Later that same evening, during a corporate dinner, Emilian Gebrev felt the early effects of severe poisoning, with the symptoms quickly worsening until he fell into a coma that evening. A blood and urine sample analysis conducted two months later by the OPCW-accredited Finnish laboratory VERIFIN showed that his vital functions had deteriorated severely, leading to, among other things, kidney failure. Gebrev was hospitalized at the Military Medical Academy in Sofia that same night, with his production director and son hospitalized with similar, albeit less severe, symptoms in the following few days.
As Gebrev was succumbing to the first symptoms of poisoning over dinner, “Gorshkov”, “Fedotov” and “Pavlov” took an evening flight from Sofia to Istanbul, and then took a connecting flight onward to Moscow that same night.
Gebrev did not die, nor did the two people who were also poisoned. Four weeks later, on 23 May 2015 “Fedotov” returned to Bulgaria, flying again to the seaside resort of Burgas. According to sources familiar with the investigation, he rented a car and disabled its GPS tracking system, making his movements in the next seven days unknowable. On 28 May 2015, “Georgy Gorshkov” also returned to Bulgaria, landing in Sofia.
On the night of 28 May Emilian Gebrev — who was then convalescing at his seaside home a few dozen kilometers south of Burgas — felt the onset of the symptoms he knew all too well. That same night, his son drove him back to the Military Medical Hospital in Sofia.
The next day “Gorshkov” and “Sergey Fedotov” drove from Sofia to neighboring Serbia, returning the rented car in Belgrade from where they both flew back to Moscow on 30 May.
“Georgy Gorshkov” never took another trip again.
A Diplomat Is Born
Shortly after the failed Bulgarian operation, the persona of “Gorshkov” appears to have been decommissioned. However, the real person behind it, Egor Gordienko continued his work for the GRU.
During 2016, he took several flights from Moscow to the Siberian city of Novossibirsk, Krasnodar and Crimea, but his first international trip was not until 2017.
On 27 January, he flew on a diplomatic passport from Moscow to Geneva. Judging from a 2018 list, seen by Bellingcat, of all foreign diplomats accredited to Switzerland, Egor Gordienko was accredited as third secretary to the Russian mission at the Word Trade Organization in Geneva. However, Gordienko’s name is not listed in any archived copy of the diplomatic lists published by the Russian Foreign Ministry. Several foreign diplomats based in Geneva told us they have no recollection of meeting Gordienko. However, an unidentified diplomat consulted by the Nightingale blog that first publicized Gordienko’s real name said that they recognized him based on the photograph of “Gorshkov” that was published by Bellingcat.
The Loneliness of the Long-Distance Runner
The only open-source trace of Egor Gordienko’s existence as a member of the Russian mission in Geneva comes in the form of online stats from two marathon runs in Geneva — one from the popular Antigel 5-km run from January 2018, where he apparently finished 90th, with a time of 33 minutes, and a second one from December 2018, where he and his family were signed up but none of them showed up. In both races he is listed as a member of the Russian Mission.
Egor Gordienko signed up for two public run events, one on in January 2018 and a second one in December 2018. He did not take part in the latter one.
Keith Rockwell, WTO’s Director of External Relations, confirmed to our investigative partner Tamedia that a person named Egor Gordienko was indeed accredited to WTO by the Russian Federation in 2017 on a term that was due to run until 2020 but was terminated prematurely in 2018. Mr. Rockwell said he did not know Mr. Gordienko nor his actual function, and stated that any of the WTO member governments can register any individual as part of their diplomatic mission, subject to authorization by the host country. A spokesperson for the Swiss foreign ministry also confirmed that Gordienko was accredited in January 2017, and that his accreditation was rescinded on 31 October 2018.
We attempted to get a clarification on Egor Gordienko’s function at the WTO from the Russian Mission. Tamedia’s query elicited a response from the Russian Mission’s press officer, Daria Rudakova, who wrote that, “We have no information of the above-mentioned person”. A follow-up email pointing to the oddity of a random stranger unknown to Russian officials being accredited to the WTO, and running marathons on behalf of the Russian Mission, remained unanswered. Our partner, The Insider, called Rudakova to follow up on this strange case of diplomatic amnesia. The press officer asked for several hours to investigate the matter, and then proceeded to stop answering her phone.
