“Let’s hire an ISIS suicide bomber to blow him up in the street!”: Europe’s most wanted man plotted my murder — and that of my colleague

RU

The investigation that started it all

The hunt for me had apparently begun in December 2020, immediately after my investigative team at Bellingcat, where I then worked, teamed up with The Insider, Der Spiegel, and CNN to publish the definitive history behind Navalny’s poisoning. We exposed the real identities, flight logs, and phone billing data of multiple FSB operatives who had trailed Navalny across Russia before ultimately administering a near-fatal dose of the Soviet-era nerve agent onto his underpants after breaking into the opposition figure’s Tomsk hotel room. Within hours of our investigation going live, as we later found out, President Vladimir Putin had personally tasked the FSB’s Internal Security Directorate with finding out how on earth we’d obtained such sensitive information — information that greatly embarrassed the security service Putin himself had once headed.

I’d soon learn, thanks to a police raid more than two years later, that on the same day our story broke, Jan Marsalek — already under the FSB’s protective umbrella following his midnight escape to Belarus in June 2020 — had fired off an encrypted message to one of his longtime Bulgarian associates, Orlin Roussev. Roussev had facilitated many of Marsalek’s “private security” initiatives back in the Austrian fraudster’s Wirecard days, and — also unbeknownst to me back then — Roussev would now assemble a ragtag band of Bulgarians living in the UK, Austria, and Bulgaria to begin tracking my every move. On Dec. 14, 2020, the plot began.

[The exchanges between Marsalek and Roussev are presented unedited and appear in their original form.]

Marsalek: “We’d be interested in a Bulgarian guy working for Bellingcat: Christo Grozev. Can we look into this guy or would it raise too many eyebrows?”

Roussev: “That name indeed sounds very Bulgarian, is he on the Bellingcat team?”

Marsalek: “Yes, he is the lead investigator in the Navalny case.”

Roussev: “If done the right way he will have no clue.”

Marsalek: “Excellent!”

Roussev: “Well… where do you want to start? First of all I mean proper full investigation will start from his place of birth… full school history, who are/were his friends.. girlfriends.. school mates… university.... employers..etc… etc. Especially if he’s operating out of Bulgaria or lives somewhere else. also.. I have 4 anonymous teams in Bulgaria each one is 12 people strong.. can tail him 24x7.”

And so, their operation began in earnest.

“Who is this Christo Grozev?”

Inside Russia, the FSB questioned telecom operators, struggling to understand who had leaked the phone and travel data of its agents — the very data we’d published in our Navalny investigation. Meanwhile, Marsalek convinced the FSB to outsource the “hands-on” legwork of surveilling me around the world to him, and he, in turn, outsourced it to Roussev. The result was befuddling, a spy operation equal parts horrifying and hilarious — more befitting a low-budget rip-off of Ocean’s Eleven than a James Bond film.

Roussev and Marsalek put together a team of bumbling wannabe spies that included a forty-something blood-bank ambulance driver, his girlfriend who worked as an assistant at a medical lab, a beautician boasting the Ms. Eye Lashes title in addition to running the Pretty Woman parlor in London, a home decorator who once dated the beautician, and a one-time MMA fighter.

None had the skill set or background for the espionage missions they were generously tasked with carrying out. And yet they all enjoyed Roussev’s confidence, along with his readiness to forgive their many blunders — and cover for them when reporting back to Marsalek. Perhaps most importantly of all, they had the right kind of passports to travel freely around Europe. They were not Russian, and thus would be more likely to remain unnoticed by their targets.

What few people realized at the time was that in their efforts to track me down, Marsalek had also enlisted the help of his Austrian cronies, who he had bribed into becoming his personal spies. And unlike the Bulgarian bunch, they were professionals.

One of them was Martin Weiss, a former senior officer in Austria’s BVT intelligence service who had been in charge of counter-terrorism until 2015. By then, Marsalek was already deeply linked with Russian intelligence, and Weiss had been part of Marsalek’s network of influence long before he left his job at BVT.

