the home of online investigations

You can support the work of Bellingcat by donating through the following link:

Third Suspect in Skripal Poisoning Identified as Denis Sergeev, High-Ranking GRU Officer

February 14, 2019

By Moritz Rakuszitzky

Translations: Русский

Bellingcat previously confirmed that a third GRU officer was present in the UK during the time Sergey and Yulia Skripal fell into a coma, after what the UK authorities said was a deliberate poisoning with Novichok. In addition, Bellingcat established that this same officer traveled multiple times to Bulgaria during 2015, including a trip days before a Bulgarian arms trader and his son were severely poisoned with a yet-unidentified poison.

Following a four-month joint investigation with our investigative partners The Insider (Russia) and Respekt (Czechia), Bellingcat can now reveal the true identity and background of this GRU officer, who operated internationally under the cover persona of Sergey Vyacheslavovich Fedotov. In fact, this person is Denis Vyacheslavovich Sergeev, a high-ranking GRU officer and a graduate of Russia’s Military Diplomatic Academy.

Additional research in this investigation was also made by newspaper Helsingin Sanomat (Finland).

Notably, we have established that in the last two months, Russian authorities have taken the unusual measure of erasing any public records of the existence of Denis Sergeev, as well as of Anatoly Chepiga and Alexander Mishkin, the main two suspects in the Skripal poisoning. These unprecedented actions cannot plausibly be taken without direct involvement of the Russian state, and add further credibility to the UK government’s assertion that the Skripal poisoning operation, and the subsequent cover-up, were coordinated at a state level. Additional details on these concerted efforts to purge public records of Chepiga, Mishkin, and Sergeev’s identities will be detailed in the next part of our investigation, scheduled to come out next week.

Who is Denis Sergeev?

Denis Vyacheslavovich Sergeev was born in Usharal, a small militarized town in what was at the time Soviet Kazakhstan, near the Soviet-China border. Both Denis Sergeev and his cover identity “Sergey Fedotov” were born on 17 September 1973. He served in the army in the southern Russian city of Novorossiisk in the Krasnodar Region.

At some point between 2000 and 2002, he was transferred to Moscow and enrolled at the elite Military Diplomatic Academy, popularly known in Russia as the “GRU Conservatory”. The Military Diplomatic Academy churns out 100 elite intelligence officers each year, ranging from spies in diplomatic and military attache covers to illegals.

We have not established what Denis Sergeev’s service prior to the Academy involved; however, it is known that recruitment into the Academy takes place among military officers with the minimum rank of captain who have excelled at their military service, traditionally in Spetsnaz or navy units. Like all other graduates, Sergeev would have finished the Academy with a minimum rank of lieutenant-colonel. While we have no confirmation of his current military rank, the time served and the nature of his assignments since graduation indicate he currently holds a minimum rank of full colonel, and possibly major-general.

Denis Sergeev is married and has an adult daughter.

2004 to 2012 Period

During this period, which possibly overlapped with his last years at the Military Diplomatic Academy, Denis Sergeev, under his real identity, served as shareholder and/or managing director of eight Russian companies. These companies, all of which were liquidated between 2007 and 2012, were sham corporations with names mimicking names of other large companies registered in Russia. In most of the companies, Sergeev was the sole shareholder, while in two he was co-shareholder with other people, some of whom we also identified as GRU officers.

We established that during 2009, Denis Sergeev obtained a personal loan from a Russian bank in the amount of just over one million USD. The allocation of such a large loan to a person who – as seen from his credit record (obtained from a leaked Russian credit history collection) – had no real estate and no personal vehicle – is extraordinary.  The loan appears to have been extended on the strength of Denis Sergeev’s personal income in his declared role as “specialist” working for a company called Loreven Style Ltd specializing in consulting services.

In a 2010 census, Sergeev listed Loreven Style Ltd as his employer, and indicated a Riga-based company address. There are no records of a company with such name ever existing, either in Riga or anywhere. Two phone numbers listed as contacts are not in service.

