Have You Seen These Men?

What if I told you that in 2016, Russia was just  

a few blunders away from violently  overthrowing a European government?

It was election day in the tiny  Balkan country of Montenegro,  

home of the world's tallest men and the  setting of James Bond's Casino Royale.

On that day, a secret plot had just been thwarted.

Late that evening, Montenegro's  prime minister, Milo Djukanovic,  

announced that the country's special  services had just arrested 20 Serb citizens.

He claimed that they had been  planning a paramilitary coup to  

throw the country into chaos and  potentially to assassinate him.

From the outside, the story sounded  borderline cartoonish. In fact,  

it was so outlandish that much of  the world didn't believe it was real.

According to the prime minister, the  alleged plot involved members of the  

coup infiltrating parliament  dressed as fake policemen,  

staging a false flag attack on the protesters,  and installing a pro-Russian government.

Global media barely registered this as news.

It seemed like the kind of  wild conspiracy theory that  

authoritarian leaders sometimes invent  to discredit their own opposition.

Many observers, including opposition figures  in the country, laughed at the government's  

allegations, suspecting Djukanovic, who was  fighting corruption charges at the time,  

had faked a false flag coup himself  to make himself popular again.

It was a typical he said, she  said situation. But 8 days later,  

something happened that started to  make the story sound less absurd.

Serbian police arrested two Russian citizens.

They were found in possession of  counterfeit Montenegrin police uniforms,  

€122,000 in cash, and sophisticated  encrypted communications equipment.

It was clear that they weren't just tourists.

But who were they and what were they doing there?

My team was determined to find out.

Hi, I'm Christo Grozev, an investigative  journalist who has spent years exposing  

Russian intelligence operations across Europe.

This is the latest episode of our ongoing series  on Russia's Unit 29155, the covert military unit  

specializing in sabotage, assassinations,  and political destabilization missions.

If you've been following this series,  you know that we've already uncovered  

how the unit was behind the  Skripal poisonings in Salisbury,  

England, the attempted murder of a  Bulgarian arms dealer, Emilian Gebrev,  

and the coordinated campaign to blow up  munition depots across NATO territories.

But those were just a few of the  unit's operations in recent years.

Today, I'm going to tell you the story of how  our joint team at Bellingcat and The Insider  

at the time uncovered Unit 29155's role  in what almost was one of the most brazen  

operations of Russian interference in  European politics since the Cold War.

An attempted coup in Montenegro, designed  to prevent the country from joining NATO.

Now, back in 2016, when this  coup attempt took place,  

I was just beginning to investigate  Russian intelligence operations.

But as I investigated more and more cases,  I not only became aware of what Russian  

military intelligence, the so-called GRU,  was capable of and how far they would go,

I also began to develop a sense of who the  key players were, what the actual agents were,  

what the military units comprised,  

and how they operated, and where  their main headquarters were located.

And these were critical  ingredients to cracking this case.

But before we get into how we uncovered the truth,  

let's discuss some important political  context about Montenegro in 2016.

Since gaining independence from Serbia in  2006, 10 years earlier, this small Balkan  

nation of just 620,000 people had been  walking a tightrope between East and West.

And then in 2015, the Montenegro government made  

a decisive choice supported  by much of the population.

They decided to join NATO.

As we've seen repeatedly across Eastern Europe,  any country's movement toward Western institutions

triggers an almost reflexive response from Moscow.

Montenegro was no exception.

In December 2015, Kremlin spokesperson Dmitry  Peskov had explicitly threatened Montenegro with,  

quote unquote, "retaliatory measures"  if it proceeded with joining NATO.

The Russian Parliament threatened to freeze  

all cooperation projects with the  small Balkan country if it did so.

Montenegro, for its part,  largely ignored these warnings.

In May 2016, Prime Minister Djukanovic  signed an accession protocol with NATO,

depriving Russia of a potential ally  with naval access to the Mediterranean,  

very important for Russia.

The Russian response escalated quickly.

On July 14, 2016, Maria Zakharova,  

the spokesperson of the Russian  Foreign Ministry, tweeted,

"The current Montenegro authorities  will bear full responsibility for  

the consequences of their anti-Russian stance."

Just 3 months later, on election day,  we began to see what she may have meant.

Now, back to October 16, 2016.

On that day, Montenegro was  holding parliamentary elections.

