The Bulgarian spy ring has starkly shown the changing threat facing the UK, a counter-terrorism chief has warned, as Russian state intelligence increasingly turns to criminal proxies to carry out operations on British soil.
The five members of the group carried out extensive surveillance on a number of targets, including investigative journalists, a US army base and a Kazakhstani politician, using sophisticated technology and tactics.
Commander Dominic Murphy, head of the Met Police’s Counter Terrorism Command unit, said: “I have never seen anything link this in my more than 20 years in counter-terrorism. It was an extremely sophisticated operation.”
He added: “This investigation uncovered spying on behalf of the Russian state on an industrial case, in this case committed by a group of Bulgarians contracted by an individual to conduct that spying on behalf of Russia.
“As the UK becomes a more hostile environment as a result of our work we will see them increasingly use proxies to conduct their activities.”
It forms part of an emerging trend across Europe, with a campaign of sabotage reported in countries such as Germany, Lithuania, Sweden, Estonia and Poland in a pattern of behaviour reminiscent of the Cold War.
This has included repeated railway derailments investigated by the Swedish security police, signal interference over the Baltic Sea region and plots to target airbases used by the US in Germany.
Giving his annual report in October, the head of MI5 Ken McCallum said that Russian intelligence is on a mission to create “sustained mayhem” in Britain.
He said that since the UK backed Ukraine in its war against Russia, GRU agents had carried out “arson, sabotage and more dangerous actions conducted with increasing recklessness”.
He added that since Europe had expelled more than 750 Russian diplomats since 2022, many of which were spies, their intelligence services had turned to proxy groups such as private intelligence operatives and criminals.
In an interview recording obtained by the Times in December, Mr McCallum also said the agency has had to look at its “finite” resources and make “uncomfortable choices” due to the growing threat from hostile states.
“We now face much, much more aggression from nation states,” he said. “In effect, we had the 20- to 30-year holiday from that kind of big player, sophisticated states in serious conflict with each other. It’s back, I’m afraid.”
The number of state-threat investigations by MI5 has increased by 48 per cent in recent years, with the UK’s “leading role” in supporting Ukraine meaning “we loom large in the fevered imagination of Putin’s regime”.
On the threat they posed, Commander Murphy said: “My concern has always been what that lifestyle surveillance was going to lead to and we have seen a long history of the Russian state conducting operations here in the UK, including lethal threat operations like the investigation in Salisbury.
“Certainly national security was at stake as a result of this investigation but, yes, there was physical threat to individuals here in the UK which is one of the reasons we treat investigations like this so seriously in counter-terrorism police.”
On the challenges faced by enemy states operating on UK soil, he said: “Within counter-terrorism policing we are seeing more than 20 per cent of our demand now coming from threat posed from foreign states to our national security so this is an ever-growing challenge for us.
“We are committed to working closely with intelligence agencies in this country and our international partners to disrupt activity by foreign states.”
Katrin Ivanova, 33, Vanya Gaberova, 30, and Tihomir Ivanov Ivanchev, 39, have now been found guilty at the Old Bailey of being part of a group that passed secrets to Russia for nearly three years.
Their two ringleaders, Orlin Roussev and Biser Dzhambazov, had already admitted espionage charges and having fake identity documents.
Upon their arrest, hundreds of “sophisticated” devices were discovered at an address in Harrow and Roussev’s address in Great Yarmouth, which were used to gather intelligence, including hidden bugs and jammers.
Among the spy kit were 33 audio devices, 55 visual recording devices, 221 mobile phone phones, 495 SIM cards, 11 drones, 75 passports and 91 bank cards in various names.
Cameras had also been hidden in Coke bottles, in a Minion teddy bear and found within ties and a pair of glasses.
Hundred of thousands of pounds were channelled into the ring via their Russian spymaster “Rupert Ticz”, said to be Austrian national Jan Marsalek, the former chief operating officer of Wirecard who is wanted for a missing $2bn that disappeared from the German financial provider.
The Met Police were able to discern six spying operations which involved “high level espionage with high levels of deceit” which were “extremely risky” for those involved.
This included tailing two investigative journalists who had covered Russian funds and the Salisbury poisoning, as well as a Russian lawyer designated a “foreign agent” by the state.
The group had also plotted to fake a demonstration outside the Kazakh Embassy in September 2022 and had travelled to Stuttgart to conduct surveillance on Patch Barracks, a US army base in Germany training Ukrainian soliders.
