolving espionage playbook. Here is what we learned.

The Contractor Network

The trial pulled back the curtain on the anatomy of an unusual espionage structure. Rather than a traditional “spy ring,” led by an experienced intelligence officer or “principal agent” — a senior asset trusted with running other agents — the structure exposed in the Old Bailey resembled a state-commercial contractor relationship. In this multilayered, delegated chain, Russia’s domestic security services — the Federal Security Service (FSB) and military intelligence, the Main Intelligence Directorate (GRU), now officially known as the GU — acted as the “clients.” According to lead Prosecutor Alison Morgan, they were looking to fill a “gap in the market” that emerged following expulsions of Russian spies shortly after the GRU’s 2018 attempt to poison Sergei Skripal. To fill this need, they outsourced operations to a “contract manager,” Jan Marsalek, the Prada-wearing, disgraced, Austrian ex-Wirecard Chief Operating Officer (COO) believed to be hiding in Russia since the company’s collapse in June 2020. Marsalek, who had pre-existing networks of private operatives and longstanding ties to Russian intelligence, appeared to volunteer for FSB or GRU operations — perhaps as a means to sustain his shadowy business ventures — or to ingratiate himself with the government on whose whims his life now depended.

Acting as a liaison with his Russian clients, Marsalek brought on board a U.K.-based “country manager” — that tech-savvy, middle-aged Bulgarian operating from the cluttered three-story guesthouse in Great Yarmouth. Orlin Roussev, with a murky background in private investigation and IT, had met the Wirecard COO in 2015. By 2020, they were plotting operations on behalf of Russia: Marsalek would bid for covert missions, and Roussev would refine them into detailed operational plans. Together, the pair acted as espionage contractors, fulfilling Moscow’s requests and hustling for the next job.

With the client’s approval, Roussev delegated further operational responsibilities to his close associate, Biser Dzhambazov, who acted as second-in-command or “deputy country manager”. The Bulgarian-born medical courier and community organiser based in the United Kingdom assembled a curious crew of amateur, also Bulgarian-born, “sub-contractors” — individuals who were personally or romantically intertwined — with no formal intelligence training. They included: Dzhambazov’s long-term partner and fellow laboratory assistant Katrin Ivanova; his lover and beautician Vanya Gaberova; her ex-boyfriend, a painter and decorator named Tihomir Ivanchev; and Dzhambazov’s close friend and laboratory colleague, mixed martial-arts fighter Ivan Stoyanov. While Roussev and Dzhambazov planned all operations, typically with Marsalek’s input, the four sub-contractors executed them. Referring to them as the “minions,” Roussev kept them at arm’s length, maintaining a degree of insulation from direct fieldwork.

Image: MET Police; visual by Barbora Ruscin.

However, at times, Roussev was forced to step out of the shadows — especially when the “minions” struggled to operate the high-tech gadgets he had assigned for each mission. Fashioning himself as “Q” — a nod to the technology mastermind from the James Bond franchise — Roussev assembled what SO15 described as a “spy factory,” packed with hundreds of surveillance and espionage tools. His arsenal included three IMSI catchers, which the jury heard were valued at around $250,000, nearly a dozen drones, and covert cameras concealed in sunglasses, ties, a Coca-Cola bottle, and even a Minion soft toy. There were also Wi-Fi and GPS jammers, bug detectors, eavesdropping gear, vehicle trackers, and an ID card printer, alongside counterfeit passports and driver’s licenses from nearly a dozen European countries.

This equipment gave Marsalek’s contractors the means to conduct surveillance, identity theft, and collect intelligence in multiple countries, and they were all paid handsomely for this work. Records show Dzhambazov receiving a sum equivalent to $215,000, which he distributed to other network members. The hefty rewards received by Roussev’s sub-contractors are in stark contrast with the paltry amounts paid to so-called gig-economy agents-saboteurs — online recruits hired by Russia to conduct high-risk, one-off surveillance and sabotage operations across Europe.

