In May 2025, a group of Bulgarian nationals living in the UK were convicted for their roles in a covert Russian espionage cell operating across Europe. The group was tasked with gathering intelligence on critics of the Kremlin, surveilling NATO-linked facilities, and planning disruption on behalf of Russian state actors.
The case, tried at the Old Bailey, is being described as one of the most significant modern espionage convictions in the UK,. This is not only because of its implications for national security, but what it reveals about Russian intelligence networks, and the opaque nature of their operations (conducted from two-bedroom flats in Harrow).
The spy ring: Who they are
The convicted individuals—Orlin Roussev, Biser Dzhambazov, Katrin Ivanova, Vanya Gaberova, and Ivan Stoyanov—were all Bulgarian nationals living in the UK for over a decade.
Orlin Roussev, noted as the group’s ringleader, previously owned a tech company based in London. Upon investigation by the security services, he was found to be in possession of thousands of pieces of ‘spying equipment’. Items seized from his home in Great Yarmouth including listening devices, concealed cameras and a fake ID card printer.
Biser Dzhambazov was a driver for hospitals in London but is believed to have been a senior operator in the spy ring. He moved to the UK in 2009 and was the long-time partner of another individual implicated in the incident, Katrin Ivanova. Dzhambazov managed the logistics of the group's surveillance activities and travel across Europe.
Katrin Ivanova, a medical laboratory assistant and translator, was involved in operational planning and document forgery. While her defence claimed she was manipulated by Dzhambazov, prosecutors successfully argued that she knowingly participated in activities designed to support Russian intelligence collection efforts.
Vanya Gaberova, a West London-based beauty therapist and “eyelash extension specialist”, who was to be used as part of honeytrap operations to obtain intelligence of interest to the Russian state. Prosecutors alleged that she stored surveillance materials and assisted with alias creation.
Ivan Stoyanov, the final member of the group, was considered a lower-level operative but played a role in logistical support. He admitted guilt prior to the trial.
Together, the group maintained dozens of fake passports and identity documents for multiple nationalities, including UK, French, Spanish, and Croatian papers. Investigators from the Metropolitan Police’s Counter Terrorism Command uncovered evidence of surveillance on prominent Kremlin critics, including investigative journalist Christo Grozev of the Open Source Intelligence company Bellingcat, and on strategic NATO-affiliated sites such as U.S. military facilities in Germany.
Collectively, officers seized 221 mobile phones, 495 sim cards, 258 hard drives, 33 audio recording devices, 55 surveillance cameras, 16 radios and 11 drones plus Wi-Fi eavesdroppers, electronic jammers and 75 fake passports and identity documents in 55 different names.
The espionage operation and its methods
The operation, which unfolded between 2020 - 2023 was notable not only for its scope, but for its methods. This group relied on forged IDs, digital surveillance, and real-time photographic intelligence gathered in person. The targets were diverse: politicians, dissidents, Ukrainian exiles, journalists, and infrastructure hubs tied to NATO activities.
Prosecutors argued that the group’s purpose was to assist Russian state actors in preparatory operations, potentially including abduction, disruption of infrastructure and murder.
Roussev reportedly relayed the group’s intelligence to a third-party handler named ‘Jan Marsalek’, who is wanted in Germany and Austria over fraud and embezzlement offences.
The geopolitical fallout
This case has wider implications for European security. For one, it underscores how Russian intelligence networks have shifted toward embedding civilian operatives within local communities—a strategy that allows agents to evade immediate suspicion or connections to the Russian state while establishing long-term cover. The use of Bulgarian nationals, rather than Russian passport holders, may have also allowed the operatives to exploit freedom of movement across the EU. It has also renewed pressure on MI5 and the UK Home Office to bolster counterintelligence efforts and tighten controls on foreign influence operations.
KYC failure?
One particular point of interest stuck out to our analysts when researching this matter: despite having no visible or publicly reported high-income employment, Roussev was able to acquire a 33-bedroom former guesthouse in Great Yarmouth with minimal scrutiny. The property was used as part of their operations, alongside the notably smaller homes of the group members. The ability for Roussev to acquire this property raises serious questions about the robustness of KYC checks in property transactions.
Financial institutions, estate agents, and conveyancing professionals are all required to conduct enhanced due diligence on high value transactions and in this instance, it would appear that either red flags were missed, or they were never raised in the first place.
This failure enabled a hostile actor to embed himself in British infrastructure and underscores wider systemic vulnerabilities that can be exploited by state-sponsored networks using property ownership as a shield for covert activity.