Sofia, Bulgaria – Investigative journalist Christo Grozev has alleged that Bulgarian journalist Dilyana Gaytandzhieva collaborated with Unit 29155 of the Russian military intelligence agency, the GRU – a secretive and notorious group tied to high-profile assassinations, sabotage operations, and cyber warfare across Europe.
The accusations, revealed through an in-depth investigation published on The Insider by Grozev and fellow journalist Roman Dobrokhotov, claim that Gaytandzhieva was involved with Unit 29155’s cyber-division from as early as 2016.
The report marks the first public disclosure tying the GRU unit, previously associated with physical sabotage and targeted killings, directly to extensive hacking operations and information manipulation campaigns.
Speaking to Bulgarian National Television (BNT), Grozev disclosed that the journalist had been in informal contact with operatives linked to the GRU’s cyber unit via private Twitter chats, beginning around 2016.
“It pains me to name her,” Grozev said during the interview, noting that although he and Gaytandzhieva had disagreed ideologically in the past, he had not suspected that she was involved with what he described as “Russia’s most ruthless intelligence division.”
Unit 29155: A Ruthless Arm of Russian Intelligence
Unit 29155 has gained global notoriety for its role in the attempted coup in Montenegro in 2016, the Salisbury poisonings in 2018, and the sabotage of ammunition depots in Bulgaria and the Czech Republic.
Its operatives, often operating in the shadows, are alleged to be behind some of the GRU’s most aggressive and covert foreign operations.
But this new investigation shows the unit’s reach extended well into cyberspace. Leaked data uncovered by The Insider revealed that Unit 29155 had also established a hacking department which engaged in cyberattacks across Europe, particularly in Ukraine.
According to Dobrokhotov, the group had attempted to destabilize Ukraine prior to the 2022 full-scale Russian invasion and had breached digital infrastructure in Poland and other NATO nations.
“Until now, no one knew they had a cyber unit,” Dobrokhotov told Nova TV. He described the team as “incompetent and careless,” revealing that their internal server was left entirely exposed — a lapse that enabled journalists to identify members, trace targets, and connect the unit to Gaytandzhieva.
Gaytandzhieva’s Role and Recruitment
According to the report, Gaytandzhieva was recruited by GRU-linked hacker Amin Stigal. She allegedly helped spread disinformation using leaked and doctored documents.
One example cited was her reporting on alleged arms shipments using Azerbaijani diplomatic flights — a story published around the same time she was in contact with Stigal.
Dobrokhotov explained that her role was to give Russian propaganda the appearance of legitimacy by broadcasting it through a European voice. “Her reporting was cited by Russian state media to support narratives attacking the West,” he said.
While no communications have been traced to the past year, Grozev expressed concern for Gaytandzhieva’s safety, noting that the GRU often eliminates former collaborators who are considered liabilities.
Denial and Legal Threats
Gaytandzhieva has firmly denied the accusations, calling them “false and defamatory.” In a public statement, she vowed to initiate legal proceedings against both Grozev and Dobrokhotov, asserting that the investigation aimed to destroy her reputation. She maintains that her reporting has always been independent and based on verified sources.
Gaytandzhieva, who previously worked for Bulgarian outlets including “Trud” newspaper, now writes for the news website Obektivno.
She has gained attention for her controversial investigations into Western military operations, including her coverage of alleged U.S.-run biolabs in Georgia and Ukraine — claims dismissed by international experts as conspiracy theories rooted in Kremlin disinformation.
A Pattern of Influence
Dobrokhotov said that evidence of Gaytandzhieva’s collaboration was derived from hacked communications, including messages sent via GRU-managed Twitter accounts. These communications were obtained with help from Bulgarian activists who had access to the compromised data.
He further stated that while Gaytandzhieva might argue she didn’t know she was communicating with GRU operatives, the volume of evidence — including overlapping timelines, her presence in locations with known agents, and the nature of her reporting — leaves little room for doubt.
“She was in Tbilisi at the same time as Amin Stigal. She was meeting sources he had also met. And her reporting mirrored the talking points of Russian disinformation campaigns,” Dobrokhotov said.
A Widening Investigation
The revelation comes amid growing scrutiny of Russian influence operations across Europe. While Unit 29155’s physical sabotage campaigns have been well documented, the extent of its cyber activities remained largely hidden until now.
The group’s cyber unit, according to The Insider, operated haphazardly. Members included underqualified recruits such as military academy students and amateur programmers.
Instead of focusing on covert intelligence work, some used their aliases for personal perks — booking escorts, traveling with partners, and spending money meant for operations on themselves.
One campaign reportedly involved paying Ukrainians to graffiti anti-Zelensky slogans in an attempt to create a false sense of public dissent.
Dobrokhotov emphasized the unit’s corruption and lack of professionalism. “Much of their budget was embezzled,” he claimed. “They weren’t elite hackers — they were opportunists pretending to be.”
Implications for Bulgaria
While the cyber division did not directly target Bulgarian infrastructure, Dobrokhotov noted that Bulgaria had already suffered GRU-linked operations, including the 2015 poisoning of arms dealer Emilian Gebrev with Novichok and the destruction of weapons depots.
He now hopes Bulgarian authorities will act on the new revelations. “It’s difficult to work with foreign intelligence without leaving any traces,” he said, urging officials to launch a formal inquiry into Gaytandzhieva’s activities.
So far, there has been no official response from the Bulgarian government or intelligence services.
Consequences and Concerns
Dobrokhotov warned that Gaytandzhieva now faces two significant threats: legal repercussions in Bulgaria, where collaboration with foreign intelligence could constitute treason, and potential danger from the GRU itself. The agency has a well-documented history of eliminating operatives who become liabilities.
He suggested that the journalist may be safer cooperating with Bulgarian authorities than remaining silent, adding that if she has indeed acted unknowingly, now would be the time to come forward and clarify her role.
Looking Ahead
While this is the only known case of direct collaboration between a European journalist and Unit 29155, Dobrokhotov said the investigation is ongoing and hinted at the possibility of more revelations in the future.
“This is just the beginning,” he stated. “We’ve exposed the tip of the iceberg. There could be others — and if there are, we will find them.”
As Bulgaria grapples with the implications of this scandal, the revelations shed new light on the scope and strategy of Russian hybrid warfare, underscoring how disinformation, hacking, and targeted collaboration with individuals in foreign media continue to form the backbone of Moscow’s covert influence campaigns in Europe.