While well paid, the ring was rife with romantic entanglements and personal drama. Dzhambadzov and Ivanova were in an open relationship, but he secretly began an affair with another member of the spy crew, Vanya Gaberova. To further complicate matters, he also recruited Gaberova’s ex-boyfriend, Tihomir Ivanchev. In a bizarre twist, Dzhambadzov is believed to have faked a brain cancer diagnosis — possibly to cover for his double life and elicit sympathy from his partners.

Tracking Opponents

While uncovering this corporate espionage structure, the trial also offered a rare window into the Kremlin’s evolving intelligence priorities from August 2020 to February 2023. The operations detailed in court spanned several tactics. These included pattern-of-life surveillance of regime critics, classic Soviet-style “active measures” aimed at discrediting adversaries or gaining political advantage, and reconnaissance missions focused on gathering military targeting intelligence. The network used the United Kingdom as a hub to run covert operations across five other European countries — Spain, Germany, Austria, Hungary, and Montenegro — taking full advantage of the Schengen system to move operatives and equipment freely across borders. Crucially, the evidence reveals how Moscow’s focus shifted and sharpened shortly after Russia’s invasion of Ukraine.

In the first year and a half of its existence, the network was mostly hired to conduct surveillance of key Kremlin opponents or critics. It began with a Telegram message. On December 14, 2020, just hours after a damning report about how Putin’s spies poisoned prominent Russia opposition leader Alexei Navalny was made public, Marsalek contacted the British-based Roussev. “We’d be interested in a Bulgarian guy working for Bellingcat: Christo Grozev,” Marsalek wrote. “Can we look into this guy, or would it raise too many eyebrows?”

Roussev replied with interest, clearly unaware of Grozev’s prominence but intrigued by the opportunity. So began their first big espionage venture. Over the next three years, Christo Grozev, the Bulgarian-born journalist dubbed “modern-day Sherlock Holmes” then serving as Bellingcat’s lead Russia investigator, became a primary target for Roussev’s team of sub-contracted operatives. Bellingcat, the open-source collective that pioneered 21st-century data journalism, had struck a nerve with its forensic exposure of Russian covert operations, and Grozev was at the center of the investigative journalism that uncovered them.

Roussev’s sub-contractors tracked Grozev across Austria, Bulgaria, Montenegro, and Spain, monitoring his movements, assessing his vulnerabilities, and considering methods to compromise him. Plans were considered to steal his devices, burn his property, or honeytrap him — a tactic where seduction is used to gain trust, extract information, or compromise the target. One particularly elaborate proposal as heard in court involved feeding Bellingcat false intelligence about a Wuhan lab leak, only to later expose the story as fake; in this way the group could “publicly ruin” the organization. The most chilling moment came when Marsalek told Roussev: “Some f**ing genius just suggested again to kidnap Grozev and take him to Moscow. These people never learn 🙈.” Roussev, unfazed by the Russian demand, immediately started suggesting ways this task could be achieved, referencing the Mossad’s 1960 capture of Adolf Eichmann as inspiration. He wrote, “If you are serious about it…and if Grozev is in Bulgaria I have the resources to kidnap, drug him and lock him up in one secure cave… We will need a plane or a boat…” Marsalek laughed the idea off — barely. “It’s likely a Hydra—cut off one head and two new ones emerge. But if they want it, I’m happy to give it a shot. It’d be a good project. 😊” Ultimately, the network’s plots stopped at surveillance, several attempted break-ins, and the theft of one of Grozev’s laptops. But it was only the start of a wider campaign against Kremlin critics abroad.

