Exclusive: Inside an infamous Russian spy unit’s first bombing in NATO

In November 2011, GRU Unit 29155 blew up an ammunition depot in Lovnidol, Bulgaria, containing artillery destined for Georgia. It was the first known terror attack perpetrated by the team of hitmen and saboteurs who would later poison Sergei and Yulia Skripal in England, a Bulgarian arms dealer in Sofia, and blow up a host of other storage facilities and buildings across NATO territories. These operations killed or wounded dozens of civilians and led to the expulsion of Russian diplomats. But now The Insider has obtained travel records and leaked correspondence from members of Unit 29155 that points to their culpability in the inaugural attack in Bulgaria – and partly answers the question of why so many of these operatives have all gone on to occupy high-profile political positions in Vladimir Putin’s Russia.

• 1.The Itinerant Commander
• 2.Bombs in Czechia, Blasts in Bulgaria
• 3.The Lovnidol Bombing
• 4.Repeat Offenders
• 5.The Vrbětice Bombing
• 6.The Talented Mr. Averyanov

The authors thank Der Spiegel for their contribution to this investigation.

RU

It started with a contest.

The Russian spies were to invent their own remote-controlled detonators. They also had to devise disguises for the triggers. Over the course of four days in a mosquito-infested guesthouse across the road from the infectious diseases hospital in Krasnodar, southern Russia, they hid their inventions in the casing of a WiFi router, within an apple juice container and inside a cell phone. In the end, everyone won. Three bespoke detonators were used to blow up a shipment of Soviet-era artillery shells made in Bulgaria and bound for Georgia, across the Black Sea.

The bombing represents the first known act of war by Russia against a NATO and EU member-state, evidence of which The Insider can reveal here for the first time. The operation is significant because it served as a debut for an elite group of saboteurs attached to Russia’s military intelligence service, known as GRU Unit 29155. The unit would go on to carry out the high-profile poisonings of GRU defector Sergei Skripal and a Bulgarian arms dealer, an abortive coup in Montenegro, and a spate of similar attacks on weapons and ammunition depots across Eastern Europe between 2011 and 2015.

Each black op was masterminded by a man who has come to earn the personal trust and patronage of Russian President Vladimir Putin – so much so, that Gen. Andrey Averyanov, 56, the commander of Unit 29155, has now inherited a sizable chunk of the empire that until recently belonged to Evgeny Prigozhin, the former Wagner mercenary chief whose private jet was blown up in August following his own failed insurrection in Russia.

The Insider and Bellingcat have written extensively about Averyanov over the past few years, although the full extent of his prior clandestine activities is still emerging through a combination of leaked data and investigative journalism. This includes emails, obtained exclusively by The Insider and data from Unit 29155 burner accounts containing memos prepared for Averyanov by his GRU saboteurs with photographic attachments showing the devices they constructed to carry out the Bulgaria bombing.

“It all fits neatly in the aggressive covert action posture of the GRU and other Russian intelligence agencies,” a former senior Western intelligence official told The Insider after being shown the findings of this investigation. “Likewise their penetration of the European critical infrastructure, which in itself is a form of Russia’s preparation for war.”

Ruthless, cunning and micromanagerial, Averyanov’s past is still very much a matter of the present as new information is revealed showing his culpability in any number of kinetic operations all over the world. There is also evidence that he has used the resources of his service for personal purposes, starting with his fondness for Land Rover SUVs, a new one of which Averyanov buys every three years and whose average sticker-price, upwards of $50,000, exceeds his annual on-paper salary as a GRU officer. He’s also got a lead foot, wracking up recidivistic fines for speeding, including at 50 miles per hour above the limit, which he pays under his legal name. These driving violations have allowed The Insider to reconstruct in vivid detail Averyanov’s movements throughout Russia over the past eight years.

Leaked emails also show he has had multiple simultaneous extramarital affairs with women younger than his 34 year-old daughter, Alexandra, for whom he threw a Hollywood-style wedding in 2017. At least three of them appear in his subordinates’ contact lists with their names following “A.A.,” Averyanov’s initials.

