How I caught an Illegal Russian Spy

On September 15, 2018, a young woman boarded a  flight from her home in Naples, Italy, to Moscow.

At the time, nobody took much notice.

She was a jewelry designer and  a Peruvian socialite known to  

travel all the time for work all around the world.

Nothing about it seemed out of the  ordinary until she never came back.

The woman known in Naples as Maria Adela  Kufheldt Rivera completely vanished.

She never returned to move out of  her apartment, never said goodbye,  

stopped replying to her friend's messages, left  just a cryptic post on Facebook implying that  

she was going in for long treatment,  and might be back in touch one day.

But she never did. All traces of her  vanished after her flight to Moscow,  

except she took one important thing with her.

In the words of somebody who  considered her a close friend,  

the only thing that she ever felt attached to her  cat, and it's exactly thanks to her cat, Louisa,  

that we managed to find her, Maria Adela, years  later, living in Russia under her true identity.

All along, for more than a decade,  she had been a Russian spy.

Hi, I'm Christo Grozev, an  investigative journalist.

I focus on exposing Russian spies  and intelligence operations.

Over the past year, we've told  you about GRU's Unit 29155,  

a sabotage and assassination unit  of Russia's military intelligence.

The operatives involved in these operations are  what we would call short-term illegal spies.

They leave Russia under fake identities  to carry out assassinations, poisonings,  

or other acts of sabotage and then return  home weeks or sometimes days later.

But today, I'm going to talk  about a different type of spy,  

one that doesn't operate under the same timeline.

Welcome to our new series on my team's  investigations into deep-cover Russian illegals.

Illegal spies live abroad  for years, sometimes decades,  

embedding themselves in foreign  societies, learning the language  

and the cultural idiosyncrasies, and  working menial or sometimes fancy jobs.

They live under entirely fake identities.  Their pasts are 100% fabricated, including  

their nationality, family history,  educational and career background.

All of it is thoughtfully crafted by Russian  intelligence to help the illegal infiltrate the  

right groups in the West, and maintain their cover  identity for years or even decades after that.

If this sounds a lot like the setup of the TV show  "The Americans," famously featuring a family of  

Russian spies embedding themselves in American  suburbia in the late 80s, you'd be very right.

That's exactly what it is.

And it's a real thing.

It's the Soviet and now the  Russian illegal spy program.

Illegal spies differ from  traditional spies in a few key ways.

Unlike what are called legal spies  who are sent overseas as diplomats,  

military attaches, or other official  government positions, illegal spies  

intentionally try to hide any connections  to the Russian government or even to Russia.

As a result, they have no diplomatic  cover if they are discovered or arrested.

Over the years, we've uncovered more than  a dozen of these deep-cover illegals.

Some of those were even part  of the recent prisoner swap  

between Russia and the West last year.

Our investigations have revealed complicated  

characters and subplots that  sometimes verge on the absurd.

This is definitely one of those.

The investigation into  Maria Adela Kuhfeldt Rivera,  

the cat lady, as we call her, began  unintentionally in September of 2018.

Earlier that day, my team  at Bellingcat at the time,  

alongside our partners at The Insider,  had published a different investigation.

Months earlier that year,  

former Russian spy Sergei Skripal had  been poisoned in Salisbury, England.

We had discovered that the Russian operatives  within the GRU, Russia's version of the CIA,  

had been issued passports with  nearly consecutive numbers.

This finding was a huge  breakthrough moment for our team.

Not only was it completely absurd, we just  couldn't believe that an oversight in tradecraft  

of this magnitude would ever be made, but  it was also the gift that kept on giving.

It didn't just help us with  the Skripal investigation.

We found a third member of the  poisoning team thanks to that.

But it allowed us to identify a whole  range of passport numbers that we  

could credibly suspect of being  Russian intelligence operatives.

For the GRU, this discovery  was obviously a disaster.

