‍To hear more about Bellingcat’s open-source intelligence gathering listen to True Spies: N is For Novichok

‍

When 'Maria Adela' walked into a room, men stood up. She was young, beautiful and introduced herself as a jewelry designer but her legend began to unravel when ‘Maria’ applied for a Peruvian passport using a baptism record from a church that hadn’t yet been built.

A decade after her arrival in Naples, Italy - home to NATO’s Allied Forces Southern Europe - ‘Maria’ bought a one-way ticket to Moscow and disappeared in 2018.

‍Bellingcat, the Netherlands-based investigative journalism group, set out to find her. They claim Maria is really Russian spy Olga Kolobova, a sleeper agent who worked for GRU military intelligence infiltrating social circles to get close to US Forces and NATO. With remarkable finesse, Bellingcat unveiled not only her alleged identity but offered a masterclass in how to gather intelligence using OSINT - open-source intelligence gathering.

‍

How a spy infiltrates NATO

For years Italian friends knew her as 'Maria Adela Kuhfeldt Rivera', a Latin American jewelry designer and widow with a somewhat chaotic personal life. When ‘Maria’ moved to Naples, Italy, she joined the board of the international 'Lions Club,' a group that encourages peace and international understanding. The branch was founded by a NATO officer, which allowed ‘Maria’ to mingle with NATO staff and US Forces for years. At least one had a romantic affair with her. But who was Maria, really? No one is certain.

Bellingcat obtained metadata from call records of Russian Maj. General Andrey Averyanov while investigating another case, the 2018 Novichok poisoning of Sergei Skripal and his daughter in England. They believed the records also shed light on the mysterious case of Maria Adela and gathered a network of media partners - Der Spiegel, The Insider, and La Repubblica among them - to access open-source data, public archives, issue Freedom of Information requests, comb leaked Russian databases, and interview friends of the suspected Moscow spy.

What they found was startling. The Lima, Peru-based Civil Registration office received an application for the addition of a citizen into the national citizen database on August 8, 2005. ‘Maria Adela Kuhfeldt Rivera’ presented a birth certificate and a baptism certificate stating she’d been baptized at Peru's Cristo Liberador parish in 1978. A website check and contact with the dioceses revealed that the church was established in 1987, nine years after Maria Adela’s supposed ‘baptism’.

Maria’s request was one of three fraudulent citizenship applications that year, according to the Peruvian Ministry of Justice. 

GRU ‘spy passports’

Bellingcat then tracked one of her Russian passports, issued in 2006, and believes it to be a GRU-issued passport with additional numbers linked to GRU spies, including an officer suspected in the Novichok poisoning of Sergei Skripal. 

A check of Maria’s social media accounts revealed photos of ‘Maria’ in Malta and Rome between 2009 and 2011.

Interviews with Maria’s friends from that period revealed a complicated back story. Maria claimed to be the love child of a German father and a Peruvian mother, whose single mother had attended the 1980 Olympic Games in Moscow and left her child there. Her adoptive Soviet parents were supposedly abusive, leading Maria to move to Western Europe in search of a German passport - which she doesn’t appear to have obtained either.

Instead, international travel records revealed that ‘Maria’ took many two-and-a-half-day train rides from Moscow to Paris (via Belarus) beginning in 2011 using her Russian-issued passport. She obtained a student visa to study gemology in France in 2011 and registered a jewelry trademark, Serein. 

“This was likely the seeding phase of a long-term plan by the GRU to deploy their illegal spy as a self-sufficient businesswoman and socialite,” Bellingcat notes. “In the years that followed, it provided cover as she sought to access the highest echelons of NATO’s Allied Joint Force Command in Naples, Italy.”

A year later, ‘Maria Adela’ married a man in Rome who held Italian, Ecuadorian, and Russian passports, enabling Maria to obtain an Italian passport. Data from her husband’s social media accounts and Russian databases show their marriage was registered in Rome and that he reportedly died a year later in Moscow at the age of 30, leaving his young bride to become a socialite in Naples’ elegant Posillipo district.

‍

‍

‘Adela Serein’ emerges‍

Between 2015 and 2018, ‘Maria Adela’ opened a jewelry boutique (apparently with jewels bought from Chinese online wholesalers) and launched a trendy club. Before long, she was the secretary of the Lions Club Napoli Monte Nuovo, a charity established by a NATO officer and supported by members of the NATO command center in Naples.

Her circle of friends included Belgian, Italian, and German NATO staff and US Navy officers who invited her to the annual US Marine Corps balls. At that point, ‘Maria’ used the name ‘Adela Serein’ and launched “the Serein Concept Gallery”, according to newspaper reports. She traveled regularly and was often in Bahrain for trade shows and in Moscow to visit her ‘mother’. A Facebook post shows ‘Maria’ gifting cufflinks to Bahrain’s PM Prince Khalifa bin Salman Al Khalifa.

Bahrain is, as Bellingcat notes, HQ for the US Naval Support Activity Base and US Fifth Fleet with more than 7,000 US officers and troops.

‍

A quick exit

In 2018, ‘Maria Adela’ flew to Moscow on a one-way ticket using a new, third, Russian passport. Her departure was abrupt. She later alluded to having chemotherapy for cancer on her Facebook page.

“In fact, at the time the fictitious person that her shocked and worried friends knew as ‘Maria Adela’ wrote this message, the real woman - a GRU officer named Olga - was spending time behind the wheel of her latest-model Audi car and eying a move into brand-new, luxury apartment in an upscale Moscow neighborhood,” Bellingcat alleges. 

‍Bellingcat and its media partners established that ‘Maria Adela’ didn’t exist in Russian passport databases although she was issued at least three passports over the years. The team then conducted a reverse face-search in Russia’s passport database that led to hundreds of possible matches to analyze. A comparison of two different-age photographs of ‘Maria Adela’ from social media sources finally led to an old passport photo of a Russian citizen named Olga Kolobova, born in 1982. 

Using old, leaked databases, the Bellingcat team discovered that Olga’s father was a retired colonel in Russia’s armed forces. Working through their hypothesis that Olga and Maria were the same person, investigators obtained a circa 2021 photograph of Olga Kolobova from a whistleblower with access to Russia’s database of driving licenses. It provided a convincing match between the faces of ‘Maria Adela’ and Olga Kolobova.

‍

Social media matches‍

Reporters then searched for Olga’s phone number on WhatsApp. They found Olga’s WhatsApp profile image was the same as the photo ‘Maria Adela’ posted to her Instagram page and Facebook profile.

But what about her GRU affiliation? Bellingcat obtained telephone metadata records for Olga Kolobova’s number. On February 23, 2022, Russia’s Defender of the Motherland Day, Olga called a commanding officer from the GRU’s Department 5 (sometimes referred to as Directorate S) - also known as the Illegals Program.

Olga/Maria did not respond to messages sent through Telegram by the time the team went public with their findings.

It still isn’t clear what kind of information Adela/Kolobova accessed in Naples (if any), or what information she gave Moscow after leaving Italy. She let in a hurry, without informing her friends. (She later alluded on Facebook to having chemotherapy for cancer.) 

What is clear is that her network throughout Europe and the Middle East was extensive. "Maria Adela’s network - mingling with NATO and US Navy officers, including some who would have had access to on-base photographs or confidential legal files and databases appears impressive, at least on paper," Bellingcat concluded. "During her deployment, Kolobova travelled extensively under the guise of visiting exhibitions and friends throughout Europe, Bahrain and potentially Thailand. This capability in itself could have been useful to the GRU."