One of Averyanov’s young former mistresses, whom we’ll call “Tatiana,” told The Insider that the GRU commander plied her with expensive items such as iPads, luxury watches and “presents from his overseas trips” while also housing her in an upscale Moscow apartment near the Kremlin. He spent thousands of dollars each month on Tatiana, just one of his many girlfriends, even outfitting her with a coterie of bodyguards and errand boys, all hand-picked by Averyanov from the ranks of Unit 29155.

Not that other members of the team went without similar perks.

Leaked correspondence also shows that other members of the unit amassed hundreds of thousands in unaccounted-for cash, all hidden away in their apartments in individual packs of $10,000 in U.S. currency. Unlike their boss, these subordinates all drive cars registered to their cover identities and wrack up hundreds of speeding tickets, which get sent to phony addresses and therefore go unpaid.

The Itinerant Commander

In the summer of 2008, Russia’s Foreign Ministry filed a visa application for Averyanov, then a colonel in the GRU, with the Embassy of Norway in Moscow. As of that autumn, he was earmarked to become Russia’s new assistant military attache in Oslo following prior stints as an intelligence officer under diplomatic cover, including as a junior attache in the Russian Embassy in Warsaw in 2004. The Norwegian Department of Diplomatic Affairs promptly processed the visa application and a working visa was issued to the prospective new arrival to Russia’s mansion-sized mission in Oslo.

Averyanov never showed up.

Instead, as publicly accessible Russian corporate records show, he became the commander of a newly reconstituted Unit 29155 following a 2008 purge and modernization of Russia’s armed forces implemented by Russia’s then-Defense Minister Anatoly Serdyukov just after the end of the Russia-Georgia war. Averyanov was recruited to helm a team of mostly young operatives, some 60 men in total, from the GRU and Russian Spetsnaz (Special Forces) for offensive sabotage operations abroad.

All were given cover names and fake passports, printed in consecutive order, in a stunning lapse of tradecraft that made the eventual exposure of most if not all members of Unit 29155 by The Insider and Bellingcat far easier.

Russian border-crossing data obtained by The Insider shows that Averyanov’s first trip outside Russia using his rather uninspired new identity, “Andrey Overyanov,” was in September 2009 to Dushanbe, the capital of Tajikistan. That visit coincided with a surge in tensions between Russia and Tajikistan over the terms of Russia’s continued use of its 201st Military Base in Dushanbe where the GRU maintains its own Spetsnaz battalion. In the next year, “Overyanov'' would take three more trips: to Warsaw (September 12, 2010), Belgrade (November 19-29, 2010) and Chisinau (March 3-11, 2011), the last overlapping with then-U.S. Vice President Joseph Biden’s visit to Moldova.

Emails from a previously hacked mailbox belonging to an aide of Averyanov show that shortly after Averyanov returned from Moldova he flew with four subordinates to Krasnodar, information The Insider was able to corroborate by examining the relevant flight records. It was here that the plot to blow up the Bulgarian ammunition consignment was formulated and a troika of Averyanov’s subordinates were tasked with a friendly competition to come up with the devices to do so. They were Maj. Vladimir Moiseev, Capt. Alexey Makeev and Col. Victor Maltsev, the latter two combining their work for Unit 29155 with teaching positions at the GRU’s Military-Diplomatic Academy in Moscow.

The three finished remote detonation devices, along with proposed disguise packaging.

By the end of the retreat, each of the three unit members had developed their own version of an operational remote detonator, complete with full technical specs and photographs of what appeared to be the underlying infrastructure for all of the prototypes: a do-it-yourself electronic circuit board modeled on an automobile alarm fob. All three were shoddily assembled, with loose wires and ample use of scotch tape.

“According to its design features, this product has a mechanical clock mechanism for long-range cocking and a safety release mechanism, which ensures safety when working with the device at all stages,” Moiseev wrote Averyanov in a document titled “Appendix No. 1.”