As polls closed that evening, Prime Minister  Djukanovic made an extraordinary announcement.

His special services had  just foiled a terrorist plot.

According to Montenegro's  chief special prosecutor,  

the plot was elaborate and could have been  deadly, involving dozens of conspirators.

The first step of the plot would have been for  the conspirators to blend into the crowds of  

opposition protesters gathering just outside the  Parliament building on the night of the elections.

Then a politician from the opposition "Democratic  

Front," an anti-NATO pro-Russian alliance,  would take the stage and trigger both the  

crowd and hidden terrorists to storm  the parliamentary building by force.

The conspirators planned to occupy the building  

for 48 hours and proclaim a  new transitional government.

During this chaos, shooters positioned in the  crowd would assassinate Prime Minister Djukanovic.

Altogether, investigators later suggested that  there had been around 50 armed and trained men  

planning to be in attendance and supplied  with a large cache of rifles and pistols.

The ultimate endgame was to change  Montenegro's political course

and prevent its NATO accession, steering  the country back towards Moscow.

But here's what made the story incredible.

Prosecutors claimed that this  wasn't just a domestic plot.

This was a Russian operation,  a Russian infiltration.

They alleged Serbian and Montenegrin conspirators

had been organized by Kremlin-backed operatives.

When these allegations were published, the  international reaction was initially skeptical.

At that point, Prime Minister Milo Djukanovic's  party had already won the elections.

The story seemed too outlandish  and perfectly timed to reinforce  

the ruling party on election day.

Many observers suspected that this was political  theater designed to discredit the opposition.

But that skepticism only lasted 8 days  

when two Russian operatives were  arrested in neighboring Serbia.

For my team at Bellingcat, when we  started reading about these developments,

the equation completely changed, and  we knew we needed to start digging in.

There was hard evidence of Russian involvement in  

what appeared to be a genuine conspiracy  to destabilize a NATO candidate country.

And maybe, just maybe, we could identify these  two Russian men who had just been arrested.

Our investigation began with the limited  

information Montenegro had  released about the two men.

They were identified only by their cover (fake  names), Eduard Shirokov and Vladimir Popov.

Montenegro had issued Interpol  notices, "red notices" similar  

to international wanted posters for both men.

So we had their passport photos, birth  dates, and claimed places of birth.

And then on February 19th, even more  helpful information was released.  

Montenegro's special prosecutor announced  that Eduard Shirokov was actually an alias.

The man's real name was Eduard Shishmakov, a tip  provided to them by Polish intelligence services.

This was very revealing.

It validated that we were really dealing with  a Russian agent, a state-issued false document,  

and aliases are typically reserved  for active intelligence operatives.

The special prosecutor announcement also revealed

more to us about Eduard Shishmakov's background.

Shishmakov wasn't some freelance  mercenary or nationalist extremist.

He was a career GRU officer with an extensive  military and intelligence background.

Born in 1971 into an army officer's family,  

Shishmakov had finished secondary school at a  Soviet military base in Halle, East Germany.

In 93, he graduated with distinction from the  Black Sea Military Navy Institute in Sevastopol.

Following Navy school, he studied at  the military diplomatic academy at the  

Russian Defense Ministry, a training  institution for military attaches and  

for GRU intelligence officers that would be  expected to operate under diplomatic cover.

But one thing in Shishmakov's  past was particularly significant.

In 2013, he began serving as naval military  attaché at the Russian embassy in Warsaw.

And in November 2014, less than two  years before the Montenegro plot,

He had been expelled from Poland  and declared persona nongrada.

The charge? Espionage.

Polish counterintelligence had  called Shishmakov red-handed,  

recruiting a Polish lieutenant colonel who worked  for the Ministry of Defense in that country.

According to court records, Shishmakov had  tasked the officer with providing data on  

hundreds of Polish military personnel with a  history of misdemeanors or disciplinary issues.

They would be considered the  easiest targets for their  

recruitment as informants or spies for Russia.

The Polish Lieutenant Colonel received  17,000 Zloty, about 55,000 euros,  

and was given an encrypted phone  to communicate with Shishmakov.

At the same time, a Polish-Russian lawyer named  Stanisław Sz, full name was never disclosed,  

was arrested for economic espionage in Poland.

Polish media revealed that Stanisław  was apparently handled by the same GRU  

officer as the Lieutenant Colonel,  presumably Eduard Shishmakov.

