A team of investigators claim to have unmasked a deep-cover spy from Russia’s military intelligence agency, the GRU, who spent a decade posing as a Latin American jewellery designer and partied with Nato staff based in Naples. The investigators say the woman went by the name of Maria Adela Kuhfeldt Rivera, and told people she met that she was the child of a German father and Peruvian mother, born in the city of Callao, Peru. In fact, she was a career GRU officer from Russia, according to research by Bellingcat in partnership with a number of media outlets including La Repubblica in Italy and Der Spiegel in Germany, and shared with the Guardian before publication. “Rivera” was what the intelligence community call an illegal, a deep-cover agent trained to pose as a foreigner. Moscow’s intelligence agencies have used illegals since the early Soviet period. Sometimes, they stay living in their fake identities for decades. Posing as “Rivera”, the illegal moved between Rome, Malta and Paris, eventually settling in Naples, home of Nato’s Allied Joint Force Command, around 2013. She set up a jewellery boutique called Serein and led an active social life. Her acquaintances said that by taking on the role of secretary at the Naples branch of the international Lions Club, she was able to befriend many Nato staff and other affiliates. One Nato employee told the investigators that he had a brief romantic relationship with “Rivera”. Traditionally, illegals have been extremely hard for counterintelligence agencies to find, but in a world of biometric data, facial recognition software and open source investigation possibilities, it has become harder for Russia to keep its illegals below the radar. Christo Grozev, Bellingcat’s CEO and lead investigator, said in an interview that he had first found the trail of a possible GRU illegal when he was looking at a leaked database of border crossings logged by Belarusian border guards and provided by a group of hackers in opposition to the regime of Alexander Lukashenko. Grozev searched for Russian passport numbers in ranges known to have been used by GRU operatives, and found numerous hits. Most had Russian names, but one stood out: Maria Adela Kuhfeldt Rivera. Looking more closely at “Rivera”, Grozev found that she travelled on several Russian passports with serial numbers in a range used by other known GRU operatives, including an officer who had been indicted for the alleged novichok poisoning of the Bulgarian arms dealer Emilian Gebrev, and another GRU officer reportedly involved in the attack on Sergei Skripal and his daughter in Salisbury in 2018. He also discovered that on 15 September 2018, “Rivera” bought a ticket from Naples to Moscow. The previous day, Bellingcat and its Russian investigative partner, the Insider, published an article on the two Salisbury poisoners, who travelled under the cover identities Ruslan Boshirov and Alexander Petrov, noting irregularities in their passport data suggesting they had security services links. It seems “Rivera” was withdrawn by her bosses, who feared that other operatives with similar passport numbers could be compromised. She does not appear to have left Russia again. Two months after her sudden departure from Naples, she posted a Facebook status in Italian, apparently as a way of explaining her disappearance and silence. “It’s the truth I must finally reveal … Hair is growing now after chemo, very short but it’s there. I miss everything, but I’m trying to breathe,” she wrote. Some GRU illegals only travel abroad for quick, short-term missions and change identities regularly, while others like “Rivera” spend years inhabiting the same cover identity. In June, the Netherlands deported a man arriving on a Brazilian passport in the name of Viktor Muller Ferreira, accusing him of being a Russian illegal named Sergey Vladimirovich Cherkasov. He had apparently spent a decade preparing his identity, including stints studying in Ireland and the US, and was suspected of trying to infiltrate the international criminal court in The Hague. The unusual thing about “Rivera” is that she travelled on a Russian passport, when usually illegals disguise their links to Russia or the Soviet Union. It seems that an earlier attempt to pass off “Rivera” as a Peruvian citizen failed: an official Peruvian document from 2006 notes that her application for citizenship was rejected as fraudulent. Apparently, unfazed by the setback, the GRU then relaunched the “Kuhfeldt Rivera” identity with a Russian passport. This was a strange decision, but it is possible she had already made valuable contacts under that identity and did not want to lose them. Numerous people who had met “Kuhfeldt Rivera” said she told them her Peruvian mother had taken her to the Soviet Union in 1980 and left her there. She had apparently tried various routes to gain a western European passport over the years. Bellingcat said it had identified the real Russian woman behind the fake “Rivera” persona, based on information and photo matching from various databases and open source research. She did not reply to requests for comment from the Guardian.