At the time of the Navalny investigation I was living in Vienna, and the FSB needed some help from a man on the ground. Weiss did not exactly fit the profile, as he had defected to Dubai following the unravelling of the Wirecard scam, in which he stood charged with helping Marsalek flee from justice. However, Weiss had his own network of spies on the ground in Vienna.

On Dec. 15, 2020 — the day after we published the Navalny investigation – Weiss messaged a former subordinate, Egisto Ott, who was then working at the Austrian Police Academy. Weiss instructed him to “find out everything about this guy Grozev” and sent him a link to my investigation, published on the Bellingcat website. Several hours later, Ott replied with the puzzled message, “Who is GROZEV?” Weiss replied: “A former CIA employee. Now works freelance.”

I will never know for certain if this lurid fantasy — obviously transmitted to Weiss by the FSB via Marsalek — was something the Russian security services actually believed in, or whether they merely pretended to do so. Years later I had a chance to pose this question to the Russian spymaster who had originally recruited Jan Marsalek. He matter-of-factly replied: “You must understand. Some people can sleep better if they believe that it’s the CIA, and not some lone journalist, that made them look stupid.”

A few days after that exchange between the two Austrians, Vladimir Putin publicly dismissed our Navalny revelations as nothing more than “materials furnished to so-called journalists by U.S. intelligence.” It was an odd echo of that sleep-improving self-delusion, broadcast straight from the Kremlin. In retrospect, I now wonder if Marsalek’s recruiter had had Putin in mind when he told me that.

In the weeks that followed, we had followed up on the Navalny investigation with several more shocking exposes disclosing that the FSB had tailed and poisoned many other opposition figures in Russia, including opposition figure Vladimir Kara-Murza (twice) and the poet Dmitry Bykov, and that they had likely poisoned and killed an anti-corruption activist and several independence crusaders from the Caucasus.

On Jan. 30, 2021, the FSB made both me and Roman “official targets of surveillance” — as we later learned from a leaked database containing the names of over two million Russians who had popped up on the radar of the security service. Roman, who was then still based in Moscow, was visibly surveilled in the streets and was harassed repeatedly at the airport whenever he would travel in or out of the country.

Initially, the FSB was mainly interested in getting its hands on our equipment, presumably in the hopes of confirming its hypothesis regarding our links with the CIA. On the evening of March 6, FSB officers stopped Roman at Moscow’s Sheremetyevo Airport after his return from a business trip. Under the cringily absurd pretext of “questioning him about the COVID-19 situation in Europe” — part of an allegedly random survey of travelers arriving from the region — they directed him into a separate room. The officials claimed that border guards were not permitted to bring gadgets into their office, and so Roman’s electronic devices were placed on a table in the hallway. After several ridiculous questions about the reputation of the Russian-made Sputnik vaccine in Europe, Roman suddenly decided to check and see if his belongings were still outside the door, and the interrogator had no time to stop him. He found that neither the laptop nor the mobile phones remained on the table. The FSB officers feigned surprise and promised to return the missing items immediately but succeeded in doing so only after 40 minutes had passed. Although they failed to bypass the pin codes on the phones or computer, the Kremlin’s agents did manage to install a tracker on Roman’s laptop, which he discovered within minutes. Hence, the only damage inflicted was the cost of a new device.

I had a weirdly similar experience shortly thereafter, not in Moscow, but — shockingly — in Berlin. Flying back from a screening of Navalny in New York and on the way to another one in the Hague, I was just passing via the German capital for a few hours to speak at a conference. The event was held at a pompous hotel in the city’s suburbs. The bellboy insisted on taking my suitcase and laptop bag, even though I protested that I would be in and out in less than an hour. Ultimately I made the mistake of relinquishing my suitcase to his insistent pull. During the event, I looked up the ownership of the hotel only to discover it was owned by a German, quite literally, “friend of Vladimir Putin”. I rushed out to get my suitcase, and the bellboy took a whopping twenty minutes to find it. On the way to the airport, I discovered a hard disk was missing from the suticase. I alerted the police who rushed to the hotel, only to be told that the security cameras had been down for maintenance.

