Police and intelligence services in Germany, Sweden, Denmark, Poland and even Russia have for the past year been working on the most sensitive investigation in Europe. They are seeking to unravel the mysteries of the well-run operation that led to the explosion on 26 September 2022 on the Nord Stream gas pipeline connecting Russia and Germany under the Baltic Sea. By following in the footsteps of the suspects, they hope to trace the operation back to a state sponsor which so far has eluded them.
At the heart of the multiple judicial and administrative probes is the search for the crew and the person or persons who paid for the rental of the 15m sailing boat, the Andromeda, which left the port of Hohe Düne near the city of Rostock in Germany a few days before the explosion and which most of the European investigators believe served as a platform for the operation. The route taken by the suspected saboteurs during their two-and-a-half week voyage has now been more or less retraced after months of research. The suspected saboteurs travelled approximately 500 nautical miles, or more than 900 kilometres, on the Andromeda.
Mysterious Warsaw company
The rental of the Bavaria 50 Cruiser yacht was paid for by a front company called Feeria Lwowa based in Warsaw. The company is officially run by nominees with connections in Ukraine. Not a single employee is to be found in the grey office building in Warsaw that is meant to house it. Nor is there any telephone number associated with the company. Intelligence Online has, however, found the name of the owner of Feeria Lwowa: Rustem Abibulayev, 41, a businessman from Kyiv.
Last year, as part of a minor anti-corruption probe into Abibulayev's company, Ukrainian police confiscated around $125,000 from a safe in the company's offices in Kyiv. But a Kyiv court, specifying in its judgement that Feeria Lwowa is indeed the property of Abibulayev, later ruled that the money should not have been seized and ordered it to be returned. It also noted that the businessman's income had risen sharply in recent years. According to information gathered by the media consortium investigating the Nord Stream explosion, which includes Intelligence Online, Germany's Süddeutsche Zeitung, Die Zeit, ARD, Estonia's Delfie, Sweden's Expressen and Poland's Frontstory, his name is now known to German investigators, which may explain why he reacted rather aggressively when contacted by our journalists.
A financial front?
Abibulayev lives in a gated community in Kyiv, a strictly guarded complex for the wealthy. Some of his companies do business with the Ukrainian state. He appears to be no fan of Russia. He posted a photo of himself on social media in front of the shop of a famous Russian dissident and outspoken opponent of Vladimir Putin. And Abibulayev ended a Whatsapp dialogue with the media consortium by sending a graphic showing destroyed Russian submarines and ships.
Did he serve as a financial front for the attack on the Nord Stream pipeline? Journalists from this consortium sought to put that question to him in person a few months ago. As he spotted them in front of his property, he became very aggressive, got into his BMW X3 to chase them, and ended up pushing and hitting one of Intelligence Online's journalists, and refused to let them leave the gate community premises.
Fake Romanian in Rostock
Two people close to him claim that Abibulayev was approached at the time of the events by a long-standing client who asked him to "sort out" the Andromeda issue. It has now been established that his company Feeria Lwowa did pay the rent for the boat. But Abibulayev did not turn up in person to settle the bill. Others were sent in his place: a captain by the name of Mihail Popov and a man by the name of Stefan Marcu.
However, in March 2022, several months before the attack, the German partners in this investigation were contacted by an anonymous source who was keen to talk. The person provided the consortium with a number of items to be confirmed, including the names of influential Ukrainians who were allegedly involved in the operation, such as General Valeriy Zaluzhny, commander-in-chief of the Ukrainian army.
The source also provided information about the alleged involvement of Ukrainian and British intelligence services in the production of false passports, the organisation of diving operations disguised as wreck searches, and the use of satellite telephones.
The anonymous source mentioned Marcu's name in an email and said he had been provided with a false Romanian passport. It now appears that this hypothesis was correct: a person going by the name of Stefan Marcu had in fact presented a Romanian passport in Rostock in order to rent the Andromeda. His real name is believed to be Valery K., a 27-year-old Ukrainian with links to the armed forces. He has posted photos of himself in uniform on social media.
Identity theft?
It is not certain that Valery K. had any part in this drama on the high seas. He may have been drawn into the affair solely because his identity was stolen. A DNA comparison between traces found on the boat and a sample taken from a child Valery K. had with a former girlfriend who lives in Germany proved negative. Marcu, aka Valery K., was therefore unlikely to have been at the scene. But extracting DNA from a boat that was subsequently hired out to other people can prove difficult. During a three-day search of the vessel in January, German investigators reportedly found a sock.
Journalists from Suddeutsche Zeitung, Die Zeit and ARD tried to visit Valery K. in Ukraine, but without success. His grandmother said only that he had not been home for some time because he was serving in the armed forces. She noted in passing that her grandson was "currently under pressure from all sides", but could not say why.
In fact, German investigators have already been in contact with Valery K. but have not specified whether they consider him to be a suspect. In a report to the Bundestag, federal prosecutor Lars Otte referred to the case, noting that it had been possible "to identify with virtual certainty a person who may have been involved" in the Nord Stream sabotage. However, this was before the result of the DNA comparison.