Potential Tasks in Geneva
It is not yet known what Egor Gordienko’s main mission in Geneva may have been. Our review of phone metadata of his Russian phone (which he used primarily while in Russia) shows that in 2017 and 2018 he was in close working contact with Sergeev, Chepiga, Mishkin, and other members of Unit 29155. Thus, we can assume Gordienko’s interests in Switzerland were similar to those of the other GRU team members, or that he provided a supporting role under diplomatic cover.
Based on our tracking of Denis Sergeev’s mobile phone movements in Geneva, Sergeev appears to have visited the WTO compound on occasion, but this was clearly not his, and not the GRU’s, main interest. Given frequent e-sightings of him at the Lausanne branch of the World Doping Association, the Lausanne Polytechnic Institute, as well as the frequent trips to locations near the ski slopes, it is more likely that those locations, among others, would have been of interest to Gordienko as well. Without metadata for Gordienko’s Swiss mobile number, we are not able to analyze his movements in the same way we did this for Denis Sergeev.
However, it is notable that from December 2017 to February 2018, a constellation of several GRU officers from Unit 29155 traveled to Geneva, including Col. Anatoly Chepiga and Col. Alexander Mishkin, as well as the ubiquitous General Sergeev, whose last trip to Geneva was in late January. On many occasions, these officers several times postponed the return dates for their trips back to Moscow, indicating they were waiting for something to happen, or someone to arrive.
These trips occurred only two months before a crucial operation — the poisoning of the former GRU double agent in Salisbury — suggesting a possible link between the two operations.
Even more indicative of a link may be the trip of at least one officer from Unit 29155 to Geneva late in February 2018, just days before the Salisbury operation. GRU officer Nikolay Ezhov, travelling under his cover identity of Nikolay Kononikhin, arrived in Geneva on 21 February 2018. He had no return ticket, implying that he did not know how long his assignment might last. Ticketing records show that on 1 March 2018, he appeared at the airport at 22:30 and bought a last-minute ticket for a plane to Moscow departing only an hour later. It was that same evening that Sergeev, Mishkin and Chepiga bought their last-minute tickets to fly into London the next day.
Nikolay Ezhov was one of the GRU officers involved with the preparation for the Bulgarian poisoning in 2015, and he stayed in Sofia for approximately two weeks in February and March, presumably tracking and collecting reconnaissance on the target. While his presence in Geneva might well have been part of a different mission, the very small clandestine team of Unit 29155 is unlikely to have had the capacity to work on two important overseas operations at the same time.
Notably, upon his return to Moscow for the summer recess on 4 July 2018, three months after the Skripal operation, Gordienko immediately called Sergeev, Mishkin, Chepiga and Ezhov, in this exact sequence.
Meanwhile, the Swiss Foreign Ministry told Tamedia they were not aware of Egor Gordienko’s activities outside his accredited diplomatic function.
Postus Interruptus
At 8:21 p.m. on 25 October 2018, Egor Gordienko bought a last-minute ticket to Moscow for a flight departing at 10:40 that night. He bought a two-way ticket with a return flight for 31 October. However, he never returned to Geneva, and never traveled outside Russia again.
Flight records show he arrived at Moscow’s Sheremetyevo airport at 2:45 a.m. His phone metadata shows that at 7:05 a.m. he was already at the GRU headquarters at Khoroshevskoe Chausse 76B. At that time, he called his boss, General Andrey Averyanov, the commander of Unit 29155. He stayed at the HQ address for the whole day, and after 5 p.m. he began calling all his colleagues in sequence, presumably to inform them that he was back for good.
On 31 October, Egor Gordienko did drive to the airport after all. However, he did not to take his return flight to Geneva, but to pick up his family, who were also returning home. The family’s names on the 1 December run status website would remain without run-times.
