Unmasking GRU Unit 29155: Christo Grozev explains how he helped expose the Russian spies creating chaos in the West

16988

Investigation topic

GRU illegals

18 materials

Who are the Russian GRU spies from Unit 29155 creating chaos in the West for over a decade? Who's taking over Yevgeny Prigozhin's Wagner fiefdom in Africa? And why do Russian agents text their wives to plough millions of dollars into real estate?

Simon Ostrovsky sat down with The Insider's head of investigations Christo Grozev for an exclusive interview answering all those questions — and more. Grozev, for the first time, exposes details of a Kremlin plot to assassinate chess Grandmaster Garry Kasparov, details how successive investigations managed to identify the GRU unit and its agents, and explains why his work irritates Putin so severely that it led to him being placed on the Kremlin’s kill list.

Simon Ostrovsky: Christo Grozev, head of investigations at The Insider, Thank you for sitting down with us today. We're going to be talking about the unit that you've never heard of, but you should know more about — Unit 29155 of the Russian Military Intelligence Service [the GRU].

What’s the difference between the FSB and the GRU, the agency that this unit belongs to?

Christo Grozev: The main difference, nominally at least, is that the GRU should only work abroad. The FSB, which is an heir to the KGB, should only work domestically and in countries that were part of the Soviet Union before. There's a little bit of competition between the two for some locations, for example, the former Soviet countries. Both of them are trying to be the dominant intelligence power. Also, even parts of Russia that are considered to be fringes, such as Dagestan and Chechnya. You would see GRU officers also occasionally go there to conduct assassinations, but other than that, the main difference is [the] FSB [being a] domestic [agency]. For example, the assassination attempts on political leaders in Russia or opposition leaders in Russia, such as [Alexei] Navalny and Vladimir Kara-Murza, were conducted by the FSB, whereas if the same people need to be targeted abroad, as we have seen in other investigations of ours, this would be the GRU who would do that. This unit is actually doing some of the most prominent attacks against the West and against what Putin perceives to be his enemies.

SO: Unit 29155. Who are they?

CG: 29155 is a very large unit within Russia's military intelligence. Its official nominal purpose is to train other people in the business of explosions, sabotage, and assassinations. And that encompasses about 400 people. Within this unit, there is a subunit with no name. Sometimes it's called K2, sometimes K200, but it's a subunit of 29155 that does the international operations for the GRU. And these include the same sabotage operations, explosions at munitions facilities of the enemy — and the enemy is essentially everybody but Russia — and assassinations. And this unit trains people to be what is known as illegals. However, a different type of illegals. The illegals are people that you would be familiar with from a show like The Americans: Russians who live under a fake foreign identity as Canadians or South Americans for all of their adult lives abroad, and they stick to a legend or cover story of who they are. The people within the subunit of 29155 are short-term illegals. They are sent for a couple of weeks abroad and their fake identity is Russian, but it's not their [permanent] identity. But many of them live for years in Russia under a fake identity. So it's a very weird situation of “illegals” [also being present] within Russia.

So these people have to have a social media presence under the cover name in Russia. They sometimes have to get education under a cover identity. One of them, for example, is a director, a film director under his fake identity. And he needed that because he needed to travel and spend some time infiltrating the artistic circles in Barcelona, in Spain. Another one has an identity as a trained insurance broker, and that's a fake name. But he lives in Russia and travels abroad under that fake identity. So about 70 of these gems were created since Putin decided that the world is an enemy. That was about 2007, 2008, and these were big investments in creating these fake identities. And these 70 people have traveled around the world for the last 15 years, as I said, blowing up bridges and blowing up munition facilities, killing people and infiltrating opposition diaspora groups of Russia. So that's who they are.

These 70 people have traveled around the world for the last 15 years, blowing up bridges and munition facilities, killing people and infiltrating opposition diaspora groups of Russia.

SO: I mean, it feels like you were almost in there when they were making all of these decisions and creating this group. How do you know so much about that?

CG: The reason we became so knowledgeable of it is because my team and I started looking at what happened with the Salisbury poisoning in the UK in 2018, where Sergei Skripal and his daughter were poisoned and a completely random, innocent British woman was assassinated — was killed by these people because they were so careless as to leave one of the perfume spray bottles, which was used to carry the poison. So we started looking at this unit then. We had a couple of preceding investigations with Roman Dobrokhotov, which pointed to the existence of such a unit. We found who they really were, the real identities.