Moiseev went on to provide the range of the detonator at 300 to 700 meters and to give the time window for detonation after it was activated: between 5 and 55 minutes. “The product is ready for deployment,” he wrote to Averyanov.

Report from Maj. Vladimir Moiseev to Andrey Averyanov, one of the three spies who manufactured remote-controlled explosive triggering units

Report from Maj. Vladimir Moiseev to Andrey Averyanov, one of the three spies who manufactured remote-controlled explosive triggering units.

Product Description

The product is designed for the mining of mobile and stationary objects.

Tactical and Technical Characteristics

Type ............................................ Radio-controlled

Range, m ...................................... 300-700

Mass, kg:

Control device .............................. 1

Executive device ............................ 0.15

Explosive device mass ...................... 2.8

Dimensions, mm:

Executive device ............................ 70x70x40

Executive device with charge ............... 400x110x75

Power supply .................................. 1.5V - 1 pc., 9V - 1 pc., 12V - 1 pc.

Remote arming mechanism ..................... Mechanical, clockwork

Time of remote arming ......................... From 5 to 55 minutes

Principle of Operation

In the transport position, the contacts of the initiator circuit are open with the safety switch. The time of remote arming is ensured by the operation of the mechanical timer; the contacts of the initiator circuit are fixed on the rotating parts of the timer.

When the device is installed, turning the handle of the timer sets the required time for remote arming; the safety switch is set to the combat position corresponding to the red triangle. When the power source of the control device is connected, the auto alarm automatically switches to the working position.

After the time of remote arming elapses, the contacts of the initiator circuit close, and the device enters the standby mode for the detonation command.

Upon receiving the command from the control device, the transistor switch of the executive device connects the power source to the initiator circuit, and the device explodes.

Conclusion: The product is ready for use.

Major V. Moiseev

Bombs in Czechia, Blasts in Bulgaria

Six months after the Krasnodar retreat, in October 2011, thousands of artillery rounds for Soviet-era weapons were being readied for shipment to Bulgaria from a Czech ammunition storage facility in the tiny village of Vrbětice, home to only a few hundred people, in the Zlín region of eastern Czechia. The facility was owned by a subsidiary of the Czech Ministry of Defense but it had been rented out on a long-term basis by the Czech arms trading company IMEX, which was storing Soviet-era munitions scrapped by the Slovak Army a few years earlier on behalf of clients such as Bulgaria’s EMCO. As former Warsaw Pact nations, Czechia, Bulgaria and Slovakia still had ample supplies of Soviet-era weaponry and ammunition, a good deal of which all three countries have since donated to Ukraine for its defensive war against Russia.

Three years earlier, however, Moscow had invaded another post-Soviet state, Georgia, in a five-day summer war fought over the breakaway regions of South Ossetia and Abkhazia, which were slowly turning into vassal states of Russia. Russia technically won the war and hostilities came to an end in a negotiated ceasefire in August 2008, which accorded Russia de facto control over South Ossetia.

Yet the Kremlin knew that despite its destruction of much of Georgia’s weapons arsenal, the Georgians were far from resigned to the new status quo and their army was quickly rearming. Just a year after the ceasefire, the Russian Army Chief of Staff Nikolay Makarov made the alarmist claim that “Georgia’s military potential is now higher than last August.” Makarov went on to say that the United States was supplying Georgia with weapons and ammunition “through somebody else’s hands.”

Russia had specific ideas of who these hands belonged to. Putin directly accused the Ukrainian government, then headed by reformist President Viktor Yushenko, of supplying weapons to Georgia. The GRU, however, was aware of another supplier in Eastern Europe: Bulgaria.

According to former Georgian government officials, arms contracts for Tbilisi contracted severely after the war with Russia. “Remember, also, this was the time of the Obama ‘reset’ with Putin,” Giorgi Kandelaki, who served as MP in Georgia's parliament from to 2020, said, referring to a U.S. effort to thaw relations with the Kremlin at the onset of a new presidential administration. “So Georgia sought sellers wherever we could find them.”

