Two Bulgarian women who played key roles in an alleged Russian espionage cell operating from the UK have been identified for the first time following a detailed BBC investigation.
The women, Cvetelina Gencheva and Tsvetanka Doncheva, were involved in covert surveillance activities on behalf of the spy network, which UK authorities described as a serious threat to public safety.
Silent Suspects: Women Decline to Comment
Attempts to contact both women were met with silence or denial. Ms Gencheva, believed to be employed in the airline industry, hung up on a BBC reporter and later declined to comment in writing. Ms Doncheva, when approached in Vienna, Austria, denied her identity and walked away.
The two women were part of a wider spy ring that included six Bulgarian nationals now facing sentencing in London. Three of those individuals admitted knowingly working for Russian intelligence, while the remaining three were convicted earlier this month at the Old Bailey after a lengthy trial.
The network, which police described as “highly sophisticated”, was allegedly directed by Jan Marsalek, a former Austrian businessman turned Russian intelligence asset. Targets of the operation included prominent investigative journalists such as Roman Dobrokhotov and Christo Grozev.
Gencheva: The Airline Insider
Ms Gencheva, residing in Sofia, is believed to have leveraged her position within the airline industry to access sensitive flight details of surveillance targets. Members of the cell reportedly used these details to board the same flights as their targets, positioning themselves nearby to gather intelligence — including, in one case, observing a journalist’s phone PIN.
She was part of a surveillance mission in Berlin targeting journalist Roman Dobrokhotov and had connections with three convicted UK spies — Orlin Roussev, Biser Dzhambazov, and Katrin Ivanova — through encrypted messaging apps used for coordination.
Evidence presented at the Old Bailey referred to a mystery airline worker under the aliases “Cvetka” or “Sveti”. BBC researchers later matched this individual to Ms Gencheva through social media activity and her professional LinkedIn profile, which lists her expertise with Amadeus — an airline industry software also found in recovered files belonging to Roussev.
Despite being identified by sources within Bulgarian security services as linked to the spy network, Ms Gencheva has not been charged with any offence.
Doncheva: The Vienna Operative
Meanwhile, Tsvetanka Doncheva played a surveillance role in Vienna, where she operated a camera from a flat opposite journalist Christo Grozev’s residence. Austrian authorities have since arrested and released her pending further legal developments.
Court documents reveal Ms Doncheva was involved in anti-Ukraine propaganda efforts and took part in espionage against prominent Austrian figures, including senior intelligence officials and investigative journalist Anna Thalhammer.
Ms Doncheva admitted to police that she was enlisted by long-time friend and co-accused Vanya Gaberova, who provided her with surveillance targets’ personal details. Though she initially claimed to have been misled about the operation’s purpose — at first described as a “student project” and later as an Interpol mission — Austrian investigators dismissed these explanations as implausible.
Evidence shows she was contracted by Marsalek and UK cell leader Roussev to carry out her activities. Ms Doncheva also admitted to photographing Ms Thalhammer’s former workplace and monitoring her from a nearby restaurant.
Journalist Speaks Out
Ms Thalhammer, now editor of Profil magazine, expressed frustration and concern after learning she had been monitored for an extended period. “I live alone with my daughter. It’s not so nice to know the state doesn’t act when journalists or politicians are being threatened,” she said.
Despite Ms Doncheva’s arrest, Austrian prosecutors released her, citing low risk of reoffending and her “social integration” in the country, as well as her responsibility for a dependent mother — a move Ms Thalhammer criticised. “Maybe [they] shouldn’t believe everything a spy says,” she remarked.
Espionage Operation Unravelled
The UK-based spy network has come under increasing scrutiny since the arrest of the six Bulgarian operatives. Nearly 80,000 Telegram messages between cell leader Orlin Roussev and Jan Marsalek were seized, outlining surveillance plans and even discussions of kidnapping and assassinating journalists.
Among the plots uncovered were operations targeting Ukrainian soldiers training at US military bases in Germany, as well as broader plans against individuals critical of the Kremlin.
Still at Large
Unlike their UK counterparts, neither Ms Doncheva nor Ms Gencheva has been formally charged or taken into long-term custody. Gencheva remains in Bulgaria, continuing to promote herself online as a travel industry professional. Shortly after being contacted by the BBC, she changed her name on social media accounts but retained references to her proficiency with Amadeus software.
Ms Doncheva, known for her prolific social media activity — including posting a photo in a Vladimir Putin t-shirt — was approached by the BBC in Vienna. Though she denied her identity, her clothing, phone case, and later movements confirmed her to be the same individual.
As Austrian and UK authorities continue to investigate, there is growing concern that additional operatives remain active. According to Ms Thalhammer, Austrian intelligence services believe the network has not been fully dismantled.