So Shishmakov's background clearly confirmed that  

he wasn't just a Russian national  or an average Russian tourist.

He was a recently burned GRU operative  with a track record of recruiting assets  

in NATO countries using encrypted communication  

devices and targeting individuals  with compromised backgrounds.

And now he had turned up in Serbia days  after the attempted coup in Montenegro.

Now the second Russian Vladimir Popov proved  much more challenging for us to identify.

Montenegro prosecutors knew him  only by that fake cover identity,  

and we had to work our way  backward from limited information.

His passport photo, his claimed  birth date of June the 29th,  

1980, the supposed birthplace  in Kurganskaya Oblast in Russia,  

and the fact that he had been traveling  alongside other confirmed GRU agents.

Our investigation into Popov began with a  working hypothesis that this was also an alias.

We confirmed this by checking  Russian databases and finding  

that while someone with this name  and birth date existed in records,  

there were no earlier references to this  individual in any databases we consulted.

The entry listed only one passport issued in  2009 and was associated with a Moscow address.

When we contacted the family listed at that Moscow  address, they never had heard of Vladimir Popov.

This random assignment of  a residential address was a  

pattern that we had observed previously with  other undercover GRU operatives in the past.

The breakthrough came when we searched  Moscow vehicle ownership databases.

In a 2011 version of a leaked  Russian traffic police database,  

we found that someone named  Vladimir Popov owned a Kia CEED.

More importantly, his registration  showed 10 unpaid speeding tickets,  

four of which were concentrated near a specific  GRU address at Moscow's Khoroshevskoye Shosse 76b.

That's the GRU headquarters building.

We then used a technique that had  helped us identify other GRU operatives.

We searched Moscow databases using only the first  name and patronymic Vladimir Nikolaevich and the  

actual birth date of June 29th, 1980 while  leaving the last name blank as a wild card.

In Russia, the father's name, the patronymic,  

usually always falls between  the first and last name.

In that same 2011 Moscow vehicle registration  database, we found only one matching entry.  

Vladimir Nikolaevich Moiseev listed as  the owner of a Subaru Legacy Outback.

This person had a password issued  by the Tyumen region in Russia and  

was registered at an address we recognized  Matrosskaya Tishina 10, Military Unit 48427.

Military Unit 48427 is a GRU airborne  Spetsnaz reconnaissance unit that had  

played critical roles in the two Chechen  wars and in the 2008 Russia-Georgia war.

If Moiseev was assigned to this unit before 2008,  

he would have participated in Russia's  military operations in Georgia.

Further database searches confirmed our theory.

We found Moiseev registered at the Tyumen Military  

Engineering Institute in 2004 and  2005 and in residential databases  

for Kurganskaya Oblast with a registered  address in the tiny village of Pivkino

exactly matching the birthplace  listed on Popov's fake birth records.

The smoking gun came in a more recent  vehicle database. Vladimir Nikolaevich  

Moiseev was listed as owning a 2015 Subaru  Outback with a contact telephone number  

identical to the number listed for Vladimir  Popov in the earlier Kia car registration.

This database also revealed that Moiseev's current  

address was in the same apartment  complex where Alexander Mishkin,  

one of the Skripal poisoning suspects,  had been given an apartment by the state.

Both apartments were registered in their  wives' names through similar arrangements.

Transfer of ownership directly from the  city of Moscow to the officers' families,  

unencumbered by any mortgages or payments.

We could now confidently say that  Vladimir Nikolaevich Moiseev was the  

true identity for the second  Russian arrested in Serbia.

And like the Skripal suspects, he maintained  two parallel identities in Russian databases.

His real name for domestic purposes and his cover  identity, Popov, for international operations.

But our investigation didn't stop because we had  

just confirmed that these two  men were both GRU officers.

We wanted to understand how the plot had  unfolded and what evidence supported Montenegro's  

claim that they were trying to overthrow the  government and maybe kill the prime minister.

The prosecution's case relied  heavily on testimony from two  

self-confessed conspirators who had  become informants for the police.  

Alexander Sindjelic, a Serbian former convict  and paramilitary leader, and Mirko Velimirovic,  

a Montenegrin national who had surrendered to  police just a few days before the election.

Sindjelic's story provided a detailed account  of how the Russians had recruited him.