“Bulgaria was one of the first countries to give us export licenses and sell us weapons,” a former Georgian official familiar with the Georgian Ministry of Defense’s procurement history, told The Insider, speaking on the condition of anonymity. “What kind of weapons and ammunition we were importing, unfortunately, we can’t say because it's top secret by Georgian law.”

Yet the Bulgarian arms sales, which are a matter of public record in Georgia, continued in the face of express warnings by Dmitry Medvedev, Russia’s placeholder president, who threatened to ground Bulgaria’s fleet of MiG fighter jets in the event Sofia “resumes arms sales to Georgia.”

Among the munitions Tbilisi needed badly were 152-millimeter artillery shells, the Soviet standard, which had been expended in the five-day war. A major reseller of this type of ammunition in Europe was EMCO, a company owned by Bulgarian arms dealer Emilian Gebrev. In October 2011, EMCO contracted with the Czech weapons company IMEX to package several thousand rounds of the shells for shipment to Bulgaria.

A shipping report from EMCO itemizing the ammunition received from IMEX shows that in a one-month period – from October 4 and November 4, 2011 – more than 6,000 artillery rounds, of which 3,120 were the 152-millimeter variant, were shipped from Czechia to Bulgaria. These rounds, Bulgarian prosecutors alleged in 2021, had been earmarked for subsequent transfer to Georgia. (Emilian Gebrev, EMCO's owner, told The Insider he had not committed the shipment specifically for export to Georgia but concedes that the GRU would have likely suspected the shipment would end up there.)

“The key thing to know about this variant is that the ammunition and the propellant are kept together in one one package, which makes each container much more volatile,” an active-duty U.S. Army artilleryist told The Insider. “152 millimeter shells are harder to transport logistically, but they’re also more idiot-proof since you don’t have to handle ammunition and propellant separately.” But the same quality that makes them more convenient on the battlefield also makes them more combustible in storage – a fact Unit 29155 was clearly eager to exploit.

As the Czech ammunition was packed and readied for shipment in several batches, Averyanov’s team began arriving from Moscow to airports near Vrbětice. By all accounts, it was there that they’d plant their explosives, ready for remote detonation.

Unit 29155 members always arrive at the locations of their intended sabotage operations in staggered groups. The first arrived at Bratislava Airport in Slovakia, a mere 90-minute drive from the IMEX storage facility, on October 10. This group included “Nikolay Kononikhin,” who was previously identified by Bellingcat and The Insider as GRU officer Lt. Col. Nikolay Ezhov; and “Sergei Ryzhikov,” whose real identity, The Insider can now reveal, is that of GRU officer Lt. Col. Sergey Romanov. Both men remained in Slovakia until October 20, giving them ten days for unrestricted vehicle travel into and out of Czechia, which, like Slovakia, are both within the Schengen zone of free and unrestricted travel for up to 90 days, meaning a Russian who obtains visa entry to one requires no customs checks in any other.

On October 12, two days after Ezhov and Romanov, their boss arrived in Europe too. Averyanov landed at Vienna International Airport using his “Overyanov” cover name. Metadata from his burner phone shows that he crossed into Czechia the next day, likely reconvening with his advance team at or near Vrbětice, a little over a two-hour drive from the Austrian capital. Travel records show Averyanov flew back to Moscow on October 18, again via Vienna.

The next operative to touch down was Col. Alexey Kapinos, who landed in Bratislava on October 21, using his diplomatic passport and his real name. Kapinos had previously served as Russia’s deputy military attaché in Ukraine from 2011 to 2014. Historical travel data and telephone metadata reveal he was also an original member of Unit 29155 seconded to the Russian Embassy in Kyiv under diplomatic cover two years before his unit attacked Bulgaria. Kapinos left back for Moscow on October 28.