It is not certain what the function of the many sham companies incorporated by Sergeev was, and whether it was linked to the loan amount of $1 million apparently obtained from a Russian bank. A review of some of the other shareholders in these companies  – some of which also with GRU links – shows that they too incorporated dozens of companies with similar profiles, all of which have since been liquidated. It is plausible that these companies may have been used for money laundering purposes, or as cover corporations providing “respectable employment” to other GRU undercover officers, for instance in the context of visa applications. Bellingcat will continue to investigate these companies’ purpose and potential use by the GRU within or outside Russia.

The Birth of Sergey Fedotov

In 2010, Denis Sergeev received his alter ego, “Sergey Vyacheslavovich Fedotov”. A new, valid passport was issued under this name, by the same “770001” passport desk in Moscow that issued cover passports to Mishkin, Chepiga other GRU operatives, and “VIP” citizens, as previously detailed by Bellingcat.

“Fedotov” was given a birth date matching the one of the actual person Denis Sergeev. His place of birth was moved from Kazakhstan to the village of Apushka in the Ryazan region of Russia. As in the case of the other undercover passports issued to Mishkin and Chepiga, the “reason” for issuance of the new passport was stated as “unsuitability for use” of the previous passport. As in the other cases, the previous passport listed never actually existed.

“Sergey Fedotov” was also assigned a residential address and an employer. The new Moscow address in fact belonged to an unrelated family bearing the same family name (we were unable to contact the family to find out if they were aware of their cohabitation with the GRU officer, due to the fact that all four of their phone numbers were disconnected).

The employer, listed as a company called “Business-Courier”, could not be established definitively. There are more than 25 Russian companies that carry or had this name, including ones that were liquidated in the same period as the batch in which Denis Sergeev was a shareholder.

In a 2017 census, “Sergey Fedotov” listed his income as the equivalent of USD $1000 per month. He did not list an employer in this census.

An International Man of Mystery

Using four different airline booking, PNR, and border-crossing databases, Bellingcat has collated and analyzed travel records for the persona “Sergey Fedotov” for the period of 2012-2018. He used two different (consecutive) passports during this period–both of which were issued by the same 770001 passport desk and had numbers from batches that we have identified to include other GRU undercover officers.

Fedotov’s itinerary shows extensive travel to destinations across Western and Eastern Europe, Central Asia, and the Middle East.  In the period of 2012-2013, his destinations included Ukraine and Tajikistan.

In 2014, Fedotov traveled to Czechia, Italy, and Switzerland. Notably, during his first trip to Prague at the end of January 2014, he traveled alongside “Alexander Petrov”, the cover persona of Dr. Alexander Mishkin, one of the key suspects in the Skripal poisonings. The two stayed in Prague eight days, until 2 February 2014, when they flew back to Moscow. Bellingcat’s investigative partner Respekt has established that during this trip, “Fedotov” and “Petrov” stayed at the four-star Best Western Meteor Plaza Hotel, where they shared a room.

“Fedotov” made two subsequent trips to Western Europe during the rest of 2014, visiting Milan, Geneva, and Paris. His last trip that year was from 12 November to 1 December 2014, when he traveled to and from Paris.

Bulgarian Events

In February 2015, Fedotov made his first trip to Bulgaria. On 15 February 2015 he flew from Moscow to Belgrade in neighboring Serbia. On the next day he traveled on to Bulgaria, and stayed there until February 22, when he flew back from Sofia to Moscow.

His second trip, which was previously reported by Bellingcat, was in April 2015. He landed in the seaside resort of Burgas on a direct flight from Moscow on 24 April 2015. While he had bought a return flight from Sofia to Moscow on 30 April 2015, he did not use that ticket. Instead, on the evening of April 28 at 20:20, he flew from Sofia to Istanbul, where he bought an onward ticket to Moscow that same night.