According to his testimony, he had first  encountered some Russian nationalists  

while fighting alongside separatists  in eastern Ukraine in 2014 and 2015.

These contacts invited him to Moscow one day to  

meet with representatives of "the  special services," as he was told.

On September 26, 2016, Sindjelic claimed he  met with Shishmakov (Shirokov), as he knew him,  

and Moiseev (Popov), as he knew him, in what  he described as a luxury apartment in Moscow.

During this meeting, Shirokov showed Sindjelic  a detailed architectural plan of Montenegro's  

parliament building and outlined the plan  for entry and takeover on election night.

Shirokov then ordered Sindjelic  to buy weapons and ammunition,  

providing initial funding in cash and  later through Western Union transfers.

Upon returning to Belgrade, Sindjelic  contacted Velimirovic to procure weapons  

from Kosovo and rent a safe house in Podgorica.

Travel records show that Moiseev, using the  name Popov, arrived in Serbia on September 29th,

While Shishmakov, traveling as Shirokov,  came a few days later on October the 2nd.

There, they provided encrypted Lenovo telephones  

with pre-programmed numbers to Sindjelic,  who passed one of them to Velimirovic.

According to Montenegro police sources  allegedly leaked to Montenegrin media,  

these phones had been purchased  online from a Bulgarian website.

The Montenegrin prosecutors had released  these two testimonies to the public,  

which became key for our investigation.

First, we felt that we had  to verify Sindjelic's claims.

To do that, we began by examining  his social media activity,  

which provided compelling circumstantial evidence.

His VK, the Russian social network  equivalent to Facebook, had a profile  

showing that he had been a vocal opponent to  NATO, the EU, the West, since at least 2013.

His feed was filled with Russian-manufactured  anti-US, anti- Ukraine, and anti-EU propaganda,  

along with posts showing his admiration  for Vladimir Putin, for example.

More significantly, we analyzed the  timing of the social media posts.

Sindjelic was normally an active poster,  averaging seven to eight posts per week.

But on September 25th, 2016, the day  before the alleged meeting in Moscow,  

he posted a selfie from an unknown location.

After this post, Sindjelic went  completely silent on social media  

for 4 weeks until October 20th, 2016, when  he reposted a generic pro-Russian message.

This 4-week gap was highly inconsistent  with his prior online behavior,  

but perfectly consistent with someone working  on a project that required intense focus,  

travel, and minimal digital footprints.

The most compelling evidence came from leaked  audio recordings obtained by Montenegro Media.

On October 19th, 2016, several news outlets  published transcripts and audio of alleged  

phone calls between the conspirators  made on the day before the election.

In one call between Sindjelic and  Velimirovic, Velimirovic expressed  

concern about not receiving clear  instructions for the following day.

Voice analysis comparing Sindjelic's voice  in the recording with his authenticated  

voice from earlier Skype videos confirmed  that the speaker was indeed Sindjelic.

Crucially, the audio quality and the  balance suggested the recording device  

was on Velimirovic's phone, consistent  with the prosecutor's claim that he was  

already a police informant by that time,  who recorded the conversation voluntarily.

In a second leaked call between  Sindjelic and Bratislav Dikic,  

a former chief of Serbia's special police  whom Sindjelic had recruited himself,  

Dikic complained about being unable to reach  someone whose phone was in roaming mode.

They discussed waiting for election results  and explicitly referenced the Russians and  

the politicians who appeared to  be part of the plan themselves.

Later, as the court case was underway in  Montenegro, more was revealed that allowed  

us to see how Montenegro's authorities had  worked to turn the conspiracy against itself.

Four to five days before the election,  

the Montenegrin accomplice Velimirovic had  surrendered and become a police informant.

Why exactly he did that, I'm not sure. But  when Shishmakov, one of the Russians running  

the operation, requested photographic  proof that weapons had been acquired,  

Montenegrin police borrowed weapons  from their own armory to stage a  

convincing photograph that was then  sent on to the Russian operative.

Sensing that something was wrong, Sindjelic,  the Serbian accomplice, decided at the last  

moment to replace Velimirovic with Dikic, another  Serbian accomplice, as the key field organizer.

When Dikic went to the safe house  where he was told weapons were stored,  

Montenegro police were waiting and detained him.

By election day, with key conspirators already  in custody, the plot was effectively neutralized.