Back in Vienna, my hometown at the time, I fell outside the FSB’s immediate reach — even if Egisto Ott was able to furnish the Russians with my home address, which he illegally looked up in Austrian police databases. This is why Marsalek’s Bulgarian spies had to be dispatched to surveil me. Their initial plan sounded straightforward: follow me, gain access to my phone or computer, and see if they could reconstruct how The Insider, Bellingcat, and Der Spiegel had unmasked the FSB’s expansive assassination operations.

In reality, their operation came off like bad fan fiction, albeit with some seriously close calls for me and my family — and, as it turns out, some scary moments for random bystanders who were misidentified as being linked to me.

The surveillance team rented an Airbnb across the street from my Vienna address, set up a constant surveillance camera to film me coming and going, and even bribed a corrupt employee of Swissport in order to gain access to airline booking data, thereby allowing them not only to know in advance when and where Roman and I were traveling, but also to place their agents next to us on flights. They used actual spy glasses to record me getting in and out of the plane — and even to spy on Roman texting me from inside the cabin.

Whenever they failed — often enough, they still lost track of me altogether — Roussev spun it to Marsalek as proof of my “advanced tradecraft.” Whenever his spies approached me at a hotel lobby bar, for example, “Grozev stops talking and folds his laptop and walks away.”

“He’s a paranoid guy,” retorted Marsalek, as if the more normal behaviour would be to let oneself be ostentatiously listened to by strangers. In another incident, they reported a “break-in” at my hotel room that they had achieved by allegedly cloning my key card. “He will never know, as any investigation will show that the room was accessed with his own key.” In truth, they entered someone else’s room to find a sleeping stranger, and instead of acknowledging their failure, the report to Marsalek claimed that, “We found a man sleeping in his bed.”

By the middle of 2022, after gathering little to no intelligence of value on me, Marsalek became increasingly exasperated with Roussev and his team, writing that, “Our FSB friends are desperate to prove Grozev is linked to Mi6.” On July 22, he and Roussev had the following exchange:

Marsalek: “Some f***** genius just suggested again to kidnap Grozev and to take him to Moscow. These people never learn.” [followed by a “Monkey paws over eyes” emoji, and then one more]

Roussev: “If you are serious about it .. and if Grozev is in Bulgaria I have the resources to kidnap, drug him and lock him up in one secure cave. Then we need to plan the extraction process. We will need a plane or a boat…”

Marsalek: “Honestly, I think it’s a bad idea.It will be just bad press and 6 months later there are two new Grozevs. It’s like a Hydra – you cut off one head and two new ones emerge.”

Roussev: “But if they want it, I’m happy to give it a shot. It’d be a cool project.”

That week, I was spending time with my family at our summer house north of Varna on Bulgaria’s Black Sea coast, and Roussev reported with pride that his team had located my villa — an achievement that would have required nothing more than a peek into the publicly accessible real estate registry. He sent a satellite photo of what was presumably my property, and Marsalek responded: “are you sure this is his house? Google maps are notoriously imprecise for this part of the world.” Roussev responded that he did not depend on Google Maps but on actual “local intelligence.”

This resulted in Roussev’s team staking out — and proudly sending photos of — a house that not only was not mine, but was not even in the same holiday settlement. Not surprisingly, when the group bribed a cleaning lady to penetrate “my” villa, they found “only women’s clothes and items,” which they naturally attributed to my superb talents of subterfuge and counter-surveillance.

Another time, the group bragged about having penetrated my Vienna apartment and cracking a “safe.” I have never owned a safe there, but the team likely did succeed in making off with an ancient laptop that had once been used by a deceased relative. They passed this off to Marsalek as a treasure trove of “USB sticks and valuable data.” Roussev’s message to Marsalek describing the very special operation read:

“They were fast… unlocked the flat… check as per the list.. there had been a lot of books around.. the old safe immediately captured their attention.. since nothing luxury/valuable was outside they thought (logically) all was in the safe… took them about 10 min to open it… inside sadly no money and jewelry.. just the laptop and I think some USBs etc… they decided it is not worth to tear the place apart.. closed the safe.. locked the front door.. Elvis has left the building.”

Weeks later, Marsalek scolded Roussev, telling him that “Our friends at Lubyanka cracked the laptop; little of value there, the freshest files are from 2016.”