As soon as we discovered numbers we  suspected of belonging to Russian spies,  

dozens of active spies around  the world were burnt overnight.

Many of them were under deep  cover throughout Europe.

After spending years or even  decades living under fake  

identities. The cat lady was one of these spies.

I remember the day I stumbled  upon this name for the first time.

I had just received access to a leaked data  set of Belarusian border crossings and I  

was eager to find if any Russian spies,  using passports from the now known range,  

had crossed the border of this country that  sits between Russia and Western Europe.

There was one name that stood out,  

a beautiful foreign Spanish-sounding  name, Maria Adela Kuhfeldt Rivera.

It didn't make sense for a foreigner to have a  

Russian passport only a few digits  away from known GRU operatives.

Now, why would the person with that name,  traveling repeatedly by train from Moscow  

to Rome and back, as we could see from the  database, use a passport issued by Russia's GRU?

Why did she even have a  Russian passport to begin with?

Why would she travel back and forth between Italy  

and Russia dozens of times  in the period 2010 to 2018?

And crucially, why did she fly back to Moscow  the day after our investigation was released?

And why was she never returning  back from Russia after that?

We started by scouring everything that we could  

online for any information  we could find about her.

Fortunately, the internet was flushed with  pretty pictures, videos, and social media posts.

All of these helped us build an idea of her  life in Naples, the people she hung out with,  

the clubs she was part of, the jewelry  business that she claimed she was running.

We decided to reach out to a few of her friends to  

see what they could tell us about this  woman who seemingly vanished overnight.

Her origin story went as follows.

Maria Adela Kuhfeldt Rivera  was born in Callao, Peru,  

to a German father and a Peruvian  mother on September the 1st, 1978.

The story she would tell her  friends in Naples was quite exotic.

Her father abandoned her mother  when she was just a baby,  

with her mother left to raise Maria on her own.

Then, in 1980, her mother supposedly  took baby Maria to Moscow, of all places,  

to watch the Olympic Games,  which were happening there.

When she received an emergency message from  Peru requiring her to return home immediately.

Her mother left little baby Maria  in the care of a Soviet family that  

she had apparently befriended during her visit.

And then she never returned.

Maria was then raised by these  adoptive parents in Russia and  

was later abused by her adoptive father.

That's the story she was telling everybody.

Does any of this sound fishy yet?

Not the best origin cover story or "legend" as  they are called in Russian intelligence jargon.

The reason for this sloppy, implausible  story was that it had to be invented on  

the fly or retrofitted to fit the unexpected  circumstances that this spy had landed in.

You see, Soviet and later Russian illegal  

spies are usually deployed with  impeccably crafted backstories,  

"legends," and valid passports issued by the  country that they purport to originate from.

To do this, a whole service department exists in  Moscow with branches at many Russian embassies  

around the world whose only job is to hunt for  opportunities to create these fake identities.

Sometimes, based on forged original  birth certificates, at other times,  

based on stolen identities of deceased people.

This had been the case with Maria  Rivera's backstory, initially.

A forged birth certificate issued by  a parish church in a small Peruvian  

village had been used to get the Russians  by an authentic Peruvian passport in 2005.

However, just a few months after she had  been successfully deployed as a young,  

attractive Peruvian globe-trotter  to Malta, the unthinkable happened.

A civil officer overseeing  this case in Lima, Peru,  

thought something was fishy about  this newly issued citizen passport.

The officer reached out to the parish priest  

at the Cristo Liberador Dioceses  and the actual priest responded.

It didn't take long for the reverend  to know that this was all a fake.

After all, he was the founder of  that church and the inaugural priest.

It had been established, and  that's where the problem lay,  

9 years after Maria's documents, the  birth certificate said was issued there.

Unsurprisingly, he reported back to Lima that  the documents were clearly fake, and her name,  

Maria Adela Kuhfeldt Rivera, was even included  in an "annulled citizenship" list in the annual  

report of the Peruvian migration department,  available even to download on the internet.