And then by just doing simple things like cross matching their travel records with other people who traveled with them on the same booking and getting access to their phone call metadata and seeing whom they call most frequently. We discovered this universe of about 70 assassins who talk amongst each other, who call each other on Christmas or New Year's Eve in Russia. So on the 23rd of February, Defender of the Fatherland Day, you have to compete with the others to be the first one to call the boss.

So we knew literally who the boss is. And who was his boss’s boss. Because of this confluence of calls early in the morning because they all wanted to be first. But more than that, they traveled on passports that were easily identifiable as fraudulent, because they were all in consecutive batches of numbers — of serial numbers. And actually, that's how we found many of them. So yes, we kind of know their life better than their wives.

We kind of know their life better than their wives.

SO: The telephone metadata, you have access to that. How do you get that kind of information?

CG: As my colleague Roman has frequently said, Russia is probably the most transparent society in the world because you can buy data on anyone, and not just on regular people, but also on spies. And it's because of the corrupt market of the law enforcement in Russia.

SO: So I guess Salisbury, the first instance of using Novichok in such a public manner was kind of the coming out party for Unit 29155. What else have they been involved in that people should know about?

CG: It’s interesting, because what happened is Salisbury exposed them, but it wasn't the first time they had done something in the public eye. It's just that people didn't know. We didn't know that there was that unit. So we found that the same group of assassins, including one of the people who had been in Salisbury, had actually been in Bulgaria three years earlier. Exactly on the day when a Bulgarian arms dealer, an arms manufacturer, had fallen ill with symptoms very, very similar to the Novichok symptoms. He had been selling weapons and ammunition to Ukraine in the early days of Russia's invasion of eastern Ukraine in 2014. But at the time nobody knew about Novichok, nor the existence of this Russian unit. Bulgarian investigators shrugged this off as arugula poisoning during a dinner.

Russia is probably the most transparent society in the world because you can buy data on anyone — not just on regular people, but also on spies.

SO: Arugula?

CG: Yes. And the victim who survived — barely — was yelling, saying, 'I hate arugula! I never, I would never try it!’ But the prosecutors just said, ‘No, no, he had arugula and there was a little bit of pesticide in the arugula in that restaurant, which probably explains why you felt ill.’ We have to then go back to the prosecutors. And ultimately, these three people are now on Interpol's wanted list.

SO: But the armaments were sold to Ukraine anyway.

CG: The armaments were sold to Ukraine. We talked to people that were involved in the procurement for Ukraine at the time, and they said this guy had actually saved Ukraine in the first days of the war.

SO: So they knew who they were going after.

CG: Yes.

SO: And I think this is the same unit that was involved in targeting the Bulgarian arms industry at large with actual just straight up, you know, explosive devices.

CG: Correct.

SO: They were hidden in very clever ways. Can you tell us about that?

CG: In one particular case, we got access to the original planning blueprints of how they were going to do the remote explosions in Bulgaria. And we found that they had developed this remote detonator that was packaged in a, in a router — a Wi-Fi router. And in order for them to be able to cross borders with it without it raising alarm, the explosive detonator was, in fact, a car alarm that they had embedded in the router so that they could use the remote control for the car alarm to cause the thing to explode. And then the thing would be connected to a larger explosive and so on and so forth.

SO: I feel like I've seen that in ten movies, where somebody hits the car keys and the car explodes.

Mock-up of an explosive device packaged in a Wi-Fi router by Unit 29155 operatives

Screenshot of The Insider video interview with Christo Grozev

CG: The question is who — who copied who? Was it the Russian spies who had watched too many movies and decided to do it this way? But in this particular case, what was particularly innovative is that they had planted the explosive and this remote detonator in one country, in anticipation of the goods moving to another country. So they planted it in Czechia, and they knew that three days later, this cargo would move to Bulgaria and they'd be able to remotely detonate it without even being there and not leave a trace.

One particular attempt that they did was to hide it in apple juice — in a package of apple juice. And if I remember correctly, another one was just a computer case. Then they would just hide it in a lot of different things. But in every case, the electronics behind it were based on car alarms, simply because that is easily obtainable. And it's something they can do while being abroad and in the field, so they don't have to go back to headquarters in Moscow to get some very sophisticated electronics. They can do it in the field. And that's very important for this unit.

SO: And the photographs of this that you hacked from their emails, those are actually the mockups they made when practicing how to create these devices, right?

CG: That is correct. Each of the mockups that was delivered to the boss for approval was accompanied by a letter saying, ‘these are the specifications and the characteristics of the device.’ And all of them ended with ‘the device is ready for deployment,’ which is a spooky statement if you know what happened after that.