It is not exactly certain why Gordienko left suddenly on 25 October 2018. However, it is almost certain that the premature departure was triggered by the waterfall of disclosures on the identity and modus operandi of the clandestine team he was a member of. Only a couple weeks earlier, Bellingcat had identified his colleagues, “Boshirov” and “Petrov”, as Col. Chepiga and Dr. Mishkin, and days earlier his direct superior “Fedotov” had also been outed as Denis Sergeev. And earlier that same day, we had published a lighter story: a case study on how we were able to exactly chrono-locate a 2014 photograph Col. Chepiga had posted from Prague. Little did we know then that Egor Gordienko, a.k.a. “Georgy Gorshkov”, had been in Prague on that same day.
The Search for Gordienko
Our search for the real identity of “Gorshkov” was one of the longest and most difficult GRU identification projects. We became aware of a GRU officer traveling under the alias of “Georgy Gorshkov” in October 2018. This became possible following the discovery of another senior GRU officer, “Sergey Fedotov”, who had traveled to the United Kingdom during the time when Sergey and Yulia Skripal were poisoned with Novichok.
Using a leaked offline database of flights of Russian citizens in the 2014-2016 period (available as a torrent download from a number of Russian websites), we searched for co-travelers of “Fedotov” having similar passport number series. One of the persons we identified was “Georgy Gorshkov” born 2 February 1977, who had flown with ‘Fedotov” to and from Bulgaria during the time Emilian Gebrev and his son had been poisoned in April 2015.
“Gorshkov”’s passport differed in only the last two digits form “Fedotov”’s and after their Bulgarian operation, both had returned to Moscow on the same flight from neighboring Serbia.
We then tried to obtain a copy of “Gorshkov”’s passport file from a whistleblower with access. We were informed that no such passport file existed, which is consistent with our understanding that Russian security services had begun purging passport files of cover identities following our disclosure of the identities of Col. Mishkin and Col. Chepiga.
We were able to obtain a copy of “Gorshkov”’s Russian border crossing records from a different whistleblower. These also contained a poor-quality scan of his latest passport photo. We discovered that the border-crossing records had been meddled with, likely in order to frustrate a possible external investigation.
Due to the fact that we had a copy of “Gorshkov”’s travel records from the 2014-2016 flight database, we were able to compare the two sets and identified a pattern of data manipulation: all travel records during the Bulgarian operation time-frame had been fast-forwarded three years into the future, showing 2014 trips as having occurred in 2017, and so on. We knew that the correct dataset was the one from the offline flight database, as it had been leaked in 2016, before our identification of the first member of the clandestine GRU team.
After reverse-engineering the border crossing records to match the non-manipulated offline-data set, we found that “Gorshkov”’s last trip under this cover identity was the return trip from the second Bulgarian trip in 2015. Unlike all other members of Unit 29155 identified by us, he never traveled in 2016, 2017 or 2018. This outlying status made us believe he may have been “de-commissioned” from active service or, indeed, might have died.
Our standard approach to identifying the real identity of GRU officers brought no results. There were no people with the same first name and birth date as “Gorshkov” registered to any Moscow addresses known to be linked to GRU or Spetsnaz bases. We searched for any similar combinations of names and birth dates but to no avail. The identification project for “Gorshkov” had come to a dead end.
Nearly a year later, after our positive identification of Gen. Andrey Averyanov as the commander of unit 21995, we identified his telephone number via a Moscow car registration database leaked in 2018. We then obtained Averyanov’s call records from a whistleblower working at a mobile operator.
While analyzing his records we identified a number that, according to the caller-id app GetContact, belonged to a person named Egor Gordienko. We looked up this person’s name in an offline Russian residential database, and found four Moscow residents with this name combination. None of them were registered at the known GRU addresses, but one of them had a birth date of 2 February 1979. The similarity between the birth dates of 2 February 1977 (Gorshkov) and 2 February 1979 (Gordienko) and the overlap between the first letters in the name led us to the working hypothesis that Gordienko is in fact be the officer behind the “Gorshkov” alias.
At this point, we obtained the border-crossing data for Egor Gordienko, which contained a recent photograph. A facial comparison between this photo and “Gorshkov”’s photo gave us a sufficiently high match factor to conclude this was the same person.
