A third suspect in the 2018 nerve agent attack on a former Russian spy in Britain was also in Bulgaria three years earlier at the time of another suspicious poisoning, according to the open-source investigative organization Bellingcat.
In a fresh report released on February 7 along with its Russian partner, The Insider, Bellingcat said the Russian security agent arrived in Bulgaria in April 2015 -- just days before a local entrepreneur and his son became seriously ill after being poisoned by an unidentified substance.
The company of businessman Emilian Gebrev had contracts to deliver military equipment to Ukraine, whose relations with Russia sunk after Moscow's annexation of its Crimean Peninsula and support for separatists in eastern Ukraine.
Bellingcat said the 45-year-old man, who traveled under the alias Sergei Vyacheslavovich Fedotov, had been "conclusively identified as an agent of Russian military intelligence," known as the GRU.
RFE/RL's Bulgarian Service quoted Bulgarian government sources as saying a foreign intelligence service had suspicions at the time that Fedotov traveled to Bulgaria and contacted their counterparts in Sofia.
The Kremlin immediately cast doubt on the findings of the new Bellingcat investigation and earlier reports of a third suspect in the alleged Novichok poisoning of Sergei Skripal and his daughter in Salisbury, England, in March 2018.
"There's only one question: how is it possible that the use of some chemical warfare agent in Europe goes unnoticed in 2015? Why did we find this out only now?" Kremlin spokesman Dmitry Peskov said on February 8, referring to the Bulgarian case, while not completely denying it.
According to Bellingcat, Fedotov flew from Moscow to Burgas, a resort on Bulgaria's Black Sea coast, on April 24, 2015.
He was due to return on April 30 from Sofia, the Bulgarian capital, to Moscow, but did not board that flight.
Instead, late on April 28, he was at Istanbul's Ataturk airport and bought a last-minute ticket for a flight to Moscow.
Earlier on April 28, Gebrev was hospitalized after collapsing at a reception in Sofia. His son, Hristo, and an executive at his company, Valentin Tachchiev also fell ill. All three were hospitalized with suspected poisoning.
Gebrev's condition improved, and he was released from the hospital about a month later. But by late May he was back in the hospital after becoming sick again.
It was at this time, Bellingcat discovered, that Fedotov had returned to Bulgaria, flying on a direct flight from Moscow to Sofia on May 24, 2015.
As with his last known visit to Bulgaria, Fedotov missed his booked return flight on May 28, 2015. Bellingcat said that two days later he took a flight from neighboring Serbia to Moscow.
Bulgarian government sources told RFE/RL that Bulgaria's intelligence service had been tipped off by a foreign intelligence service about Fedotov's possible travel to their country. That service, according to sources, was seeking confirmation of those suspicions.
Skipping booked flights appears to be part of Fedotov's modus operandi.
The British news outlet The Telegraph reported on February 6 that Fedotov had been in Salisbury at the time of the Skripal poisoning, but failed to board his scheduled flight back to Moscow along with the two suspected prime suspects, Anatoly Chepiga and Aleksandr Mishkin.
Peskov questioned whether the findings could be trusted.
"We don't know what they based their [Bellingcat] report on. We don't know whether they are competent, who they are and, moreover, whether it's true," Peskov was quoted as saying by RIA Novosti.
According to Bellingcat, Fedotov's identity was created in 2010 at the same time as the Skripal suspects, Mishkin and Chepiga, who traveled under documents with the names Aleksandr Petrov and Ruslan Boshirov.
Bellingcat said it was able to track Fedotov's travels from 2010 until his last trip to London in March 2018. It said over these eight years Fedotov traveled widely through Europe, Asia, and the Middle East, "often appearing in hot spots just days before news-making events."
Fedotov's true identity is still unknown -- as is his exact role in the poisoning of Skripal and his daughter Yulia with a nerve agent known as Novichok.
It's also unknown what chemical agent might have been used against Gebrev. According to Bulgarian media reports, lab tests conducted in Finland were able to identify a strong pesticide in Gebrev's urine, possibly the banned Amiton (known in Russia as Tetram).
Bellingcat suggested Gebrev may have been targeted because his company had exported military equipment to Ukraine or because of possible Russian interest in a Bulgarian arms plant he owned.
Gebrev reportedly insisted after the Skripal poisonings in March 2018 that Bulgarian authorities reopen an investigation into his 2015 poisoning.