Last to arrive were “Rustam Dzhamalov,” a senior GRU officer named Col. Rustam Dzhafarov, and “Ruslan Boshirov,” whose real name the world would come to know as Col. Anatoly Chepiga following his role in the poison assassination attempt of Sergei Skripal, a GRU officer turned British agent, along with Skripal’s daughter Yulia, in Salisbury, England in 2018. Dzhafarov and Chepiga reached Bratislava on October 22 and left on October 25, which happens to be the day the largest EMCO consignment of 152-millimeter shells were shipped from Czechia to Bulgaria by cargo truck.

How the GRU officers traveled to the depot in Lovnidol in 2011

The Lovnidol Bombing

Border-crossing data shared with The Insider by Belarusian cyber partisans, a “hacktivist” group opposed to the current Belarusian government, show that at 9:43 a.m. on November 10, 2011, two of the members of Unit 29155 who’d traveled to Vrbětice – Ezhov and Romanov – crossed the Belarusian-Ukrainian border at the Novye Yarolovichy checkpoint. They headed south in a Nissan Tilda registered in the name of Romanov’s fake persona, “Sergey Ryzhikov.” From there, their movements over almost two weeks are as-yet unknown, but their trajectory and timeline are consistent with a next-day arrival in Bulgaria.

On November 12, the Bulgarian village of Lovnidol, located in the middle of the country not far from its one-time capital Veliko Turnovo, was shaken by a huge explosion. The ammunition storage depot near the village, where EMCO had stored the 3,120 152-millimeter shells it had recently received from Czechia, went up in flames. Secondary explosions continued and fires burned for days after the initial blast, making it impossible for rescue and salvage teams to approach the site until November 22.

Screengrab from the moment of one of the serial explosions, caught by Bulgarian TV crews arriving near the scene on 12 November 2011

Five months after the incident, Bulgarian investigators discovered an unexploded IED approximately 200 meters from ground zero. The unit retrieved was described as “an object resembling plastic explosive, covered with polyethylene wrapping and with an attached aluminum cylinder with exposed wires sticking out.” The forensic analysis ordered by the police concluded that the improvised explosive device did not fully explode due to a fault in the triggering mechanism “likely” due to “insufficient electrical current or improper connection of the capsule detonator.” The experts also pointed to the irregular craters at the explosion site as evidence of partial detonation, adding that if the full charge had exploded a single, round-shaped crater would have been formed.

One of the unexploded packets of plastic explosive found near the explosion site.

Ten days after the blast, on November 23 2011, the Nissan Tilda carrying Ezhov and Romanov reached the safety of Russian soil via the Hoptivka border crossing near Kharkiv, a city in northeast Ukraine.

Despite the fact that Bulgarian investigators discovered not long after the incident evidence that the massive explosions were caused by “the embedding of an improvised explosive device,” three years after the explosions, Bulgarian prosecutors closed the investigation due to an absence of evidence connecting foul play to any perpetrators.

Bulgaria will likely have a national security interest in renewing this cold case, although it shouldn’t be the only country to do so.

The distance traversed from Vrbětice to Lovnidol is over 1,200 kilometers, and the route the truck took bypassed four European countries and their capitals – Bratislava, Budapest, Belgrade and Sofia – putting tens of millions of lives at risk if one of the detonators the GRU operatives MacGyvered together went off prematurely. Nevertheless, Hungary and Serbia have long maintained close ties to the Kremlin and last month Slovakia elected a coalition government headed by a pro-Russian populist party.

Repeat Offenders

The 2011 sabotage operation in Lovnidol is the first of its kind in a NATO and EU country that can be convincingly attributed to Unit 29155. But it was hardly the last. This same band of operatives would be responsible for destroying other arms and ammunition depots across Bulgaria and Czechia over the next four years, going so far as to blow up the very IMEX storage facility in Vrbětice in 2014 where Averyanov’s operatives had planted their remote-detonated IEDs three years earlier. Some of these attacks killed and wounded Bulgarian and Czech citizens. Both Sofia and Prague have publicly blamed Unit 29155 for many of these attacks and expelled Russian diplomats in retaliation, prompting tit-for-tat expulsions of Bulgarian and Czech diplomats by the Kremlin. In April 2021, Bulgaria’s then-Prosecutor General Ivan Geshev even hinted at Russia’s culpability in the Lovnidol explosion, stating, “There are sufficient data to make a justified supposition about the connection between the poisoning of Emilian Gebrev, the explosions at Czech munitions depots in 2014 and four similar incidents at factories and depots in Bulgaria between 2011 and 2020.”

