Two Bulgarian Women Exposed in Russian Spy Network

The BBC revealed that two Bulgarian women were part of a Russian spy network in Europe. Cvetelina Gencheva and Tsvetanka Doncheva spied on people and spread anti-Ukraine propaganda. They targeted journalists, officials, and others, raising serious security concerns.

Bulgarian Women Caught in Espionage Scandal

Gencheva, based in Sofia, Bulgaria, used her airline job to access private flight details. She gave this information to the spy network, helping them track targets during flights. Spies sometimes sat near their targets, watched their phones, and even stole PIN codes.

She spied on Russian journalist during a Berlin trip. She also collected flight details on investigative journalist and Russian dissident.

Doncheva, based in Vienna, Austria, focused on direct spying. She set up a camera near Grozev’s home to watch him and also spread anti-Ukraine propaganda, putting stickers around Vienna, including at the Soviet war memorial, to label Ukraine supporters as extremists.

She also spied on Austrian journalists and officials, including Anna Thalhammer, an editor at the Austrian magazine Profil.

Social Media Clues and Arrests

The BBC identified Gencheva by tracking her social media activity. Her LinkedIn profile showed she knew Amadeus, a common airline software. The same software was found on Orlin Roussev’s hard drive, the leader of the Russian spy cell in the UK. Her links to convicted spies made her role clear.

When the BBC contacted Gencheva, she refused to comment. She later claimed she wasn’t fluent in English, though her LinkedIn profile showed professional fluency and a degree in English. After the investigation, she quickly changed her social media, removing some details.

Doncheva was arrested by Austrian police in December but was later released. During questioning, she gave conflicting stories. First, she said she thought it was a student project. Later, she claimed it was an Interpol operation. Austrian authorities dismissed her claims, confirming she was part of the spy network.

Connections to Russian Intelligence

Austrian court documents showed that Doncheva had direct ties to Jan Marsalek, a Russian spy in Moscow. Marsalek also worked with the leader of the UK spy cell. The documents revealed that Marsalek planned surveillance on journalists.

The UK police described the spy network as highly sophisticated and dangerous.

A UK court recently convicted six Bulgarians linked to the spy network. Three admitted working for Russia, while the others denied it but were still found guilty. They targeted journalists and Ukrainian soldiers training at a US base in Germany.

Despite strong evidence from the BBC, none of them has been convicted. Austrian prosecutors asked for Doncheva’s pre-trial detention, but the court denied it, saying she was unlikely to flee. Her role as her mother’s caretaker was also a reason for her release.

After the BBC investigation, Gencheva still claims to be a travel industry professional but changed her social media after reporters questioned her. BBC reporters approached Doncheva in Vienna, but she denied her identity. However, they later saw her at her home address.

The BBC investigation raised serious concerns about Russian spies in Europe. With both women still free, it shows the ongoing risk of foreign spies and the challenges of catching them.

How Cyber Attacks on Industrial Control Systems Can Endanger Lives ?

Mohit Kumbhar
Mohit Kumbharhttps://www.linkedin.com/in/mohitkumar99/
Mohit Kumbhar is the editor of Newsinterpretation. He edits the site’s news coverage and writes on artificial intelligence, AI search and how publishers become visible to AI assistants such as ChatGPT, Claude, Gemini and Perplexity. He also writes about NI Geovanta, the AI visibility tool for WordPress developed by Newsinterpretation.

TOP 10 TRENDING ON NEWSINTERPRETATION

Cyber Attacks on Space Infrastructure: Satellites, GPS and the Ground Systems Behind Them

From the Viasat KA-SAT hack to GPS jamming over the Baltic, a research guide to how attackers target satellites, navigation signals and ground stations, and why it matters on Earth.

How AI Agents Are Used in Cyber Attacks: From Assisted Hacking to AI-Orchestrated Espionage

Attackers now use AI agents to scan networks, write exploits and run extortion campaigns. A research guide to documented cases, including the first reported AI-orchestrated espionage campaign, and what defenders should do.

Cyber Attacks on AI and LLMs: How Attackers Target Large Language Models

Prompt injection, data poisoning, model theft and jailbreaks: a research guide to how attackers target AI systems and large language models, with real cases and defences.

French Supermarket Refrigeration Cyberattack: How Hacking the Cold Chain Can Endanger Lives

In October 2026 attackers heated refrigeration cabinets in hundreds of French supermarkets to as much as 50°C. No one was hurt, but the attack shows how hacking the cold chain can endanger lives through fire, food poisoning and spoiled medicines.

Cyberattacks on Nuclear Facilities: Stuxnet, Kudankulam and the Limits of Air Gaps

Stuxnet, the Davis-Besse worm and malware at India’s Kudankulam plant: what they show about cyber risk at nuclear facilities and the limits of air gaps.

Triton: When Hackers Target the Safety Systems That Prevent Industrial Disasters

The 2017 Triton attack targeted the safety systems that prevent industrial disasters. What happened, who was charged, and how plants protect their last line of defence.

Cybersecurity Risks in Smart Cities: When Connected Infrastructure Fails

How connecting traffic control, emergency alerts and utilities concentrates cyber risk in cities, what the Dallas and Atlanta incidents showed, and what governments recommend.

Weaponized Drones: Hijacking, GPS Spoofing and Emerging Cyber Warfare Risks

How drones can be hijacked, jammed or misled by GPS spoofing, what researchers have demonstrated, and why governments treat drone fleets as a security risk.

Ransomware Attacks on Hospitals: How Healthcare Cyberattacks Put Patients at Risk

How ransomware against hospitals and their suppliers delays care and endangers patients, what the Düsseldorf and WannaCry cases show, and what research says about deaths.

Operational blunder exposes massive Russian cyber espionage attack on Ukrainian prosecutors

A major cyberattack has compromised the email accounts of...

Cyber Attacks on Space Infrastructure: Satellites, GPS and the Ground Systems Behind Them

From the Viasat KA-SAT hack to GPS jamming over the Baltic, a research guide to how attackers target satellites, navigation signals and ground stations, and why it matters on Earth.

French Supermarket Refrigeration Cyberattack: How Hacking the Cold Chain Can Endanger Lives

In October 2026 attackers heated refrigeration cabinets in hundreds of French supermarkets to as much as 50°C. No one was hurt, but the attack shows how hacking the cold chain can endanger lives through fire, food poisoning and spoiled medicines.

Cyberattacks on Nuclear Facilities: Stuxnet, Kudankulam and the Limits of Air Gaps

Stuxnet, the Davis-Besse worm and malware at India’s Kudankulam plant: what they show about cyber risk at nuclear facilities and the limits of air gaps.

Triton: When Hackers Target the Safety Systems That Prevent Industrial Disasters

The 2017 Triton attack targeted the safety systems that prevent industrial disasters. What happened, who was charged, and how plants protect their last line of defence.

Cybersecurity Risks in Smart Cities: When Connected Infrastructure Fails

How connecting traffic control, emergency alerts and utilities concentrates cyber risk in cities, what the Dallas and Atlanta incidents showed, and what governments recommend.

Ransomware Attacks on Hospitals: How Healthcare Cyberattacks Put Patients at Risk

How ransomware against hospitals and their suppliers delays care and endangers patients, what the Düsseldorf and WannaCry cases show, and what research says about deaths.

FBI warns of AVrecon malware targeting outdated routers linked to proxy based cybercrime

A serious cybersecurity warning has been issued regarding commonly...

Related Articles

Popular Categories