In circumstances like this, the Russian  illegals machine would just recall the  

spy back to Moscow and start fresh after a  few months or a year under a new identity.

However, in this case, our Maria Adela  had already been deployed initially in  

Malta and then in Italy and had begun  building a promising circle of contacts.

She was dating an eligible bachelor,  the son of a Malta rich family.

And she had befriended people with important  contacts in politics, business, and the media.

It made no sense to kill all  of this and start a fresh.

So Moscow Center decided to take a huge gamble.

They kept Maria Adela deployed in the field  but gave her emergency Russian papers,  

a Russian passport, from  the then unknown GRU range.

And to fit that passport, they  had to retrofit her backstory.

Thus, the implausible Moscow Olympics trip.

And even more implausibly, that crazy  story held up among her new friends,  

and no one seemed to question  the bona fides of this woman.

Apparently, the looks and charisma that went with  

her went a long way to make up for  the GRU operational deficiencies.

But we still didn't understand why or  what she had been doing all this time,  

initially in Malta and then in Italy,  as her social media post showed to us.

By 2018, she had lived in  Europe for over a decade,  

known to her friends as a Peruvian jewelry maker.

Using social media posts, travel records, and  flight data attached to the newly uncovered  

passport, we began piecing together  her movements from 2009 to 2018.

Between 09 and 12, she appeared in  Malta, Rome, Paris, and in London.

She had infiltrated numerous different  expatriate circles in these countries.

She had a rich boyfriend in Malta,  later another rich one in Italy.

She took trips to Africa and the Middle  East to attend many jewelry expos.

But more interesting than these  travels was her base in Naples,  

Italy, that really drew our attention.

See, Naples is home to NATO's  Joint Forces Command Center.

It is a major operational  headquarters for the alliance,  

which makes it the ideal place for a  Russian spy posing as a socialite to live.

Maria opened her jewelry business here in 2013,  first establishing herself in the community.

Later, she helped relaunch and became the  secretary of a local charity organization,  

which had been launched by a NATO  officer earlier, called the Lions Club.

Through the Lions Club, Maria began to  develop friendships with other members,  

including the wives of important  NATO colonels and generals.

It was also reportedly a good  place for her to seed romantic  

relationships with people that were close  to NATO circles or even within NATO itself.

These relationships granted her access to  untold NATO secrets without arousing suspicion.

Unlike what you might expect from  a highly trained spy, however,  

Maria Adela was also known to be  very emotionally unpredictable.

These ups and downs and frequent  heartbreaks that she talked about  

likely complicated her operational consistency.

From a professional sense, however, her jewelry  brand did offer her the perfect cover story.

We began investigating "Serein," her  company, first using social media posts.

She marketed herself as an  artisan boutique jewelry designer.

She traveled all the time to  meet with important partners  

and buyers, giving the impression of a  sophisticated and busy businesswoman.

However, like most things in her life,  that wasn't exactly what it seemed like.

When we reverse image searched  the photos of her jewelry,  

the jewelry that she supposedly designed  herself in Naples, we discovered that  

they were actually cheap trinkets purchasable  online from Chinese websites and wholesalers.

This was an exciting discovery for us because  

it was yet another proof that  Maria Adela was living a lie.

But those around her in  Naples didn't realize this.

She was even invited to host  grand openings for her storefront,  

named the “Serein concept gallery," inviting  friends from all over to come celebrate.

A promo video for the venue that we found online  markets it as a haven for the high-rolling public,  

including local politicians,  businessmen, and celebrities.

She was even interviewed for an  Italian TV channel at the time.

Again, that's a great way to get close to  powerful contacts that might be useful to Russia.

The jewelry brand also provided  Maria with a useful excuse for  

travel and for building relationships elsewhere.

For example, Maria visited  Bahrain multiple times after  

2013 under the pretext of attending  the annual Jewelllery Arabia Expo.