A year into tailing Grozev, the network turned its attention to a high-profile Russian journalist: Roman Dobrokhotov, editor-in-chief of The Insider. Tracked from Budapest to Berlin in November 2021, he found himself seated next to Roussev’s operative, Katrin Ivanova, on a flight. She filmed him with a hidden camera and relayed her observations to Roussev in real-time via Telegram. In August 2022, Marsalek revived the idea of abduction. “We might get the opportunity to kidnap RD,” he wrote. “Any ideas?” Roussev proposed several, including a maritime operation dubbed Operation Boat Trip. Other suggestions were disturbingly theatrical, such as assassinating Dobrokhotov by burning him alive, spraying him with VX — the highly-toxic nerve agent used in 2017 by North Korean dictator Kim Jong Un to assassinate his half-brother — or poisoning him by taking inspiration from Israel’s 1997 failed poisoning attempt on Hamas leader, Khaled Mashaal.

Neither the journalists nor the other two targets contracted out to Roussev’s team — a Russian investigator exiled in Montenegro and a Kazakh dissident living in London — were ultimately harmed. However, it was the obsessive, years-long pursuit of these targets that laid bare how far Russia’s security services were willing to go — and how dangerously willing their amateur subcontractors had become.

Image: Barbora Ruscin.

Upping the Ante

Following Russia’s full-scale invasion of Ukraine in February 2022, the tasks handed to Roussev’s team shifted from targeting opponents to carrying out missions driven with more strategic objectives. Shortly after the start of the war, the Kremlin began using this covert network to not only track its opponents but also to manipulate perceptions, win over allies, and gain advantage in a protracted war. The operations also grew more urgent and more dangerous. Roussev’s team were no longer just eyes and ears — they were also expected to create realities favorable to Moscow’s interests.

Shortly after the invasion of Ukraine, Marsalek’s network was asked to kickstart an anti-Ukraine graffiti and sticker propaganda campaign in Austria and most likely Germany. Although these activities were not center stage during the Old Bailey proceedings, this active measure marked a key shift in Moscow’s tasking. The plot was simple: Roussev’s team would spray graffiti and distribute stickers suggesting links between Ukraine, President Zelensky, and right-wing extremism. Slogans such as “I love Azov” — referencing a Ukrainian battalion associated with right-wing ideas that Putin used as a pretext for invasion — and the battalion’s logo were placed in sensitive locations, including the Jewish Museum’s Judenplatz in Vienna.

The network was also hired to produce anti-Russia stickers — images of pigs crossed out with the slogan “Russian,” and yellow labels with a struck-through “Z.” These were to be plastered on Vienna’s Soviet war memorial and Russian-owned shops and hotels, as well as the luxurious Hotel Sacher. The aim was most likely to create the illusion of an organised, aggressive, anti-Russian campaign sponsored by Ukraine, which would allow Moscow to portray itself as a victim of Russophobia. In the summer of 2022, the team located where Vienna-based journalists lunched and targeted these cafes and nearby benches. Marsalek was pleased but warned, “But let’s be careful please, it must not look artificial. The journalists are rats but not stupid.”

In September 2022, Marsalek’s network escalated its efforts by targeting the Kazakh Embassy in London, located near Trafalgar Square and some of the capital’s most exclusive clubs. The objective was to stage a fake protest, creating the illusion of a Kazakh opposition group in exile. Russia intended to pass this fabricated intelligence to Kazakh officials to position itself as a useful ally in suppressing dissent. Appearing helpful, the move would also aim to repair Moscow’s strained relationship with Astana, a key regional player that balances ties between Moscow and the EU.

Roussev’s “minions” were assigned to spray fake pig’s blood on the embassy walls, followed by a message claiming it symbolized the blood of innocent Kazakhs on the hands of the regime. In an unusual twist, Marsalek was to become directly involved, orchestrating a letter-writing campaign to U.S. and European officials urging sanctions against Kazakhstan and its leadership for supporting Putin. The aim was to deceive Kazakh authorities into believing Russia was protecting their regime’s internet, tighten Astana’s dependency on Moscow, and reshape regional dynamics through manufactured threats.

