Bulgarian investigative journalist Christo Grozev has revealed that a Bulgarian journalist was involved in the operations of Unit 29155 of the Russian military intelligence service, the GRU. This unit is known for carrying out high-profile assassinations, sabotage, and disinformation campaigns. The findings were made public by Grozev and Roman Dobrokhotov on the Insider website, exposing how this GRU unit also engaged in hacking and information manipulation, often collaborating with journalists worldwide to achieve its objectives.
Grozev told the Bulgarian National Television (BNT) that the Bulgarian journalist in question is Dilyana Gaytandzhieva. He shared his personal disappointment about having to name her, explaining that although they had previously clashed over ideology, he had not imagined that she had been working with what he described as the GRU’s most ruthless division – a department that not only orchestrates assassinations but also targets dissidents, traitors, and foreign competitors.
According to Grozev, Gaytandzhieva‘s involvement with the GRU’s Unit 29155 dates back to 2017. He said their communication took place through informal channels, notably via a closed chat on Twitter. Grozev pointed out that by the time of the first verified exchanges in 2017, their relationship had already been ongoing for at least a year. While there have been no records of direct communication for roughly a year now, Grozev expressed concern for Gaytandzhieva‘s safety, noting that former agents or collaborators often remain vulnerable.
This revelation comes amid broader findings about the GRU’s shadowy cyber-operations. The Insider’s investigation, based on leaks and digital traces, indicates that Unit 29155 has not only engaged in covert killings and sabotage – including the attempted coup in Montenegro, the poisonings in Salisbury, and the attacks on arms depots in Bulgaria and the Czech Republic – but also has run an internal hacking division. This group of hackers was allegedly responsible for cyberattacks intended to destabilize Ukraine prior to the full-scale invasion in 2022. The U.S. Department of Justice has even indicted several members of the group for large-scale cyber operations against Ukrainian targets and NATO allies.
For the first time, Unit 29155 has been tied directly to these hacking operations – a role previously thought to be outside its scope. Among other actions, the unit’s hackers published sensitive data about Ukrainians, probed networks tied to NATO states, and breached systems linked to Poland’s critical transportation infrastructure.
The investigation by The Insider further uncovered that this unit worked closely with external partners, including Gaytandzhieva. She was reportedly recruited by Amin Stigal, a hacker linked to Unit 29155, to spread disinformation based on hacked documents. These materials allegedly exposed arms shipments using Azerbaijani diplomatic flights, a topic Gaytandzhieva published at the time.
In his conversation with BNT, Grozev emphasized that many journalists working with this GRU unit were fully aware of who they were collaborating with, either from the start or once they were explicitly told. He described the hacking unit as corrupt, disjointed, and sometimes at odds with its own leadership, yet capable of striking blows in the digital realm to serve Russia’s military interests in Ukraine and Syria.
In response to these revelations, Dilyana Gaytandzhieva denied the allegations entirely. She stated that the claims by Grozev were false and defamatory, vowing to take legal action against both the author and those spreading the accusations. She described the entire investigation as a malicious attempt to tarnish her reputation, promising to prove the falsity of the allegations in court.
Dilyana Gaytandzhieva has previously worked for various newspapers and TV stations in Bulgaria and currently writes for the website “Obektivno.”
In an interview with Nova TV following the publication, Roman Dobrokhotov explained how their latest investigation uncovered the secretive hacking group within Unit 29155. Although the unit is infamous for its sabotage, assassinations, and operations in Europe, Dobrokhotov noted that no one had previously known about this specific cyber division. Contrary to their reputation as elite hackers, the investigation found the group to be surprisingly incompetent and careless, leaving their server completely exposed. This allowed the journalists to trace their targets and reveal the group’s members.