As if we needed more evidence that Shismakov  and Moiseev were members of the GRU, they were  

somehow able to get themselves out of Serb custody  even before their arrest had been made public.

Travel records show that at 4:00 a.m.  on October 22nd, just 8 days after the  

attempted coup was scheduled to take place and  2 days before the Serbian police even announced  

the arrest of these two Russian nationals,  Shismakov and Moiseev were flown back to Moscow.

Both tickets were bought at midnight on  the 22nd, just hours before they flew off.

The hasty departure reeks of a  state-negotiated extradition.

We may never be sure what the Russians used to  get the Serbians to agree to quickly release the  

two men, but it is yet another validation  that they were not just rogue operators,  

despite Russia's claim to the  contrary in the following days.

In addition, we later uncovered evidence  that the broader Russian state and key  

oligarchs were also involved in this attempt  to influence Montenegro's political direction.

Through leaked emails obtained  by Ukrainian hacktivist groups,  

we discovered that Konstantin Malofeev,  the Russian oligarch who had funded the  

initial invasion of Crimea and Donbas in Russia  2014, was also deeply involved in Montenegro.

Alexander Usovskiy, who had freelanced  for Malofeev's active measures in  

central and eastern Europe for a couple of years,  

sent a telling email to Malofeev's associate  Alena Sharoykina on November 28th, 2016.

In it, he referred to the unnecessary Montenegro  

fiasco and explicitly stated his  belief that Malofeev was behind it.

He even proposed a new initiative to wash the egg  off the face following the Montenegro failure.

Malofeev had been actively supporting  Montenegro's anti-NATO opposition for years.

In September 2014, he even  hosted Strahinja Bulajic,  

a Montenegrin MP known for anti-NATO positions.

Bulajic later became a leader of  the Democratic Front coalition.

During the preceding two years,  Malofeev's TV station, Tsargrad TV,  

had given extensive coverage to  Democratic Front leaders Andrija  

Mandic and Milan Knezevic, both later  identified as suspects in the coup plot.

And during a February 2016 interview, Mandic  predicted perpetual street protests and violent  

conflicts if there was no referendum  on NATO membership and claimed that he  

had been promised Russian support during a  meeting with Duma speaker Sergey Naryshkin,  

who later became the head of Russia's  foreign intelligence service.

The investigation also revealed  involvement by RISS, R-I-S-S,  

the Kremlin-owned Russian  Institute of Strategic Studies.

In February 2016, RISS Balkan desk chief  Nikita Bondarev had published an analysis  

that chillingly predicted the exact  scenario described in the coup plot.

Crowds of protesters will  attempt to storm the parliament.

Police would disperse them with rubber bullets,  

and protesters will persist against  Djukanovic and take over parliament.

Bondarev wrote then, "The process  of protest activity in Montenegro  

must move to a different stage.  Currently, we see peaceful protests,  

but they may escalate to something similar  to what happened in Kiev on the Maidan."

RISS chairman General Leonid  Reshetnikov, my biggest fan,  

had been an outspoken critic of  Prime Minister Djukanovic for years.

At one point, calling him a traitor who will  answer for his treachery to Russia on judgment  

day, and repeatedly predicted an anti-Western  rebellion if Djukanovic won the election.

Despite all of this, however,  Moscow's official line remained  

that the operation had been done  by a set of rogue individuals.

Our investigation into the Montenegro  coup plot revealed a sophisticated,  

multi-layered Russian operation that went far  beyond the two GRU operatives arrested in Serbia.

It demonstrated how Unit 29155 and other  Russian intelligence services coordinate with  

oligarchs, with think tanks, with opposition  leaders abroad, and religious institutions  

to create deniable networks  for political interference.

The pattern we uncovered with Montenegro,  using intelligence operatives, recruiting  

local assets with compromised backgrounds,  coordinating through encrypted communication,  

and maintaining plausible deniability  through oligarch proxies, would become  

a template for Russian interference  operations across Europe and the world.

The Montenegro coup attempt failed, and the  country successfully joined NATO in 2017.

But similar techniques and networks we uncovered  

in the investigation would surface again  in other Russian operations across Europe.

From influence operations in Moldova  to political sabotage in Catalonia.

Subscribe now to the Christo Files  so you don't miss other episodes  

like this one. And let us know in  the comments if there are other  

episodes and events around the world  that you would like us to focus on.