She seemed to have made good contacts  in the country, as in December 2014,  

she posted a photo on Serrain's company  Facebook page of her gifting cufflinks to  

the country's prime minister at the time,  Prince Khalifa bin Salman Al Khalifa.

As I mentioned earlier, the  Lions Club charity was also  

a key way that Maria was building  an important relationship circle.

She was so committed that she eventually  became the secretary of that local chapter.

According to a German Bundeswehr officer who  was treasurer of the Lions Club branch in 2015,  

the club's membership had begun  waning before Maria joined.

An executive from the biggest Lions Club in Naples  

recommended Maria Adela as a  way to invigorate momentum.

He said she's very enthusiastic.  She will bring people back.

He recalls that Maria Adela  was very active in trying  

to revitalize the club, attending all the events.

And at one point in 2018, as membership  began declining again and the prospect of  

club closure reemerged, she even volunteered  to pay herself for everybody's membership fee.

This gesture actually directly aligns with  

a technique used by spies to  gather profiling intelligence.

For example, identifying people with financial  difficulties could mean finding targets  

potentially susceptible for external influence and  who may be vulnerable to recruitment or blackmail.

This would be seen as a valuable intelligence for  the illegal spy to pass on to other operatives  

who would then take more actionable  initiatives with that information.

Then on September 15, 2018, one day after  our article exposing the Salisbury poisoners  

and the GRU passport range was published,  Maria purchased a one-way ticket to Moscow.

In the blink of an eye, she left  her jewelry boutique, friendships,  

and nearly all of her personal possessions  behind without saying goodbye to anyone.

Then, 2 months after her sudden departure,  Maria made one final cryptic Facebook post.

She claimed that she had been suffering from  

cancer and revealed that her hair had  just grown back after chemotherapy.

This appears to be an attempt  to explain her disappearance  

without offering any verifiable information.

Now, her GRU passport number, the unlikely details  of her childhood, and her fake jewelry business  

being stationed at NATO headquarters convinced  us that Maria was a GRU illegal spy already.

But as in many of our  investigations into illegals,  

the final piece of evidence we needed  was to confirm not who she wasn't,  

Maria Adela, but who she really was,  identifying her Russian real identity.

However, uncovering Maria's real identity ended up  being a frustrating months-long challenge for us.

Initial searches for any thread that would  connect Maria to life in Russia were fruitless.

We didn't really have a place  to start because we couldn't  

find a single true detail to search around.

Her name, birthday, and  career were completely fake.

Searching for her face in  Russian passport databases  

yielded hundreds of possible matches  with very low match probabilities.

No public sightings or social media profiles  with her face popped up anywhere in Russia.

It was a deafening digital silence  after her disappearance from Italy.

Then I remembered how often sources in Naples  consistently described one thing about Maria,  

her intense attachment to her cat, Louisa.

In fact, many people described the cat  as the only stable thing in Maria's life.

So maybe, just maybe, this was  the one true thing about Maria.

I hypothesized that she may have brought  Louisa the cat back to Moscow after she fled.

And maybe finding Louisa the cat was going  to be easier than finding Maria the spy.

For months, we started looking  for any potential linkage between  

that cat in Naples and a matching cat in Moscow.

We searched for cats named Louisa  mentioned in Russian social media sites.

We tried to find a database of  Russian domestic pets listed by name.

No such existed, unfortunately.

We even tried to do reverse face  searching using Louisa the cat's face,  

mostly as a joke, but with a secret hope  that it might provide a match in Russia.

None of that produced any  meaningful results, of course.

But then we realized that every cat that  travels from the EU to Russia must have  

one thing: a uniquely numbered microchip  implanted in order to identify the cat.

Otherwise, they can't get on  the plane, cross the border.

It's all linked to vaccinations,  immunizations, and so on and so forth.

And this was our first breakthrough.