Mock-up of an explosive device packaged in a juice carton by Unit 29155 operatives

Screenshot of The Insider video interview with Christo Grozev

SO: This is all happening after the war in Ukraine started in 2014. Do you think the reaction from NATO sort of was proportional to what was actually happening to attacks inside a NATO member?

CG: Attacking facilities that are crucial to NATO — and any munitions storage facility is crucial to NATO — in any NATO country and killing people, is in fact an attack on the sovereignty of NATO. And I think what we are failing to see is a combination of a failure to understand what happened, because law enforcement never figured it out until now. [Now] Czech and Bulgarian prosecutors are going after Russia and the GRU as the culprit, but it didn't happen at the time. And because it didn't happen at the time, there was no public support for any confrontation with Russia — no political support to confront Russia and to ask questions or to even impose a cost on Russia. And now the war has started, so Russia has no reputation cost remaining, and they're all sanctioned out. So I feel like this attack on NATO has remained unrewarded.

SO: So Western intelligence agencies blew it, basically.

CG: I'm sure that they blew it because for at least a decade these people were going around blowing up things in Europe, Asia and America, and were leaving traces. They were asking to be caught, but nobody did.

They didn't exist in real life, yet they were getting visas, and during the visa application process, somebody should have figured out these are not real people. But more than that, they traveled on passports that were easily identifiable as fraudulent, as fake, because they were all in consecutive batches of numbers — serial numbers. Actually, that's how we found many of them. They didn't have a birth certificate. They didn't have a mother or a father.

I have to believe that if intelligence services were worth their salary they should have been able to figure that out, and not allow these people to travel. But here we go. For ten years they were traveling and blowing things up.

I'm sure that [Western law enforcement] blew it because for at least a decade these people were going around blowing up things in Europe, Asia and America, and were leaving traces. They were asking to be caught, but nobody did.

SO: So there's a new investigation into one of the latest operations that I think the public is not aware of yet. Can you tell us about that?

CG: We had a universe of about 70 people, and for about half of them we could see that they were trained in explosives. And they had traveled to places where we could tie them to particular events. But there were a few members that we had no understanding of what they were doing and where they were traveling. And one of these people we, to our consternation, found to have become under the fake identity that he was given, a member of many opposition diaspora groups, operating as human rights organizations in Europe or the U.S. And he had become an accepted member of at least two of these organizations. One was the Sakharov Center for Protection of Human Rights. And the other one was the Free Russia [Forum]. He had been invited and attended many of the sessions abroad. He'd been called to Vilnius several times, to Chisinau a few times, to Vienna for these meetings, and he'd even managed to infiltrate one of the important committees of these meetings, which was the sanction list drafting committee. So he was allowed to have a voice in who gets sanctioned…

SO: …in a commission that was choosing who to sanction in Russia…

CG: …They were proposing to governments, Western governments who would be sanctioned in Russia, which is extremely cynical. And we noticed that this particular person had traveled not to every meeting of the foundation, but particularly to ones that were attended also by one of the prominent names in the organization: Garry Kasparov, the world champion chess player.

SO: And now dissident.

CG: And now dissident, and probably one of the most outspoken critics of President Putin out there, and somebody we can clearly imagine why Putin would want to have killed. It was again a blood-curdling discovery to see this spy traveling under a fake identity, trained in the dark arts of the GRU, including assassination, to be so close to Kasparov, even in photographs. And even before we proceeded to publish this investigation, which we will, I called Garry Kasparov up and warned him that this is what has been happening.

SO: How did he react?

CG: I was surprised at how matter-of-fact of a person he is and how he was like: ‘Yeah, I knew it was bound to happen. And thank you for telling me. And here's all the data on this person that my colleagues can find, and just do your work.’

SO: Do you think that he knows his cover is blown?

CG: I think he does. Because he had traveled under a consecutive passport, or on a passport from this range. And we made public our understanding of these patterns. We know about 70 of them. Maybe there's 100. Maybe we don't know all of them, but they don't know what we don't know. They don't know what intelligence doesn't know anymore. So this generation of expensive, trained spies is disabled, and it will take a few years before Russia can generate a new generation of equally trained or better trained spies. So I think we're living in this twilight zone between two generations of assassins.

It will take a few years before Russia can generate a new generation of equally trained or better trained spies. So I think we're living in this twilight zone between two generations of assassins.

SO: Well, that's quite an achievement for you.

CG: Well, that might explain why I'm also on the kill list.

SO: How did you find that out?