In October 2022, Marsalek upped the ante. Moscow’s appetite for operations abroad had clearly risen. He messaged Roussev with a bold request. “…can we use the IMSI catcher in Germany? We need to spy on Ukrainians at a German military base.” Roussev, unfazed, replied, “Sure we can… both are sitting and gathering dust in my Indiana Jones garage 😊😊.” The base in question was Patch Barracks near Stuttgart, believed by Marsalek to be training Ukrainian troops to use the Patriot missile defense systems — highly mobile surface-to-air interceptors vital to Ukraine’s defensive efforts against Russian aerial assaults. The goal of the mission was to gather phone data from individuals inside the base, particularly mobile identifiers of Ukrainian soldiers.

Roussev sprang into action. He dispatched Dzhambazov and Ivanova on a covert reconnaissance mission to scout the base’s perimeter and identify ideal spots, such as parking lots and apartments, where the spy kit could be deployed. After they returned, Roussev moved to the next phase: transforming second-hand vehicles into mobile intelligence units. His team refitted Chryslers and a Mercedes with dark-tinted windows, cloned license plates, and two IMSIs catchers. The plan was set: the team would launch a high-risk surveillance mission to extract digital fingerprints of Ukrainian soldiers — intelligence Moscow could use to track and target them on the battlefield.

Just days after Roussev confirmed to Marsalek that the vehicles and operatives were ready, the plan, which the prosecutor argued had “potential to damage U.S., Allied and Ukrainian interests, at a crucial time,” was dismantled in dramatic fashion. On February 8, 2023, Roussev, his deputy country manager, and the four sub-contractors were arrested, halting what would later be described as the largest counter-espionage operation in U.K. history.

Although the network never made it to Germany or staged the fake anti-Kazakh protest, its exposure laid bare an important chapter from Russia’s contemporary espionage playbook. This was not classic Cold War spycraft. It was espionage by contract. The Kremlin had effectively outsourced sensitive intelligence work to a decentralized network of private operatives, mirroring how governments contract out defense or infrastructure projects. The structure — layered, fragmented, and packed with amateurs — was arguably not primarily designed to ensure deniability. Rather, the arrangement filled the intelligence void following the 2018 wave of expulsions and those that followed the February 2022 Russian invasion of Ukraine, aimed to increase the Kremlin’s operational capability, speed, and flexibility. The main contractors, Marsalek and Roussev, realized the enormous monetary value of this opportunity and hired complete amateurs to carry out Russia’s outsourced operations. However, this dangerous mix bred chaos, incompetence, and risk. In the end, it was this model that helped unravel the entire operation.

At the time of writing, how the spy ring was uncovered remains unclear. In espionage cases, details of discovery are rarely made public, as they often rely on intelligence sources and methods that are not admissible in court and are kept tightly classified to protect ongoing capabilities.

Crucially, the network’s operational timeline demonstrates a shift in Moscow’s intelligence priorities. Early missions revolved around surveilling Kremlin critics, but after Russia’s full-scale invasion of Ukraine, the clients’ taskings escalated sharply in ambition, urgency, and risk. Moscow no longer sought just information or revenge; it wanted influence, disruption, and military advantage.

Disturbingly, this espionage-for-hire model was never just about six Bulgarians or one courtroom drama. Roussev and Marsalek plotted further ventures, including targeting a Munich-based group investigating China’s Uyghur abuses and offering captured battlefield tech to Beijing. The scope of their ambitions pointed to a marketplace of espionage for hire. Meanwhile, the human cost is ongoing: Christo Grozev lives apart from his family. Roman Dobrokhotov has been warned by police of a second suspected Russian cell operating in the United Kingdom. The war in Ukraine rages on. This may have been the U.K.’s largest-ever spy trial — but it will not be the last.

Daniela Richterova, Ph.D., is associate professor in Intelligence Studies at the Department of War Studies, King’s College London. She specializes in the history of Cold War espionage, counterterrorism and state-based threats. She is author of Watching the Jackals: Prague’s Covert Liaisons with Terrorists and Revolutionaries. Bsky: @drichterova.bsky.social * Insta: @drichterova_kcl * LinkedIn.

Image: Midjourney and the Crown Prosecution Service.

War on the Rocks