We were eventually able to locate the  microchip number for Louisa, the Italian cat,  

asking for a favor from an Austrian police  officer who had a colleague in Italian police.

I had to explain that cats are not people and  

thus they are not subject to  protection from privacy laws.

This argument surprisingly worked.  And after a few months of digging,  

I got the reply to my "pet  project," the microchip number.

At this point in the investigation, we  needed to use every shred of digital  

evidence we had to find who the  real person behind Maria Adela is.

One thing we did is obtain  a Russian phone number in the  

name of Maria Adela that was used when  she was booking flights inside Russia.

We were able to obtain the call records of that  number from the Russian black market for data.

And while she didn't make any  meaningful phone calls in Russia,  

she was using it mostly for internet.

We saw that there were incoming spam phone calls  

from a particular region  in Russia, from Krasnodar.

That's in the south of Russia.

Now, what is interesting is that spam  calls in Russia work in a particular way.

When the owner of a phone number  shows up in a new region in roaming,  

they start getting calls from  spam numbers in that region.

This meant that the owner of the phone  had shown up at least once in Krasnodar.

And then I remembered that in an  Instagram posting of Maria Adela,  

we had found a comment in Russian and that  happened to be from a woman from Krasnodar,  

from actually a town in Krasnodar called Anapa.

And these were two data points connecting the  

person behind Maria Adela to  a particular region in Russia.

But then the stroke of luck was when we were able  

to obtain an old searchable database  of Russian passports from before 2006.

And this meant that that was before the  GRU would have scrubbed any data about  

Maria Adela or the real person behind  the real Maria Adela from databases.

We did a reverse face search with the photo of  Maria Adela, and we found several faces that may  

or may not have been the real person behind Maria  Adela, but one of them was connected to Krasnodar.

And this was a young woman in a black  and white photo who resembled a younger  

version of Maria Adela, and  her name was Olga Kolobova.

Now the photo as you can see is of a much younger  person and although she resembled Maria Adela we  

could not be sure, and in fact my colleagues  were saying this may be a different person.

And then I sent this same photo  to close friends of Maria Adela,  

who had befriended her in Western  Europe, and the reaction was unambiguous:  

that's 100% Maria Adela, which meant Maria  Adela was none other than Olga Kolobova.

Now we were completely convinced  by this point that we had found  

the real Maria Adela, and that was Olga Kolobova.

But that was not enough for  us to publish an article.

We needed to prove it beyond any doubt,  and that meant finding a current photo  

of Olga Kolobova that matches the  person that we see as Maria Adela.

We managed to find Olga Kolobova's OK account.

OK is something like Facebook in Russia.

It was linked to her mobile  number, and that's how we found it.

Although there were no photos of Olga  herself, they were telling signs.

She, for example, followed  a group called Four Paws.  

It was a veterinary clinic, clearly a cat lover.

She posted photos of flower bouquets mirroring  the same aesthetic as Maria Adela's Instagram,  

where there were a lot of  photos in the same style.

And she shared a photo of a Mediterranean beach,  

and she asked her friends to  guess where that had been.

Well, we knew where that was. That was Italy.

Leaked car registration databases showed that  

the person called Olga Kolobova  had bought an Audi A3 in 2020.

And guess what?

Maria Adela was also known  to have loved the Audi brand.

She had posted a picture of herself  behind the wheel of an Audi on Instagram.

All of these were great telling signs that we  found the real person, but we needed a photo.

And then an idea popped up in my mind.

And this is when I turned to an app that I had  

never imagined I would find helpful in an  investigation of illegal spies: Tinder.

In Olga Kolobova's call records, we noticed that  she had received a confirmation code from Tinder,  

which revealed to us that she  must have a Tinder account.

I also knew that Tinder usually works  off the location where you are based to  

serve up romantic partner candidates  that may be in your near vicinity.

So, I created my first-ever Tinder account.