However, suspicious incidents in which buildings have mysteriously burst into flames remain officially unsolved, despite more and more evidence coming to light implicating the same GRU perpetrators.

For instance, on June 5, 2012, storage facilities at the Stralzha-Marash depot on the main thoroughfare to the Black Sea in Bulgaria suffered a series of explosions similar to those in Lovnidol. These depots, too, were storing ammunition owned by the Bulgarian-owned Sage Consultants, an EMCO competitor, and pre-sold to and destined for Georgia. The blasts that destroyed them were so powerful that Bulgaria’s seismic labs registered a 1.5 Richter-scale earthquake in the vicinity. Three people working at the depot were killed and another 18 seriously wounded. Moreover, an additional 150 people from the neighboring villages had to be evacuated due to the fire spreading and the danger of secondary explosions from ammunition igniting.

Similar to the Lovnidol affair, years of detective work by Bulgarian prosecutors found no evidence of sabotage and instead indicted three officers of the company managing the depots on charges of negligence in the safe-keeping of hazardous matériel, the implication being this was an industrial accident.

Yet circumstantial evidence obtained by The Insider suggests such an explanation may be incorrect and points to involvement by Unit 29155 in yet another act of sabotage.

Vladimir Moiseev, one of the inventors of one of the three remote-controlled IED detonators presented to Averyanov in 2011, had made plans to be in Bulgaria on the day the Stralzha-Marash depot blew up. Moiseev made travel plans under the guise of a marine insurance specialist named “Vladimir Popov,” the same fake name he used to execute the failed Montenegro coup in 2015. Records examined by The Insider show Moiseev had planned to drive from Ukraine’s port city of Odessa to Varna, a city on Bulgaria’s Black Sea coast, then to fly to Moscow from Sofia on June 6, the day after the explosion.

For some reason, Moiseev’s plans changed. Just two hours after the Stralzha-Marash depot went up, he purchased a last-minute plane ticket to fly from Odessa International Airport to Vnukovo Airport in Moscow. Travel data shows Moiseev indeed arrived in Russia on the night of June 5, bypassing Bulgaria.

He returned to Bulgaria in the company of three other operatives from Unit 29155, this time in March 2015, just days before yet another arms depot was destroyed. Traveling this time by plane from Istanbul to Varna, again as “Vladimir Popov,” Moiseev arrived on March 6 and stayed in the country for five days. Following the unit’s customary tradecraft of staggered arrivals and departures, Moiseev assumed command from three associates from Unit 29155 who had reached Bulgaria a week earlier, on February 25, and remained for 11 days. One of them was Ezhov, the saboteur involved in the Lovnidol operation. The other two were Col. Ivan Terentiev (traveling as “Ivan Lebedev”), and Lt. Col. Alexey Kalinin (“Alexey Nikitin”).

According to Unit 29155’s leaked correspondence, which The Insider has examined, Terentiev was then Averyanov’s deputy commander.

On March 21, ten days after Moiseev’s departure, more than 2,000 missiles and anti-tank grenades ready for export to Ukraine blew up at the Iganovo depot near Sopot, the city where Bulgaria’s largest arms manufacturer is based. Emil Kabaivanov, then the mayor of the nearby town of Karlovo, described seeing pillars of fire reaching more than 650 feet into the sky.

All evidence gathered by police from the aftermath at Iganovo was transported for safe-keeping to a police-forensic center in Sofia, pending an investigation. Then the evidence burned up.