In order to come off looking at least a little bit more professional, Roussev constantly invented non-existent successes and reported them to Marsalek. He fictitiously claimed that they had recruited a hotel concierge or a stewardess. He even wrote that Vanya Gaberova had achieved incredible success in seducing me, that I had already been “hooked,” that I was falling in love with her and actively liking her photos on Facebook. Not only was I not aware of Gaberova’s existence, but the very idea of me liking any photo on Facebook fills me with cringe. (Upon reviewing my Facebook history following her arrest, however, I did discover that I had accepted her friend request — but only after she had already “befriended” my sister, cousin, classmate and two colleagues.)

Marsalek, in turn, shared information with Roussev of roughly the same quality, telling him, for example, that the United States was allegedly paying the director of Austrian intelligence a million euros a year for my “personal expenses.” It is unlikely that Marsalek made this up himself; it is more likely that he got the rumor from his FSB handlers, who were tasked with finding my connection to the CIA. Yet at the same time, Roussev wondered why I had such old and tattered shoes. “Strange guy,” Marsalek replied. “Really hard to judge. He might also simply not care or cultivate the image of an honest and down to earth man.” In reality, I simply paid little attention to the choice of footwear for a brief trip to the store, but if I had known I was being followed, I certainly would have worn my good pair.

A series of close calls — and escalating threats

Throughout this period, Bulgarian operatives were also tailing Roman across a range of European cities. On July 27, 2021 he had purchased plane tickets, planning to attend a conference in Tbilisi on July 28, followed by a visit to see me in Bulgaria. However, Roman’s itinerary was disrupted before the trip could even begin.

At 6 a.m. on July 28, the FSB broke down the door of Roman’s Moscow apartment and searched him. The security services took all the gadgets they could find along with both of his passports. The formal pretext behind the break-in stemmed from an old tweet in which Roman had alleged that Dutch blogger Max van der Werff was working for the GRU, Russia’s military intelligence agency. The blogger had filed a defamation lawsuit in December 2020, but the police declined to pursue Roman at the time. However, in June 2021, the FSB secretly reopened the case and used it to justify the July 28 search.

Roman was not arrested, but the FSB was confident that the object of their surveillance would not go anywhere, as his passports had been taken as “material evidence” in the investigation. But Roman took the FSB’s attempt to keep him in the country as a clear sign that he should leave immediately. Two days later, as I played DJ at a children’s karaoke party at my summer apartment in Bulgaria, I helped coordinate Roman’s crossing of the Russian-Ukrainian border through a forest.

As Roman awaited new documents, I met him in Western Ukraine for a hike in the Carpathian Mountains. Later on, a source in the Security Service of Ukraine (SBU) informed Roman that Kyiv’s intelligence services had gathered information showing that a Ukrainian criminal group had received an “order” from Moscow to kidnap him and take him to Russia. A reward of $50,000 was offered for his capture. But the bandits failed to find him, and on Aug. 30, he left for Vienna.

From there, Roman zigzagged around Europe while the spies kept tabs on him via hacked Amadeus flight records. At one point, one of them even booked a seat next to him on a flight from Budapest to Berlin, wearing a hidden camera to record his screen while he texted me. Their attempt to get his smartphone pin code was off by only one digit.

Their biggest “coup,” at least in their view, came when they stole a spare phone I had brought along to a conference in Montenegro. They pried it open and found…nothing. I used it precisely because it contained no data of value. Still, they seemed to think it was a gem. They also snapped a photo of Roman and me in our bathing suits on a beach — hardly the stuff of 007-level espionage.

Yet the further their mission drifted from success, the darker their ideas became.

In early February 2022 they discovered that I was flying to Kyiv. The group at first intended to follow me, but Marsalek stopped them, hinting that the Russian secret services had their own plans: “Our friends are worried [our] presence might interfere with another overlapping operation in Ukraine. They would prefer if we’d abstain from any on the ground activity in Ukraine at the moment. I don’t know what they are doing but it involves Grozev and his meetings in Ukraine. Maybe he only needs a one-way ticket.”