CG: First of all, like Garry Kasparov,I always assumed I must be on it. But a couple of events gave me positive information. One is that actually somebody reached out from the Russian intelligence apparatus — a fan of my work, or of our work with Roman — and gave us a very clear warning that he had just seen evidence that we're on the kill list. And then Western law enforcement — and I'm not going to specify which one — but law enforcement had essentially found people with instructions on how to surveil me and Roman. And some of these people are arrested now. So that's how.

Somebody reached out from the Russian intelligence apparatus — a fan of my work, or of our work with Roman — and gave us a very clear warning that he had just seen evidence that we're on the kill list.

SO: If you and Roman Dobrokhotov are single-handedly responsible for dismantling an entire generation of Russian GRU spies, then it isn't a surprise they want to get rid of you guys.

CG: They were living a life to be envied. They were traveling around the world having unlimited credit card allowances. We've seen that during their trips abroad, which was supposed to be in the national interest of Russia, they were having parties with prostitutes. They were buying, on the credit cards issued by the GRU, clothes, expensive perfumery and jewelry. Not only for their wives, but for their lovers, for their lovers' children, which suggests that maybe that's also their children. And so on and so forth. They were living a life few Russians could afford, and suddenly they have to be stuck in a little village outside of Zelenograd near Moscow, training other people in the mud. I think that that causes a lot of anger.

SO: It sounds like you really pissed them off.

CG: Well, that's a good feeling sometimes. Late at night [I often think], ‘Have I achieved anything?’ Well, to disable a generation of killers is not a bad thing.

SO: They've accomplished a lot, but it sounds like they've also been pretty stupid in the way that they do things — using passports with consecutive serial numbers, for example. Somehow this hasn't stopped their rise through the ranks in Russia. And it seems like this unit and this unit's leader just keeps climbing the ladder.

CG: You have to be slightly better than the competition. It doesn't pay to be too good. Because if Western intelligence were idiots, why would they invest in better tradecraft than the one they had? And for 15 years they were not caught —which means we’re laughing at them [now], but they've been laughing at us. And I think the latter explains why Putin has been promoting them: because they were able to penetrate through [Western] defenses for so long.

Andrey Averyanov, head of GRU Unit 29155

Screenshot of The Insider video interview with Christo Grozev

SO: The commander of Unit 29155 was recently photographed sitting next to Putin. Can you tell me a little bit about the context of where that photograph was taken and why this is an important development?

CG: The chief commander of this unit is General Andrey Averyanov, born in 1967, in Dushanbe. And he was the founding father of this unit in its most kinetic form, in the most aggressive form in about 2007, 2008. Everything this unit has done has been credited to him. He himself liked to get his hands dirty, and he traveled under a fake identity to some of these operations, to the most important ones. This risk-taking is something Putin apparently appreciates. When Prigozhin started his mutiny, it became clear to the Kremlin, and to Putin, that he cannot trust any individual from the private sphere to be a loyal proxy for the state.

SO: Prigozhin, the leader of the...

CG: The founder and the leader of Wagner [PMC], who later found his own death after the failed coup against the military [and] against Putin that he initiated. In fact, Putin had to look around from his inner circle of siloviks, or people from the power elite of Russia, for somebody that he trusts completely — somebody who's not wealthy enough to be an independent player. It seems that he singled out Andrey Averyanov, the head of this scary unit, and he presented him — and that's how the photo and the video emerged — to the African leaders and dictators that he had gathered in Saint Petersburg for a forum as ‘the new security adviser for you guys,’ who would replace Prigozhin.

Averyanov at the Russia-Africa summit held in Saint Petersburg

Screenshot of The Insider video interview with Christo Grozev

So this guy is taking over a lot of functions, networks and connections in the Middle East and in Africa, from Prigozhin and from Wagner. They had their fingers in multiple regimes in Africa and in the Middle East, and they were providing security to all these dictators.

SO: When Prigozhin was killed, people were asking themselves: does that Russian influence in those regions just disappear? What happens next? And it seems like this is what's happening.

CG: It's important to understand why Putin had to show this person sitting next to him. It's a rare occurrence. Putin never showed Prigozhin physically sitting next to him. And it's not a good operational tradecraft symptom to show a top secret guy publicly. But when Prigozhin went down in flames, literally, all of these people in Africa, all of these dictators had a surge of distrust to Russia, because this was our guy. This was the guy that helped us climb to power in many cases. This was the guy that protected us from downfall, and suddenly they're getting rid of him.

Anyone else who'd have shown up and said, ‘Hey, I'm the new Prigozhin,’ would have met a wall of distrust. Putin had to physically put this guy next to him and say: ‘This is your new guy. I'm in charge of him, and I'm sending him to you.’ So this really explains why he was there. Whether he will take all of the markets, all of the countries in which Prigozhin's army was providing these nefarious services, I don't think it will be all of them, because Putin now distrusts any one person to be the guy who keeps the keys to all of Africa, all of the Middle East. But at least for a large part of Africa and the Middle East, Averyanov is this man.

Which means these people who can no longer travel to Europe and blow things up here and in the U.S. most likely will be recycled as advisors or as trainers or as assassins in Africa and the Middle East.

These people who can no longer travel to Europe and blow things up here and in the U.S. most likely will be recycled as advisors or as trainers or as assassins in Africa and the Middle East.

SO: What do you think motivates people who operate in these clandestine organizations abroad at great personal risk to themselves, but also doing really nefarious things like killing people with chemical weapons. Why would somebody want to be involved in something like that?

CG: You can roughly see two different groups. The majority are people who came from small villages with poor families, sometimes orphans. All of them had gone to Suvorov military schools — a kind of cadet school — but they had no social elevator in front of them in their non-military lives. Suddenly, they get picked and sent to this elite unit, and they were expected to be loyal to the army [and] to the state forever, because they were dragged out of the mud, in some cases literally.

One of the guys who was part of the poisoning of Sergei Skripal grew up in a village of 400 people in the permafrost that for a large part of the year had no physical road out of the village. Only when the frost became completely hard, only then, like for three months of the year, people from that village could leave the village. Imagine this guy suddenly having a credit card, an Amex, and being able to travel to London and Paris.

One of the guys who was part of the poisoning of Sergei Skripal grew up in a village of 400 people in the permafrost that for a large part of the year had no physical road out leading [out of it].

This is about 80% of the people, and 20% of the people actually are sons of important GRU colonels and generals from before who just used the nepotism inherent to any Russian structure to get that lucrative position. These people not only had access to credit cards but had access to stashes of cash.

We were able to read the emails of one of the core members of the team. At the start of the war in Ukraine, he was deployed as one of the small core kill team, [the] advanced kill team that was sent to Kyiv to assassinate Zelensky and [the] people around Zelensky. And they thought it would be a 5-day operation, obviously. But when it failed to be a 5-day operation, and he was stuck there for months and months and months, he started communicating via email with his wife.

Some Russian hackers were able to obtain that and shared it with us. It was very telling, not only about the fact that they believed the war would be a one-week war, and they were very disappointed when it wasn't, but this person was [also] instructing his wife to go into the stash of cash he had hidden behind the library and take batches of $10,000 each, and buy apartments, because he wasn't sure what would happen to the [Russian ruble] and wanted to at least secure the future of his family.

We were able to read the emails of one of the core members of the team [...] this person was instructing his wife to go into the stash of cash he had hidden behind the library, take batches of $10,000 each and [use them to] buy apartments.

This is a guy who was getting an official salary per year of maybe $20,000 for years, and what he was able to spend on banking against the demise of the ruble was definitely at least a million [dollars] in cash hidden behind a library bookshelf. Clearly, that's the result of their corrupt collusion with criminal groups.

SO: A spy communicating with his wife via unencrypted email is such bad tradecraft.

CG: Well, thank God for that.

SO: Christo, thank you so much. So interesting speaking to you. Really appreciate it.

CG: Thank you.

SEE ALSO

• Exclusive: Inside an infamous Russian spy unit’s first bombing in NATO

Subscribe to our Sunday Digest

By subscribing, you agree to The Insider's Terms of Service and Privacy Policy, as well as Google's reCAPTCHA terms (Privacy Policy, Terms of Service).

Popular

1. Unraveling Havana Syndrome: New evidence links the GRU's assassination Unit 29155 to mysterious attacks on U.S. officials and their families
2. Lost in translation: How Russia’s new elite hit squad was compromised by an idiotic lapse in tradecraft
3. The Czech illegals: Husband and wife outed as GRU spies aiding bombings and poisonings across Europe
4. A most wanted man: Fugitive Wirecard COO Jan Marsalek exposed as decade-long GRU spy
5. The Lab: How FSB chemical weapons experts tried to poison Alexei Navalny

Subscribe to our Sunday Digest

By subscribing, you agree to The Insider's Terms of Service and Privacy Policy, as well as Google's reCAPTCHA terms (Privacy Policy, Terms of Service).