Dobrokhotov described the group as unprofessional and even “stupid,” explaining how they used their fake identities for personal indulgences rather than covert operations – booking prostitutes and traveling with lovers while posing as operatives. Their internal security was so weak that it exposed the entire history of their targets, which included infrastructure companies in Ukraine and various organizations across Eastern Europe. Many of these targets had no military significance, like medical and technology companies.
He shared that he was initially expecting to uncover grand operations, but some of the group’s work turned out to be trivial. One example was a campaign where they paid hundreds of thousands of dollars for people in Ukraine to paint insults directed at President Zelensky on walls, manufacturing the illusion of domestic hatred for the Ukrainian leader.
Dobrokhotov offered two main reasons for the unit’s poor performance. Firstly, the hacking group was formed by people with no relevant expertise. Rather than trained cyber operatives, it was composed of military academy students, ordinary programmers, and data thieves, none of whom had the skillset to run professional hacking operations. Secondly, the team was deeply unmotivated and more interested in enriching themselves. According to Dobrokhotov, insiders reported that a significant portion of their budget was simply embezzled rather than spent on operations in Ukraine.
Regarding Bulgaria, Dobrokhotov clarified that while this unit had carried out sabotage in Bulgaria – including the poisoning of arms dealer Emilian Gebrev with Novichok and the sabotage of weapons depots – the cyber division itself did not attack Bulgarian targets. Instead, the Russian operatives used a different approach to influence Bulgaria: they collaborated with Dilyana Gaitandzhieva, whom Dobrokhotov named directly.
He explained that Gaitandzhieva began cooperating with the GRU as early as 2016, first as a reporter for “Trud” newspaper and later as a freelance journalist. Her work was used by Russian propaganda to amplify disinformation campaigns. One key aspect of her role was to legitimize Russian narratives by presenting them through a European journalist’s voice, making them more credible to an international audience.
Dobrokhotov revealed that they have evidence of this collaboration, including direct messages exchanged through a GRU-managed Twitter account. These details were reportedly provided by Bulgarian activists who had access to the compromised account.
Addressing Gaytandzhieva‘s public denial of the allegations, in which she called the investigation a malicious slander, Dobrokhotov said her reaction was predictable. He argued that it would be difficult for her to defend herself given the evidence. She might claim ignorance of who was behind the Twitter account, but Dobrokhotov pointed to numerous coincidences: her repeated promotion of conspiracy theories like the supposed U.S. biolabs in Georgia and Ukraine, her simultaneous presence in Tbilisi with known GRU agent Amin Stigal, and her direct interviews with individuals whom Stigal had also met.
He also noted that her name had already appeared on the Ukrainian site “Myrotvorets” as an enemy of Ukraine two years ago. While Bulgarian authorities have not acted on this information, Dobrokhotov expressed hope that the data published would be enough to prompt an official investigation. He stressed that it is very difficult to hide collaboration with foreign intelligence for so long without leaving any trace.
When pressed about the sufficiency of the evidence, Dobrokhotov said the amount and consistency of the findings left no doubt in his mind. He explained that the pattern of direct contact, overlapping timelines, and repeated Russian propaganda themes went far beyond mere coincidence.
As for Gaytandzhieva‘s motivations, Dobrokhotov believes that while she was paid for some of her work, the main driver was likely her desire for attention and to be perceived as an investigative journalist exposing Western wrongdoing. He speculated that she might have even believed in the narratives she was helping to spread.
Dobrokhotov concluded by saying that Gaytandzhieva now faces two serious dangers: potential prosecution for treason in Bulgaria, and the risk of harm from the GRU itself, which has a track record of eliminating those it deems untrustworthy or who know too much. He urged her to cooperate with Bulgarian intelligence, suggesting that it might be safer to spend time in prison than to continue living under threat from Russian intelligence.
Dobrokhotov said that while the GRU had attempted to recruit and influence many other journalists, no other cases of direct collaboration like Gaytandzhieva‘s had emerged so far. He left open the possibility that there might be others yet to be uncovered.
Read more on this story: The Insider
0 Comments