It was earlier that same day, April 28, that the Bulgarian arms manufacturer and trader Emilian Gebrev collapsed during a dinner event with his trading partners from Poland at an upscale Sofia restaurant. Mr. Gebrev’s health deteriorated fast and he slipped into a coma. He was treated for poisoning from an unidentified substance at the Military Medical Hospital in Sofia. A source from the medial institution who wished to remain anonymous confirmed to Bellingcat and its investigative partners that Mr. Gebrev’s state was “touch and go” for over two weeks, with his chances of survival at times deemed to be very low. Gebrev’s son and the commercial director of one of his manufacturing companies also fell ill with signs of poisoning in the days following his own collapse, albeit with lesser symptoms.

Following his release from hospital, and given that the poison had not been identified, Emilian Gebrev requested a forensic medical analysis from two European labs accredited by the OPCW. One of them – the Helsinki-based Verifin – conducted a detailed analysis on urine samples from Mr. Gebrev and his son. As previously reported, this analysis found traces of organo-phospate poisoning, with two distinct types of agent discovered in the sample of Patient 1, who is presumed to be Mr. Gebrev. One of the types was broadly identified by Verifin as a pesticide, while the other was not identified.

In a statement to the press on 11 February 2019 in the wake of Bellingcat’s first publication pinpointing “Fedotov”‘s presence in Buglaria during the time of Gebrev’s poisoning, Bulgaria’s General Prosecutor confirmed Fedotov’s concurrent presence in the country. He also confirmed that Bulgarian authorities have re-opened investigation into Gebrev’s 2015 poisoning, which had been closed in 2016 when no suspect had been identified. Mr. Tzatzarov said that the investigation had been reopened after Mr. Gebrev had written to the prosecutors in October 2018, having seen coverage of the Novichok poisonings in the UK and suspecting he may have been targeted in similar circumstances. Mr. Tzatzarov also confirmed that Bulgarian and UK law enforcement had been cooperating on the case since October 2018. He, however, appeared to discount the hypothesis that the 2015 poisonings in Bulgaria may have been linked to poisoning agents of the Novichok family, which he substantiated with the fact that “no chemicals in the CWC (Convention of Chemical Weapons) lists of banned substances were found in extensive testing”.

Bellingcat and its reporting partners approached several experts on chemical weapons for further comments on the possible poison used in Bulgaria, based on the symptoms described and the full report from Verifin.

All consulted experts, including Vil Mirzyanov, who worked on the development of Novichok as part of the Soviet Unioin’s secret chemical weapons program, concurred that the Verifin report cannot conclusively prove or disprove whether Novichok, or a similar substance, was used in the poisoning of Mr. Gebrev. Speaking to Bellingcat, Mr. Mirzyanov said that standard OPCW-standard compliant tests like the analysis conducted by Verifin are not suited to identify the use of Novichok, which is not а part of the banned list of substances under the CWC. Mr. Mirzyanov confirmed that a repeat test by the same laboratory, targeted specifically at the possible metabolysed traces and artifacts left by Novichok poisoning, is likely to prove or disprove the Novichok theory.

Verifin has confirmed to our reporting partner Helsingin Sanomat that it holds patient samples for a minimum of five years, which would mean that Mr. Gebrev’s samples are available for re-testing at least until June 2020. Verifin has confirmed to the reporting team that if requested by the patient, a custom-tailored analysis could be performed.

“Fedotov” returned to Sofia on a direct flight from Moscow once more, on 23 May 2015. He left the country on 29 May 2015 by car, crossing into Serbia in the company of two Russian citizens. According to sources in Bulgarian law enforcement interviewed by our reporting partner in Bulgaria,, one of the two companions had been present in London during the poisoning of the Skripals in March 2018. Fedotov flew from Belgrade to Moscow on the next day, 30 May 2015. This return visit to Bulgaria broadly coincided with Mr. Gebrev’s release from hospital, and subsequent reentry with renewed poisoning symptoms.