I would later learn that, by July 2022, they were actively discussing my potential abduction should I venture back to Bulgaria, and they were also discussing the possibly grabbing Roman and whisking him off of Britain’s eastern coast. The half-baked plans ranged from forcibly drugging and bundling us onto private planes to horrifying fantasies about burning us alive or dousing us with chemicals. As Marsalek noted: “A successful operation in Britain would have been very convenient after the Skripal failure.”

Roussev wrote that the police had very poor control of the UK’s east coast, which is why the area was frequently being taken advantage of by illegal migrants. “Dobrokhotov would be an illegal migrant in reverse!” — quipped Marsalek. They worked out a detailed plan that would involve several men — including former MMA fighter Ivan Stoyanov — in a violent attack. The scheme was replete with cars bearing fake license plates, a route that avoided traffic surveillance cameras, and two speed boats that would need to be sunk at the end of the operation.

The idea was to hand over Roman to the Russian security services, but Marsalek was worried about the logistics: “The problem is how to pick him up in international waters. I'm not sure the guys here would trust our abilities enough to put us in command of a submarine.”

The perpetrators also discussed a possible alternative: assassination. Roussev suggested staging an “accident in the shower,” but Marsalek dismissed the idea as insufficiently dramatic: “Maybe burn him alive in the street, spray him with some super strong acid, VX, like the North Koreans, or ricin .... An accident in the shower won't deter others. We need more drama!”

Thankfully, even the FSB seemed wary of such outlandish schemes. Russia’s invasion of Ukraine in February 2022 raised global tensions to a fever pitch. However vengeful the Kremlin felt after our Navalny exposure — and about our subsequent investigations — it seemed less willing to risk a full-blown scandal on foreign soil.

The downfall of my would-be kidnappers

By late 2022, the Kremlin officially declared me “wanted” in connection with aiding Roman’s efforts to “illegally cross the Russian border.” The accusation was absurd, given that Roman had left, rather than entered, the country. Still, Marsalek took it as a sign the FSB might get “legal” grounds for our extradition. His text messages to Roussev were chilling.

Marsalek: “The arrest warrant is apparently the legal framework needed for a kidnapping. Personally, I find Grozev not to be a very valuable target but apparently Putin seriously hates him.”

Roussev: “I guess.. a more ‘efficient’ and strong message will not be kidnapping Grozev .. but actually killing him like either: 1) Stepan Bandera in Germany or 2) killing him like Leon Trotsky in Mexico.”

Marsalek: “I agree. Though an axe is yesterday's weapon. Better a sledgehammer, Wagner-style. I'll pass it on.”

One of Marsalek’s ideas about my own liquidation sounded like a film-noir fantasy. “Let’s hire an ISIS suicide bomber and have him blow himself next to Grozev in the street.” Another fantasy was more appropriate for a Mission Impossible film: I would be kidnapped by boat to Syria, while someone wearing a latex mask with my face would fly to Moscow to get arrested on camera.

Before they could attempt any new gambit, however, British authorities moved in. In January 2023, law enforcement raided the group’s makeshift operations base, discovering forged IDs, hidden cameras, listening devices, and a mass of incriminating messages tying them directly to Marsalek — and by extension, to the FSB. Under the weight of this evidence, two of the six suspects turned state’s witness. By mid-February 2023, their Old Bailey trial ended with a small measure of justice: unanimous guilty verdicts.

While the operation’s comedic misfires bordered on farce, its true gravity is unmistakable. The same FSB unit behind Navalny’s poisoning was, through Marsalek and his overseas recruits, now hunting me and Roman — journalists who had exposed one of their darkest secrets. Marsalek, the flamboyant ex-financier, remained the linchpin abroad, leveraging an unwitting cast of amateurs for tasks that escalated from laptop theft to potential murder.

Roman and I are still continuing our investigative work in undisclosed locations, keenly aware that the Kremlin’s reach can be disturbingly long. The verdicts handed down by the Old Bailey have put an end to this particular plot, but Marsalek himself remains at large — as we now know — under Moscow’s protection. If there’s one sobering lesson I’ve taken from this ordeal, it’s that every time a thwarted plan for retribution fizzles, another one may appear. We live and work in the shadow of a Kremlin that abhors pesky truth-tellers — and from my vantage point, it will take more than one guilty verdict to change that.