How a Bulgarian cleaning lady became a Russian spy

By Deutsche Welle (World News) | Created at 2025-04-01 11:41:12 | Updated at 2025-04-04 23:43:30 3 days ago

About 10 years ago, Tsvetanka D., a Bulgarian national, moved to the Austrian capital, Vienna. For a time, she worked as a cleaner. It is not known whether she had any jobs after that.

Whatever she did, it seems that she had plenty of spare time because she was very active on social media. Over the years, her posts opposing COVID vaccines and in support of Russia's policies and Austria's far-right Freedom Party (FPÖ) grew and grew.

"She was always posting nonsense on Facebook — pro Putin, pro Russia ... that kind of stuff," says Plamen B., a Bulgarian national who employed Tsvetanka D. in a cleaning company in Vienna for a short time in 2015.

"But more like a typically confused person, one of those people who is really susceptible to propaganda," he said.

But there was nothing remotely "typical" about Tsvetanka D. According to information provided on March 24 by Austria's Directorate State Protection and Intelligence Service (DNS), Tsvetanka D. was indeed employed, but not in a regular job: she was instead working as a Russian agent.

A man in a white patterned shirt and blue blazer looks into the camera. His face is illuminated from the right, which means that the left-hand side of his face is in darkness

Although the DNS did not actually reveal the name of the Bulgarian national in question, it was later made public by the BBC.

What did Tsvetanka D. do?

Tsvetanka D. was obviously tasked with spreading Russian disinformation in Austria.

To this end, she posted stickers around the Austrian capital. The stickers were meant to appear pro-Ukrainian, but actually included Nazi symbols. The aim was to spread the Russian disinformation that Ukrainians are Nazis.

She was also tasked with spreading similar disinformation online. Tsvetanka D. has obviously admitted to the Austrian authorities that her most active period was in 2022, the year Russia began its all-out invasion of Ukraine.

But she was apparently entrusted with more complicated tasks, too, such as carrying out surveillance of targets like Omar Haijawi-Pirchner, head of the DNS, investigative journalist Christo Grozev and Anna Thalhammer, editor in chief of the Austrian weekly news magazine profil, which is known for its investigative journalism.

"Late last summer, I got a phone call from the agency responsible for the protection of the constitution," Thalhammer told DW.

Jan Marsalek. Can you provide any information?' and the Munich telephone number 089 29 100

"They told me that there had been a plan to steal my laptop and cell phone and bring them to Moscow," she said. "In December, they phoned again to tell me I could look at the files at the public prosecutor's office. Those files contained details, among other things that it really was Ms D. who had been following me around for months."

Tsvetanka D. was even supposed to film investigative journalist Christo Grozev, who was put on the Russian Interior Ministry's wanted persons list in 2022. To this end, she rented an apartment in Vienna opposite the place where he was living at the time.

How was Tsvetanka D. recruited?

People in Vienna who know Tsvetanka D. say that when the COVID-19 pandemic began in 2020, she began spreading incorrect and misleading information about the virus and, later on, about vaccines.

This is not surprising, given that Bulgaria is the country with the lowest COVID vaccination rate in the European Union. This is due to the spread of incorrect information and a mistrust of vaccines in general.

It is likely that this is how Tsvetanka D. came to the attention of a Russian spy cell operating out of the United Kingdom. The cell consisted of Bulgarians living in the UK. Six of them were convicted of carrying out espionage operations in early March.

The Marsalek connection

All of the convicted Bulgarians worked for Jan Marsalek, an Austrian national and former chief operating officer of the collapsed German payments processing company Wirecard.

Marsalek is presumed to have fled to Moscow and coordinated espionage and disinformation operations in Europe from there.

Christo Grozev was the target of most of these operations. Indeed, according to information from London, there were plans to abduct and even kill him.

A bald man with glasses smiles into the camera. He is standing on a bridge at night over what would appear to be a river. In the background, a row of buildings is lit up in the colors of the rainbow and a big wheel is illuminated in pink

Tsvetanka D. was supposed to help with all this, as was another Bulgarian woman, whose identity was uncovered by the BBC: Cvetelina G. worked at the airport in the Bulgarian capital, Sofia, where she tracked how and when journalists and Russian dissidents entered and left the country.

Anna Thalhammer had also spent a lot of time researching Jan Marsalek and had revealed, among other things, that two former Austrian officers, Egisto O. and Thomas V., had collaborated with the Russian services and were contacts of Marsalek.

Russian secret services recruit 'normal' people

Tsvetanka D. was recruited by three of the Bulgarians in the UK. One of them was Vanya G.

Both she and Tsvetanka D. claim that they did not know exactly what they were doing. According to Vanya G., her partner, Biser D., who was also a member of the London-based spy cell, lied to her, telling her than they were working for Interpol. Tsvetanka D. told exactly the same story in Vienna.

Vanya G. is a beautician. According to people in London who know her, she was not interested in politics.

"People who know Vanya describe her as a very quiet and naive woman," says Vasil Hristov, a Bulgarian journalist in the UK and president of the Foreign Press Association in London. "According to several experts, the Russian secret services intentionally recruit very normal people who are not conspicuous. Vanya's profile fits right into this framework," Hristov told DW.

Journalist Anna Thalhammer does not believe Tsvetanka D.'s claim that she had no idea what she was doing.

A woman with shoulder-length brown hair in a bright blue turtle neck and dark blazer stands against a gray background with her arms folded, smiling into the camera

"The assumption that an arrested Russian spy is going to tell the truth is laughable," she said. "She told a completely far-fetched story about how she didn't know who I am, who Christo Grozev is and who Haijawi-Pirchner is. It's ridiculous: You follow somebody around for weeks, but allege that you don't know who that person is and never even googled them."

Russian agents still active in Europe

The members of the London-based cell are currently waiting for the court's final judgment.

Tsvetanka D. is currently in Austria. Although investigations continue, she is no longer in custody.

For the remaining alleged member of the group, Cvetelina G., however, nothing seems to have changed. At the time of publication, the Bulgarian authorities had made no comment on the matter.

Does this mean that Marsalek's spy network has collapsed? Anna Thalhammer is certain that it doesn't. "The information I have is that the authorities assume that there are other cells," she says.

"The idea of this structure is that if the cover of one cell is blown, there is another one waiting in the wings. They are often intentionally not in contact with each other, but work on the same objective," says Thalhammer.

It would appear that Bulgarians are often involved. "It seems that these are not well trained spies, but criminals following orders," says Thalhammer. "Bulgarian names regularly pop up in Russian spy networks. There is obviously cooperation between criminal networks in Bulgaria and Russia."

This article was originally published in German.

Read Entire Article