2016 and 2017 Hotspots

Following his Bulgaria trips, Fedotov made one more trip five-day trip to Turkey in August 2015.

During 2016, he traveled to London twice. His first visit was at the end of March, and he stayed in London six days until 1 April 2016. He returned to London for a four-day visit on 14 July 2016. Notably, or perhaps entirely coincidentally, these two trips were shortly before and after the Brexit referendum.

On 5 November 2016, Fedotov flew to Barcelona, and left back to Moscow from Zurich six days later. He returned to Barcelona one more time: on 29 September 2017, two days before the Catalunya independence referendum. Once again, by coincidence or otherwise, Fedotov remained in Spain during the October 1 vote, and flew back via Geneva to Moscow on 9 October 2017. He flew back to Geneva one more time three weeks later, on October 30, and returned to Moscow on 8 November 2017.

The Skripal Poisoning

At the end of 2017, Fedotov took a trip to Armenia. He stayed there between 23 December and 2 January 2018.  Only a week later, he flew to Zurich on January 10 and returned from Geneva on 17 January 2018. This would be his last trip before the London visit during which the Skripals were poisoned.

Traveling as “Fedotov”, Denis Sergeev arrived in London early in the morning of 2 March 2018, leaving Moscow at 7:00 on Aeroflot flight SU 2580. The other two suspects, Mishkin and Chepiga, would arrive on a later flight that afternoon.

It is unclear what Fedotov’s role may have been, if any, in the preparation and execution of the poisoning operation. We could also not establish if he traveled to Salisbury on any of the days he was in the UK. He had booked a return flight on Aeroflot’s SU 2579
from Heathrow to Moscow in the afternoon of March 4, the day on which Sergey and Yuliya Skripal collapsed unconscious.

However, he never boarded that flight. PNR records seen by Bellingcat and its investigative partners show that despite checking in to that flight around noon on March 4, “Fedotov” was a last minute no-show. Instead, using transportation that has yet to be identified by us, he made his way to Rome, and boarded a flight at 15:30 that same day back to Moscow.

In the next part, set to be published next week, we will detail how we identified Denis Sergeev, despite concerted efforts by Russian authorities to purge all public records of him and the two Skripal poisoners, Anatoliy Chepiga and Alexander Mishkin.

Correction: the itinerary graph above contains one incorrect destination entry for the last trip of 2017. The destination was Geneva, Switzerland, and not Yerevan, Armenia. The original data was obtained from border crossing records which reflect the traveler’s own declaration of destination. Subsequently obtained travel and telephone records show that Fedotov (Sergeev) traveled to Geneva, but reported Yerevan to border authorities, possibly for opsec reasons.

Moritz Rakuszitzky

Join the Bellingcat Mailing List:

Enter your email address to receive a weekly digest of Bellingcat posts, links to open source research articles, and more.


  1. Dmitry

    Billing at guys, you are really stupid… UFMS 770001 just mean that passport issued not by territory FMS but any ex-territory service – like commercial passport-visa services, group passport issue, etc. For example my son and my wife have passports used by this FMS because I want to receive passport in 1 week instead 4-5 as in normal FMS. Are you think that 5-years child can work for FSB?! You need to check your sources more carefully! This number just mean that passport issued by centralized FMS structure instead territory depended.
    If you ask MFA for ordinary passport issue it also will be issues by this FMS from MFA-dedicated passport number allocation.

    • Black Star

      “Billing at”

      You meant to write “Bellingcat”, but your spelling got “corrected”. Obviously you are new to this thing since your computer has not yet learned this word 😀

      Do not waste any more of your time at trying to deny the already proven, it is useless trolling.

      • Germann Arlington

        Does the fact that your computer does not autocorrect Bellingcat mean that you are a professional Bellingcat supporter?