A shipping company with links to Ukrainian state
The source communicating by email with German newspapers submitted another name in March, allegedly of a person with a "secret link" to Marcu. According to our investigation, this name is now on the investigators' radar. He is referred to as Maxim B., is in his twenties and works for a Baltic shipping company for which he supplies staff and ships. The company has strong links with the Ukrainian state: it has earned around $11m in recent years from Kyiv government contracts.
German federal investigators are now wondering whether, as in the case of Stefan Marcu, Mihail Popov and Valery K., Maxim B.'s identity is the right one. Was it Maxim B. himself who sent scans of Marcu and Popov's passports to the owner of the Andromeda from his Gmail address, thus leading the investigators to a Ukrainian IP address? In response to questions from our German partners, Maxim B. said that he uses Gmail, but does not remember writing an email to Mola Yachting GmbH - whose fleet includes the Andromeda - last year.
All these leads lead back to Ukraine, where Kyrylo Budanov, the director of GUR military intelligence, has been stepping up his daring amphibious special operations in recent months. His special forces have increased their skills at sea and on the coast, thanks to British expertise (IO, 26/09/23).
The office of President Volodymyr Zelensky, however, has always denied any Ukrainian involvement in the Nord Stream gas pipeline explosion.
Polish reluctance
Polish investigators' persistence in contradicting the main thesis of the other countries investigating the attack (i.e. that the Andromeda is involved) now seems astonishing. Poland's deputy minister coordinator of special services, Stanislaw Zaryn, gave an interview to our German media partners in which he stated with conviction that the Andromeda was not suitable for such an attack.
It has emerged that during its September 2022 journey across the maritime zone that hosts the pipeline, the crew stopped off at a small Polish port, Kolobrzeg, where they were checked by the local authorities. Zaryn claims that no explosives were found, that the yacht's trip was purely recreational, and that any other version merely served Russian propaganda. But this ignores the evidence gleaned from the other investigations carried out by neighbouring European states, which are now openly complaining about Poland's reluctance to cooperate.
Information from Warsaw is particularly scant, and requests for mutual assistance are processed extremely slowly, if at all. Apparently, video recordings of the Andromeda's crew from Kolobrzeg port exist, but Warsaw simply hasn't shared them yet. De facto, Poland is one of the main beneficiaries, along with Ukraine, of the Nord Stream sabotage. Without the pipeline, the country can reap the benefits of Russian gas transiting through its territory.
Dutch warning of attack
German and other investigators continue to focus on the trail of the Andromeda, which did not return to its port of departure in Hohe Düne until the night of 23 September 2022. The mysterious crew disembarked without even collecting the deposit of several thousand euros they had left when renting the yacht. The mobile phones that investigators believe were used by the crew were subsequently located in Ukraine.
German investigators' certainty of the boat's involvement was confirmed by information gathered from the Dutch intelligence service, the MIVD, and from the CIA.
MIVD agents informed the Americans on 9 June 2022 that an attack on the Nord Stream pipeline was planned immediately after the end of the Baltops regional military manoeuvre in the Baltic Sea, which lasted until 17 June. A source told the Dutch agency, which is usually very well informed about Russian-Ukrainian affairs, that a crew of six was planning to hire a boat in Sweden. They would have false Northern European passports and were to claim that they wanted to explore a popular shipwreck in the Baltic Sea, located just five kilometres from the pipeline. Their sabotage operation was reportedly planned for 19 June.`
After receiving this information from the MIVD, the CIA immediately contacted the services of Ukrainian commander-in-chief Zaluzhny, whom the German media's anonymous source also mentioned in his first email as a person probably in the know about the Nord Stream operation. Zaluzhny supervises the 73rd Naval Special Operations Centre, a unit whose mission includes "sabotage" (see below). In its report, the MIVD also did not rule out the possibility of a "red unit", an attack carried out by a non-regular Ukrainian military command. According to the report, Zelensky was not aware of this operation. The US agency's aim was clearly a warning, if not a threat: don't do what we think you want to do. The information was not forwarded to the BND, the German foreign intelligence service, until mid-June. When no attack took place on 19 June, it was assumed that the MIVD information was tainted.
Fake Romanian not Northern European passports
But when the sabotage did take place in September, it used the modus operandi reportedly planned for the 19 June attack, with a few variations. It was operated from Germany - not Sweden - by a team of six people with false Romanian - not Northern European - passports. And it took place in September, a few days after NATO maritime manoeuvres had finished. The navy ships were practically still on their way home when the Andromeda pulled out of its port.
A year after the explosion, a team of crack divers led by Gary Krosnoff took journalists along on their vessel to try to simulate the attack. They concluded that with the right echo-sounding and lighting equipment, and despite the small size of the platform at the stern of the Andromeda, that it was possible from such a vessel.
This article was updated on 27/09/23 at 11:30am.