In the early morning of May 31, 2015, an unexplained fire consumed the building that housed the forensic center. Perhaps uncoincidentally, another member of Unit 29155, Egor Gordienko (traveling as “Georgy Gorshkov”) arrived in Sofia two days before the fire. Gordienko drove to Belgrade, Serbia on May 30, mere hours before the fire started.

“The GRU, like other Russian special services, continues to be preoccupied with fighting Ukraine,” a senior Western intelligence official told The Insider. “And brazen Russian sabotage capabilities on EU or NATO territory, in the context of the war, is one of the key intelligence priorities of our community.”

Even more brazen was Unit 29155’s return to its original crime scene.

The Vrbětice Bombing

On October 16, 2014, the very same IMEX storage facility in Vrbětice where three years earlier Averyanov’s team laced the 152-millimeter shells with plastic explosives, blew up again – Warehouse No. 16, to be exact, which kept 50 tons of ammunition – killing two IMEX employees. A second explosion occurred in Warehouse No. 12 weeks later, on December 3. As then-Czech Prime Minister Andrej Babiš stated at a press conference in April 2021, there was “reasonable suspicion” to suggest Unit 29155 was responsible. Prague then expelled 18 Russian diplomats.

Czech media also confirmed that two of the unit’s most notorious operatives, the aforementioned Anatoly Chepiga and his fellow Skripal poisoner, Alexander Mishkin, had sought access to the IMEX facility both days before the October 16 blast as well as on the day of it. Chepiga and Mishkin’s access to Warehouse No. 16 was facilitated by Nikolay Shaposhnikov, an employee of IMEX. Czech journalists further established that Shaposhnikov and Averyanov were friends; The Insider and Bellingcat even placed the two together in Lisbon just prior to the October 16 explosion.

Shaposhnikov is a former Soviet army officer who fought in Afghanistan and was later stationed in Czechoslovakia at the tail-end of the Cold War. He is very close to Alexei Kapinos, the former Russian deputy military attaché in Ukraine and Unit 29155 member. Their relationship was solidified between 2009 and 2012 when Kapinos was attached to the Russian Embassy in Kyiv and Shaposhnikov was a representative of IMEX to Ukraine. The two were evidently inseparable and jointly attended meetings with Ukrspetzexport, Ukraine’s state arms-trading company. “I was a bit puzzled as to why Shaposhnikov always insisted that a Russian embassy representative attend our negotiations,” said a former employee of Ukrspetzexport.

It is therefore highly likely that Shaposhnikov used his longstanding ties to Unit 29155 to also facilitate the sabotage squad’s entry to the Vrbětice location in 2011, leading to the Lovnidol attack.

“For years, Unit 29155 has been responsible for acts of war all across NATO countries in Europe and our response has been sanctions and spy expulsions from embassies,” Marc Polymeropoulos, the former chief of clandestine operations for Europe and Eurasia at the CIA, told The Insider. “Maybe it's time to realize the Russian playbook demands a more robust means of deterrence and retaliation.”

The Talented Mr. Averyanov

Andrey Averyanov’s career highlights have not gone unrewarded by Vladimir Putin, even as his other plausibly deniable instruments of transnational chaos and carnage have been dramatically removed from the playing field.

On July 31, 2023, at a roundtable on the last day of the Russia-Africa Summit in St. Petersburg, Putin presented his team of officials to the visiting African leaders. Conspicuously absent from the Russian side of the table was Prigozhin, whose private military company (albeit one financed by the Kremlin to the tune of tens of billions) had played a crucial role in bringing many of the attending African states back into Russia’s fold. In his place, a new face was presented to the African leaders: a burly-looking, balding middle-aged man who only introduced himself as “Averyanov, Andrey – Security.”

Averyanov’s attendance was notable for two reasons.

First, following Prigozhin’s abortive coup in late June, the Wagner Group was in the process of being steadily dismantled. The majority of its fighters were amnestied and exiled, sent first to tent encampments in Belarus or incorporated into the conventional Russian military’s order of battle. Prigozhin’s empire, of which the African continent was a large and lucrative constituent part, was similarly being ripped apart.