        Any claim is only proven if it can’t be disproven and some of the Bellingcat’s supporting evidence is dubious at best.

        • Black Star

          I rearranged your message. Here:

          Some of the Bellingcat’s supporting evidence is dubious at best. Any claim is only proven if it can’t be disproven.

          The latter sentence means you, since you do not present *any* evidence.

    • Eddie

      Still huffing and puffing with the maskirovka. We all know that Chepiga and Mishkin are guilty. You’re wasting your time.

    • K

      Good Grief, is there no end to Russian lies? I am sure that you believe you’re turning the tide of public opinion here, and – you’re correct. But not in the way that you think.

      • Yeah, Right

        K – why the ad-hom?
        What is the point?

        Bellingcat has insinuated that “the same 770001 passport desk” is a significant fact (they refer to it twice) and indicates nefarious intent on the part of the passport-holder.

        Demitry insists that the code “UFMS 770001 just mean that passport issued not by territory FMS but any ex-territory service” i.e. it is meaningless and indicative of nothing.

        He is being quite specific in his objection, and therefore it is testable – so I see no reason for you or Eddie or Black Star to simply handwave that objection away.

        If Dimitry’s claim is wrong then Bellingcat should have no trouble refuting it.

        Until they do then his objection has not been disproved and, therefore, should not be so casually dismissed.

        Honestly, the burden of proof lies with Bellingcat, since they are the people making the accusation.

    • Servus

      Priviet “Dima”,
      Maybe the following observation by Bell?ngcat investigators explains why your relatives got the passport from the unit 770001 ?

      “Bellingcat has subsequently discovered that this same office had also issued passports to Russian civilians with links to the Russian Ministry of Defense — either through direct employment or via a close family member.”

      Also, why would a simple citizen, Dmitry, make an effort and check his wife’s and son’s passport and write an emphatic note defending the honour of the UFMS 770001 ?

      Raises doubts over veracity of your story, maybe some of your probable colleagues had a better idea saying that “UFMS 770001 does not exist”, this would be a classical response, nice to see that tradition does not die out.

  2. RobS

    Your team of journalists are absolutely some of the best in the field of investigative journalism, reading your articles are like reading a spy novel where the twists just keep on adding up.

    If there is any way I could help, please dont hessitate to ask.

    • Boris

      OK, try to prove or disaprove, based on OSINT (to find you fit in or not) the following message few min before yours
      Billing at guys, you are really stupid… UFMS 770001 just mean that passport issued not by territory FMS but any ex-territory service – like commercial passport-visa services, group passport issue, etc. For example my son and my wife have passports used by this FMS because I want to receive passport in 1 week instead 4-5 as in normal FMS. Are you think that 5-years child can work for FSB?! You need to check your sources more carefully! This number just mean that passport issued by centralized FMS structure instead territory depended.
      If you ask MFA for ordinary passport issue it also will be issues by this FMS from MFA-dedicated passport number allocation.
      Tks/ Bellingcat senior corporal Boris

    • Germann Arlington

      The Intelligence Agencies have these and many more “rights”, even when they don’t have the rights can can do many more things covertly.

  3. Mr. Robert from Rome

    Gentlemen, please forgive my English I only know how to use google translator so I hope to be a good one. My question is this: how do you tell and say that Anatoliy Chepiga and Dr. Alexander Mishkin were two tourists visiting the city of Salisbury? It’s one of the biggest stupid things I’ve ever heard. Who would leave Russia in March to visit Salisbury, one of the ugliest cities in Britain? in March you do not even go to visit Venice which is another thing, right? I would like to ask you, to which travel agency have these two Russian tourists turned? Did you understand me?

    • Servus

      In an interview in ” Russia Today” , Chepiga and Mishkin claimed to be tourists with interest in medieval sites. Nobody else claimed that nor believed the two GRU tourists.

