A spy cell in the UK, including five Bulgarian nationals, targeted multiple individuals and locations over nearly three years, according to court documents at the Old Bailey, officially known as the Central Criminal Court of England and Wales.

The Bulgarian nationals had stood accused of spying for Russia at the behest of the fugitive Jan Marsalek, the former COO of Wirecard, described by prosecutors as “believed to be linked to the Russian state”. The trial centered around thousands of sinister messages between Marsalek and Bulgarian national Orlin Roussev, who compared himself to the fictional character of ‘Q’ from the James Bond movies, and his “team leader” Bizer Dzhambazov, who managed the other three defendants, all belittlingly referred to as “the minions”. Roussev and Dzhambazov had pleaded guilty to their role in the spy ring prior to the trial.

The Central Criminal Court of England and Wales; image: TCA, Stephen M. Bland

The story has all the hallmarks of a Hollywood script: gadgets, beautiful women, and dozens of fake IDs used to rent cars and properties across Europe for various operations. The defendants plotted espionage, psyops, and disinformation campaigns, and even kidnapping and murder, some of which were partially carried out in the UK and across continental Europe, including in Germany, Austria, and Spain, as well as other locations.

Messages presented to the court indicate that, beyond their alleged collaboration with the Russian FSB, the gang operated as mercenaries for any party willing to pay. The Bulgarians devised schemes appealing to their purported connections in Russia, Kazakhstan, Serbia, China, Malaysia, and Colombia.

Germane to Central Asia, the spy ring engaged in a range of covert activities targeting Kazakhstan. In 2021, they botched a surveillance operation against Bergey Ryskaliyev, a long-time adversary of former President Nursultan Nazarbayev. Ryskaliyev, the former governor of Kazakhstan’s Atyrau region, fled to London after being accused of embezzling hundreds of millions of U.S. dollars and was sentenced in absentia to 17 years in prison for leading an organized criminal group.

Targeting Kazakhstan’s President

By 2022, the group’s efforts had escalated into an elaborate scheme to influence Western government officials to impose punitive measures against Nazarbayev’s successor, President Kassym-Jomart Tokayev.

The plan began with the creation of an entity designed to lend legitimacy to a fabricated grassroots opposition movement, the inception of which was discussed in Telegram chats between Marsalek and Roussev.

“If you have a preferred name… otherwise I will use my imagination and historical facts from the past centuries. Also… how about for the fake company or real company that we register to use some Chess terms…”, Marsalek suggested with regards to naming the NGO.

To which Roussev replied: “Let’s call it ‘Truth on the Steppes Publishing Ltd.’” The duo would later refer to the entity as “TOTS”.

Marsalek agreed, saying, “UK… will be done in a few days… that one I will register tomorrow – UK company ‘Truth on the Steppes Publishing Ltd.’”

Shortly after, “Truth on the Steppes Publishing Ltd” was established with the registered address given as a premises in Harrow, London.

The website truthonthesteppes.org was launched on September 14, 2022, and became a platform for disinformation. By October 19, 2022, or possibly earlier, as indicated by internet archives, it featured narratives pushing for sanctions against Tokayev and his family, with unverified claims of funds having been stolen and laundered by his relatives. The website’s contact address corresponded with that of the above-mentioned UK entity.

Screenshot of internet archive for truthonthesteppes.org

TOTS’ schemes included staging protests, such as spraying 100 liters of pig’s blood on the London Embassy of Kazakhstan. Roussev described the plan, stating: “The idea is we film it and publish it saying it’s the blood of the innocent Kazakh people, which the president has on his hands.”

In addition to these efforts, the conspirators worked to tarnish Kazakhstan’s reputation among Western policymakers by spreading narratives of collusion with Russia, human rights violations, and corruption. On September 6, 2022, Marsalek wrote to Roussev: “I’m preparing a mailing campaign to write letters to public officials in Europe and the U.S. urging them to sanction Kazakhstan as well as the President and his family for their support of Putin and their murderous actions in January this year.” Four days later, he added: “Drafting first love letters from TOTS to various European politicians.”

Evidence uncovered on Roussev’s laptop included a draft letter addressed to EU President Ursula von der Leyen. The letter, dated September 20, 2022, delivered a scathing critique of President Tokayev, accusing him of corruption, human rights violations, and ties with Russia, urging an international investigation as well as sanctions against Tokayev and his family.

Image of letterhead of the draft letter to President Von der Leyen shared with The Times of Central Asia and corroborated with court documents

Other planned measures included slandering the President’s son. Marsalek emphasized to Roussev that, to be convincing, the fake derogatory content to be published should be mixed with some verifiable information, according to Telegram chats from the summer of 2022.

In late August 2022, the conspirators also discussed approaching Bellingcat, an esteemed investigative journalism organization, to write a story about the President’s family. Further proposals involved hacking Kazakh nuclear power plants and crashing the country’s currency.

The intended client for these “services” remains unclear and contradictory. In one instance, Marsalek and Roussev discussed fabricating evidence of protest activities that could potentially be sold to Russia, which could then share it with Kazakhstan to gain favor. In another, Marsalek argued that the attacks on the President’s family were warranted because Tokayev had not condemned Russia’s invasion of Ukraine, despite maintaining a neutral stance to keep Kazakhstan out of the conflict.

While the defense in the UK court case highlighted the conspirators’ unprofessional and clumsy methods, prosecutors successfully argued their culpability in conspiring to endanger state security. Alison Morgan KC, serving as the prosecutor, warned the jury that the defense would focus on the spies’ “amateurish antics being funny”, adding, “but it’s not funny at all… They were not stupid.”

Verdict

According to the prosecution, the defendants were accused of “monetizing a gap in the market,” engaging in what was described as “high-level espionage with very high stakes.” A money flowchart presented as evidence revealed that approximately €380,000 had been transferred between three of the suspects, further supporting the allegations.

Two men, Orlin Roussev, 47, and Bizer Dzhambazov, 43, had already pleaded guilty to their role in the spy ring prior to the trial. For the remaining three defendants (Katrin Ivanova, 33, Vanya Gaberova, 30, and Tihomir Ivanchev, 39) following 32 hours of deliberation, the jury returned a guilty verdict on charges of conspiracy, contrary to section 1 of the Criminal Law Act 1977, to commit an offence under section 1 of the Official Secrets Act 1911.

Only Ivanchev was present in court, while Ivanova and Gaberova joined via video link from HMP Bronzefield, a women’s prison in Surrey, England. Their crimes carry a maximum sentence of 14 years’ imprisonment. Sentencing is scheduled for May 2025.