Putin clipped the oligarch’s wings in June; then he blew the oligarch’s jet out of the sky in August, just 62 miles north of Moscow.

In the weeks prior to Prigozhin’s death, Averyanov was busy traversing Africa in a bid to take over Russia’s relationships with local leaders, which had previously been Prigozhin’s purview. Simultaneously, Prigozhin himself was scuttling from Mali to Sudan to the Central African Republic to try and forestall the takeover of his portfolio by the Unit 29155 commander. In fact, it was on August 23, the day after Prigozhin returned to Russia from Africa, that he was assassinated.

Averyanov’s elevation may have coincided with Prigozhin’s loss of altitude but it far surpasses the heights ever attained by the slain Wagner chief. He is now deputy chief of the GRU and Putin’s confidant overseeing military and hybrid operations in Africa, East Asia and the Middle East. One of those continents has experienced a series of violent putsches, completed or abortive, in Mali, Niger, Burkina Faso and Chad resulting in pro-Russian juntas coming - or attempting to come to power, while another is currently engulfed in grisly war between Israel and Hamas, which threatens to become a regional conflagration and possibly distract or weaken Western support for the ongoing war in Ukraine.

Nor is Averyanov the only member of Unit 29155 who saw his fortunes rise in the course of a decade of bold and bloody covert action. Many of the other black-ops personnel who participated in these terror attacks against NATO and EU countries have been promoted to high-ranking political positions, underscoring Putin’s dependance on siloviki, strongmen chiefly consisting of hitmen and saboteurs, for sustaining the machinery of his domestic repressive regime and, by extension, his hold on power.

Four of the original Unit 29155 members who took part in the bombings in Bulgaria were rewarded with high-profile federal jobs in Russia’s Far East.

Ivan Terentiev, the Averyanov deputy who took part in the Iganovo depot operation, is now Putin’s chief federal inspector in the Sakhalin region, which includes the Kuril islands, an archipelago disputed by Japan and Russia, but under the latter’s administration since 1945. Terentiev has also been promoted to major general in the GRU.

Terentiev, left, speaks at a public event in Yuzhno-Sakhalinsk in 2022. Official event photo.

Nikolay Ezhov, the spy involved in every Unit 29155 operation in Bulgaria between 2011 and 2015, is now chief federal inspector of the Magadan region in Russia’s far east. Ezhov is today a full colonel.

Niklay Ezhov, center, in a group photo with local government officials in Magadan. Offical government photo.

Rustam Dzhafarov, a veteran of the Lovnidol bombing, has been promoted to first deputy of Putin's plenipotentiary in the Far East federal district, encompassing almost half the country’s territory. Dzhafarov is a major general.

Rustam Dzhafarov attends a meeting with the local government of the Republic of Yakutia (Sakha) in 2016.

Despite having been serially compromised by Bellingcat and The Insider for his black-ops activities, Vladimir Moiseev remains an active member of Unit 29155 and was most recently deployed in the early days of the war as part of an advance assassination team in Ukraine seeking to kill Ukrainian political leadership and facilitate the country's invasion and occupation. What was planned to be a one week assignment for Moiseev and a few of his comrades, turned to be a deployment of more than a year. Moiseev is a colonel.

Vladimir Moiseev (right), appearing as "Vladimir Popov" at a book-signing of "Bayonets and combat knives of Serbia, Montenegro and Yugoslavia", a book by Serb author Branko Bogdanovic (left), in December 2016, less than two month after his unsuccessful attempt to lead a coup in Montenegro.

Finally, Sergey Romanov, another colonel and a participant in the Lovnidol operation, has served for nearly a decade as Russia’s deputy trade representative to Thailand, where he remains now.

Sergey Romanov attending Thai-Russia Chamber of Commerece session in Bangkok, Thailand, in 2016. Photo by the Thai-Russia Chamber of Commerce.