    • concerned citizen

      Here in the real world, Salisbury gets a lot of tourists because its near Stonehenge which is the 4th most visited site in the country outside London with 1.38 million visitors a year.

      And of course it has its own famous cathedral.

      • Black Star

        And here in the even more real world, those “tourists” did not even visit the cathedral, instead taking a walk in freezing weather in suburbs. Wonder what was so interesting to see there.

        • concerned citizen

          They said they did visit the cathedral, didn’t they?

          Nobody has proved they didn’t, to my knowledge.

  4. DavidB

    Excellent work, Bellingcat ! As usual. It’s funny how you can measure the quality of your work with the number of Russian trolls critics on your page. I’m glad they can at least enjoy this page of freedom since they don’t have it “at home”.
    Dear Russian trolls: this page is for you, be happy !

  5. Marquis

    As we approach the one year mark, do our authors and the readers wonder why 3 experienced GRU agents were needed to (not) kill a diabetic spy?
    It would seem obvious that Sergei was still in the “spy game” and as the three GRU chaps had made previous visits to the UK, and intersected their European travels with Sergei, it seems obvious that this Salisbury saga was not a “hit”.
    In addition, did the 3 agents receive their visas from the UK Embassy in Moscow, where I assume their genuine fingerprints were submitted?
    That would mean, that UK Border Agency would immediately know when the three boarded a plane heading to the UK.

  6. Eddie Storey

    You’re wasting your time trying to blow smoke up people’s backsides. The facts have been established and the timelne is clear..

    IBackground: A GRU officer who defects to the West, for whatever reason In this case Sripal was a double agent), is considered a traitor, by the GRU and other Russian security services at the very least. In Russia, the penalty for treason is death. [Anecdotal evidence: a Russian “diplomat” (actually an Ambassador’s male secretary, i.e. his bodyguard) personally said to me 6 years ago that “Litvinenko deserved to die”, his actual words. I was shocked at the time but it was an insight into the depth of Russian “patriotism”.]

    MMO: It’s not definitely established that “Ruslan Boshirov” and “Alexander Petrov” had the Means (the smuggled perfume bottle full of novichok that later killed an innocent civilian), but they certainly had the Motive (Skripal is a traitor and traitors deserve to die) – which especially applies if “Boshirov” is a GRU officer, as well as the Opportunity (the Russians were caught on camera 200m from Skripal’s home on the day they were poisoned). Circumstantially Russia also has form when it comes to assassinating former agents by poison (Litvinenko etc). Finally, the timeline is compelling …:

    TIMELINE: Friday 2nd March 15:00, the suspects are filmed arriving at Gatwick airport for their “tourist visit to Salisbury”. Instead of travelling to Salisbury for the weekend, they check in at a hotel in East London.
    The day after, Saturday 3rd March 14:25 the Russians are filmed arriving at Salisbury railway station;
    Saturday 16:11, after spending less than 2 hours in Salisbury (due to the snow bwhahaha), they’re filmed leaving Salisbury railway station on their way back to London;
    The following day, Sunday 4th March 11:48 the Russians are again filmed arriving at Salisbury railway station;
    Sunday 11:58 they’re caught on CCTV from a petrol station 200m from Skripal’s home (1.5 km in the opposite direction from the cathedral);
    Sunday 13:50 they catch the train back to London;
    Sunday: 16:15 an emergency services call reports that Skripal and his daughter have been found unconscious on a public bench in the centre of Salisbury by a passing doctor and nurse;
    Sunday 19:28 the Russians are filmed going through passport control at Heathrow Airport. In other words, they make a quick getaway to Russia, a country that never extradites its own citizens.

    No matter how sceptical you are, you can hardly deny that the above facts are damning to say the least.

  7. Yury

    Brilliant work done.
    I am from Russia and would like to help you in your investigations.
    So, let me know, if any help will be needed.


Leave a Reply

  • (will not be published)

You can support the work of Bellingcat by donating through the following link: