How a Bulgarian cleaner became a Russian spy: "She was constantly writing nonsense on Facebook, pro-Putin, pro-Russia..."

Until recently, acquaintances of Tsvetanka D. were convinced that she led a normal and simple life. But this Bulgarian woman who lives in Vienna has been a Russian spy for years. There are many like her in Europe.

More than ten years ago, Bulgarian Tsvetanka D. moved to Vienna. She worked occasionally as a cleaner, but there is no information available about any other jobs. It seems that she had enough free time, because she spent hours and hours on social media. There, for years, she increasingly shared posts against the Covid vaccine and supported the policies of Russia and the right-wing populist Freedom Party of Austria (FPÖ).

“She was constantly writing nonsense on Facebook, pro-Putin, pro-Russia and similar gibberish,” says Plamen B. He was Tsvetanka D.’s employer for a short time in 2015 at a cleaning company in Vienna. “But it all gave the impression of a typical, confused person from exactly the group of people who are susceptible to propaganda,” the Bulgarian adds.

But there was nothing “typical” about Tsvetanka. She wasn’t actually unemployed – she was apparently working as a Russian agent. This was announced in late March by the Austrian Directorate for State Security and Intelligence (DNS). Her name was not released at the time, but was later revealed by the BBC.

What were Cvetanka D's tasks?

What were Tsvetanka D's tasks? She was apparently supposed to contribute to the spread of Russian disinformation in Austria. For this purpose, for example, she put up stickers that were supposedly pro-Ukrainian, but actually had Nazi symbols. The goal: to spread Russian disinformation that Ukrainians are Nazis. She was also supposed to spread similar disinformation online. She allegedly admitted to Austrian authorities that she was most active in 2022, when Russia began its war against Ukraine.

Cvetanka D. also had more complex tasks: she was supposed to monitor persons of interest, including the head of the DNS, Omar Haidzavi-Pirchner, then investigative journalist Krist Grozev, as well as Ana Talhamer, editor-in-chief of the weekly magazine Profil, known for its investigative journalism.

"In late summer 2024, I received a call from the Bureau for the Protection of the Constitutional Order," Talhamer tells DW. "They told me that my laptop and mobile phone were allegedly stolen and taken to Moscow. In December, I received another call - to review the files at the state prosecutor's office. They detailed, among other things, that Ms. D. had been following my every move for months."

The Bulgarian woman was even supposed to film investigative journalist Krist Grozev, who was wanted by the Russian Interior Ministry in 2022. For this purpose, she rented an apartment in Vienna, directly opposite his residence at the time.

How did Tsvetanka end up on the payroll of Russian services?

How was Tsvetanka D. recruited? Her acquaintances from Vienna say that in 2020, when the Covid-19 pandemic began, she also started spreading false facts and manipulations about the virus, and then about vaccines. This was typical for many Bulgarians – it was the country with the lowest vaccination rate against corona in the European Union. Disinformation and distrust of vaccines are the main reasons for this.

It was probably then that she came into the focus of the Russian spy cell. It concerns a group of Bulgarians in London who were convicted in the UK in early March 2025 for espionage.

They all worked for Jan Marsalek, the former head of the German company Wirecard, who allegedly fled to Moscow and from there coordinated espionage and disinformation operations in Europe. Kristo Grozev was the target of most of these operations - according to information from London, he was supposed to be kidnapped, even killed. Tsvetanka D was supposed to help in this, as was another Bulgarian woman exposed by the BBC, Tsvetelina Gencheva. She worked at Sofia airport, where she monitored the arrivals and departures of journalists and Russian dissidents.

Russian secret services recruit "ordinary people"

Tsvetanka D. was recruited by three Bulgarian citizens from London. Among them was Vanya G. She and Tsvetanka D. claim that they did not know exactly what they were doing. According to Vanya G, her partner, Biser D, who also belonged to the London spy group, lied to her that they worked for Interpol. Tsvetanka D. told the same story in Vienna.

Vanya is a beautician by profession. Acquaintances in London say she was not interested in politics. "People who know Vanya describe her as a very calm and naive woman," Vasil Hristov, a Bulgarian journalist reporting from the UK, told DW. "According to a series of expert analyses, the Russian secret services deliberately recruit completely ordinary people who do not attract attention. Vanya's profile fits this pattern perfectly," Hristov says.

Russian spy networks still active

The members of the London spy cell are currently awaiting final verdicts. Tsvetanka D. is currently at large in Austria, but the investigation against her continues. In Bulgaria, however, another alleged member of the group, Tsvetelina G, is not yet under attack by the authorities. As of the time of publication, Bulgarian authorities had not commented on the case.

Does this mean that Marsalek's spy network has collapsed? "No," says Ana Talhamer. "My information is that the authorities believe that there are other cells. The idea behind this structure is that if one cell goes down, there is another. They are intentionally not connected, but they are working towards the same goal."

It seems that Bulgarians are very often involved in espionage. According to the editor of the Austrian Profile, these are not trained spies, but petty criminals.

"People with Bulgarian names very often appear in Russian spy networks. There is obviously a connection between the Bulgarian criminal milieu and Russian intelligence structures," concludes Ana Talhamer.