I used a fake Russian name and fake photos.

Sorry to all the men whose  physiques I briefly borrowed.

And I placed my location within 1 kilometer radius  of Olga Kolobova's apartment using GPS spoofing.

And I started swiping and swiping and swiping.

And about 3 days later, I found it.

A woman named Olga who had the exact same photo on  

her Tinder profile that Maria Adela  had on her social media page before.

This was the nail in the coffin.

We finally had the photo not  only similar between the two,  

but literally the same photo  connecting the two identities.

Maria Adela was definitely Olga Kolobova.

After confirming this, thanks  to some Russian hackers,  

we got access to several of Olga's  dating profiles and accounts.

We could see that she spent  significant time swiping,  

chatting, and setting up dates,  sometimes two on the same day.

We also discovered, thanks to these photos, that  she did most of these postings from a desk at  

work because she had a habit of sending photos of  her legs to the men that she was chatting with.

These photos also revealed her  office location, the workspace,  

and full computer screens showing that she worked  at the Russian pension fund office in Moscow.

This was confirmed by her food delivery apps,  

that showed that she was receiving deliveries for  lunch to the office address of the pension fund.

So for any of you who are wondering  what burned Russian spies go on to do,  

it sounds pretty bleak and boring.

They work at the pension fund as accountants.

Using old regional business databases,  we were eventually able to trace Olga's  

previous Russian digital presence  to 2005 when at the age of 23 she  

had registered the company selling  alcohol in Russia's Krasnodar region.

This discovery gave us her old registered address,  

and that enabled us, in turn,  to track down her father.

We found that he headed the military  department at a big university,  

the Urals University, and he had  been decorated with military honors  

and medals because of his international duty  in the republics of Iraq, Angola, and Syria.

Apparently, Olga Koloba was a  second-generation GRU officer.

So, we had been able to prove  the identity of Maria Adela  

as Olga Kolobova using ultimately Tinder.

But that wasn't satisfactory enough because I  had spent so many months tracing Louisa the cat.

We had obtained the microchip number  from Italy. And fortunately for us,  

in the beginning of 2022, Russia introduced  a system of voluntary registration of pets,  

household animals called "Animal ID."

And we were able to get access to that system.

And guess what?

The microchip number, the Italian-issued  chip number in the name of the cat Louisa,  

was linked to an owner  whose name was O. Kolobova .

And there you go.

The role of the cat was finally confirmed.

We could officially confirm that Maria and Olga  were the same person and were a Russian spy.

And we were able to unmask her because of  the very human attributes that spies have.

Firstly, her love for cats, and  secondly, her search for love.

These are the kinds of things that  expose most illegals in the end.

We were also able to later find  a recent high-quality photo of  

Olga Kolobova's driver's license, taken in 2021.

A comparison of the photos yielded a very,  

very high convincing match, proving  one more time, as if we needed it,  

that the Peruvian illegal Maria Adela Kuhfeldt  Rivera was actually GRU operative Olga Kolobova.

Olga's case introduced us to the  new generation of Russian illegals.

Individuals deployed young, trained quickly, and  reliant on their natural charm and improvisation.

Their fake identities weren't just covers.

They were their realities, and the information  that they collected was deeply consequential.

I'm not sure we will ever know  exactly what Olga gathered during  

her time in Naples and passed on  to her superiors within the GRU.

But that's part of what  makes illegal so dangerous.

Since uncovering Maria's true identity, we've also  uncovered a number of other illegal Russian spies.

And we're not done.

If you enjoy these kind of investigations,  

make sure you sign up for The Christo Files.  Subscribe to our channel because then you'll  

stay up to date with our future installments in  the "Illegals" program that we are describing.

Trust me, some of the future stories  are even crazier than this one.

And if you want to find out more  about Russian secret operations,  

maybe you should watch our  existing series on Unit 29155.

In any case, subscribe and stay tuned.