Christo Grozev Profile picture
Aug 26, 2022 10 tweets 7 min read Read on X
I can't add much to this crazy story than what @EliotHiggins and @AricToler already posted. However, I'll answer a few questions on how we actually stumbled on this spy in the first place, and what different tricks we used over 10 months to find her real identity.
We first noticed her thanks to a super useful database shared with us by @cpartisans: the border crossing records of Belarus. We knew the passport ranges of GRU and FSB spies, so we decided to search in that data-set by partial matches, leaving the last 3 digits out as wildcards.
One number I tried was that of "Ruslan Boshirov", one of the Salisbury spire-watchers. His passport number was 643258090. I got quite a few other spies in the same range, but suddenly I noticed a long Spanish-sounding name: Maria Adela Rivera Kuhfeldt. 13 whole trips!! Image
(by the way, "Boshirov" himself was also in the database, for some name his name was spelled "Poshirov" - never figured out if the Belarusians had tried to disguise him one more time, after our publications about him. Or they were just sloppy). Image
"Maria Adela" stood out big time with her non-Russian name. Was she an innocent foreigner who had acquired Russian citizenship and accidentally gotten a number from that range? Some things spoke against her being a spy. For example, 13 super-long train trips? Spies prefer to fly.
A simple Google search of her name gave two intriguing hits. One was a jewellery brand registration in France from 2012. The other one was a criminal referral for an "unknown person who claimed her name was Maria Adela Rivera Kuhfeldt" (Yes, i have visited that page MANY times) Image
Then @Dobrokhotov and I found a person with a very similar name had been secretary of a charity in Naples. We reached out to @florianabulfon - and she exclaimed: 1. That's right next to the @NATO Command Center. And 2. All the others are NATO officers. ImageImage
@Dobrokhotov @florianabulfon @NATO (Btw, to answer some proposed hypotheses - no, she didn't have a cat yet when she took the train rides - her cat is coming up later in the story, BIG TIME).
@Dobrokhotov @florianabulfon @NATO Based on her social media accounts (we found her FB and Insta), her M.O. was not hard to reconstruct. She had been "the life of the party", and had sought to make as many friends within NATO circles as possible. And seemed to have succeeded. ImageImage
But what about the cat, many ask. What was Luisa's role? Was that even her real name? Well, built a full-fledged cat dossier for Luisa. Our hope was to find her owner's identity via her cat - "the only stable thing in her life". ImageImage

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with Christo Grozev

Christo Grozev Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @christogrozev

Mar 13
Denis Alimov, FSB Alfa veteran and senior operative of Russia's new and "most secretive" assassination unit, walked into El Dorado Airport in Bogotá on Feb 24 looking like a tourist heading to Cartagena. He walked out in handcuffs.
He was undone by Google Translate.
🧵New @TheInsider investigation with @DerSpiegel — thread below.Image
The story begins in December 2022. Russia is not winning the war in Ukraine, and needs to ramp up its hybrid warfare on the West. Averyanov's Unit 29155, its previous solution, has been burned by our investigations; its operatives' biometrics were in every customs database. Image
The solution is an air-gapped, secret unit. Military Unit 75127, also known as Center 795.
The new unit is designed to be untraceable. Hidden inside the Kalashnikov Concern. Reporting directly to Gerasimov. A shadow army in a corporate suit. With PowerPoint presentations. Image
Image
Image
Read 21 tweets
Feb 8
FSB announced the arrests of two Russian citizens who allegedly organized the attempt on Gen. Alexeev. One is a 66-year old Ukrainian-born man who was detained in Dubai, but the other one - V. Vasin, 67 - works for an FSB company manufacturing surveillance tools. Plot twist.
At least through Aug 2025, Viktor Vasin was employed as "chief expert" at NTC Atlas, launched by FSB and now part of military-industrial behemoth Rostec. Image
An archived CV from 2014 shows he graduated from Russia's military command communications academy, describes himself as "master of military affairs" and "senior officer - chief of staff of a regiment" before switching to commercial jobs in the 90s. Image
Read 4 tweets
Nov 25, 2025
and now, @business's incredible scoop: "[Kirill] Dmitriev suggested sharing [with Witkoff] a paper informally and said he was confident *that even if the US didn’t completely take Russia’s version they would at least do something very close to it.*".
"LET THEM DO, LIKE, THEIR OWN" Image
"We will do everything neatly" Image
Read 4 tweets
Oct 4, 2025
I've been reporting to @Meta fake profiles that impersonate me on Facebook. Meta refuses to remove the impersonators, for some inscrutable reason considering impersonation of an investigative journalist to *not* be a violation or their terms. This is irresponsible and dangerous. Image
Image
. Not only did @Meta not remove the impersonators, but are *actively* pushing them to people. This is a fake account created in 2021. Facebook is suggesting to someone to add this fake person as their friend. Just imagine the risks from this irresponsible behavior. Image
@Meta To my real account, I constantly get unsolicited tips from whistleblowers who trust me. Imagine what would happen if/when a whistleblower contacts a fake account created by a bad state actor. @Meta is not simply helping spread disinformation, it's actively endangering lives.
Read 4 tweets
Sep 30, 2025
Pavel Durov, Telegram's founder, claims he was poisoned in 2018 (symptoms he describes are indeed are consistent with nerve agents/organoposphates). He chose "not to tell my colleagues so I wouldn't scare them"
I believe him this happened. Sadly, he didn't volunteer information on where this happened (I wish he had, so we could triangulate the usual suspects - in 2018 he was a MAJOR thorn in the side of Russian authorities). But thanks to leaked databases we can have some guesses.
Based on leaked travel data, he spent most of the time in 2018 in Dubai, interspersed with stays in Switzerland, France and the UK. Interestingly (likely coincidentally), he left the UK for Dubai a day after the Skripal poisoners left London for Moscow.
Read 6 tweets
Jul 23, 2025
In our new investigation into Russia's use of children for their military drone program, crucial evidence came from @tashurkevich's undercover phone calls. Here are some of the most striking confessions she extracted.
What are the tasks assigned to the kids? Well they sound like things from Ender's Game (link to full investigation here: )
Here Tatsiana calls "Maksim" who explains the kids' "oath of silence" in mentioning the war.
Read 6 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us!

:(