THE HAGUE — Like anyone who gets into his dream college, Victor Muller Ferreira was ecstatic when he was admitted to Johns Hopkins University’s graduate school in Washington in 2018.
He came to D.C. as a Brazilian student. The U.S. says he was a Russian spy.
Johns Hopkins graduate Victor Ferreira was unmasked as GRU operative Sergey Cherkasov, according to a federal indictment and Western security officials
By Greg Miller
March 29, 2023 at 2:00 a.m. EDT
The achievement was even sweeter for Ferreira because he was not the striving student from Brazil he had portrayed on his Johns Hopkins application, but a Russian intelligence operative originally from Kaliningrad, according to a series of international investigations as well as an indictment the Justice Department filed in federal court Friday.
His real name is Sergey Cherkasov and he had spent nearly a decade building the fictitious Ferreira persona, according to officials and court records. His “team” was a tight circle of Russian handlers suddenly poised to have a deep-cover spy in the U.S. capital, positioned to forge connections in every corner of the American security establishment, from the State Department to the CIA.
Using the access he gained during his two years in Washington, Cherkasov filed reports to his bosses in Russia’s military intelligence service, the GRU, on how senior officials in the Biden administration were responding to the Russian military buildup before the war in Ukraine, according to an FBI affidavit.
After he graduated, he came close to achieving a more consequential penetration when he was offered a position at the International Criminal Court in The Hague. He was due to start a six-month internship there last year — just as the court began investigating Russian war crimes in Ukraine — only to be turned away by Dutch authorities acting on information relayed by the FBI, according to Western security officials. Officials in the Netherlands put him on a plane back to Brazil, where he was arrested upon landing and is now serving a 15-year prison sentence for document fraud related to his fake identity.
The details that have since emerged provide extraordinary visibility into highly cloaked aspects of Russian intelligence, including the Kremlin’s almost obsessive effort to infiltrate Western targets with “illegals” — spies who operate as lone agents with no discernible link to their home service — rather than diplomats with the legal protections that come with working out of an embassy.
The case has revealed lingering vulnerabilities in Western defenses more than a decade after the FBI arrested 10 Russian illegals in a sweep that made global headlines and spawned a popular television series, “The Americans.” U.S. officials acknowledge that the bureau discovered Cherkasov’s identity and GRU affiliation only after his arrival in Washington. The FBI declined to comment on the case.
The revelations have also exposed serious lapses in Russian tradecraft. Authorities have mined Cherkasov’s computer and other devices and found a trove of evidence, according to court records and security officials, including emails to his Russian handlers, details about “dead drops” where messages could be left, records of illicit money transfers, and an error-strewn personal history that he appears to have composed while trying to memorize details of his fictitious life.
His arrest last April came at the outset of an ongoing roll-up of Russian intelligence networks across Europe, a crackdown launched after Russia’s invasion of Ukraine that officials say has inflicted greater damage on Kremlin spy agencies than any other effort since the end of the Cold War.
The FBI and CIA have played extensive behind-the-scenes roles in this wave of arrests and expulsions, according to Western officials. The charges filed Friday followed a multiyear investigation in which FBI agents gained access to devices seized by authorities in Brazil, according to the indictment, and were permitted to meet with the accused spy face-to-face in São Paulo.
This article is based on interviews with senior U.S., European and Brazilian security officials along with Brazilian court documents obtained by The Washington Post that have not been previously released, as well as the U.S. indictment.
Russia has denied that Cherkasov is a spy and requested his extradition from Brazil by presenting what U.S. officials regard as yet another fictional identity, claiming that he is neither a student nor a secret agent but a wanted heroin trafficker who fled Russia to avoid prison.
Cherkasov’s accounts of his life have also shifted dramatically. After initially insisting that he was Ferreira and that Dutch authorities were mistaken, he admitted his Russian identity in hopes that doing so would help him secure a reduced sentence, said Paulo Ferreira, an attorney who represented Cherkasov and has the same last name as his client’s alter ego.
Even then, Cherkasov engaged in further deception, according to Brazilian court records. At one point, he delivered a tearful confession in which he said he had fled Russia out of fear of punishment for a petty crime. He later endorsed the story presented by the Russian government, even though it supposedly meant facing an even longer sentence in a Russian prison system notorious for its brutality.
Cherkasov’s attorney declined a request from The Post to speak with his client, saying he “doesn’t want to talk with any journalists.”
It is not clear whether the United States will also seek Cherkasov’s extradition, but U.S. officials said one of the considerations behind the indictment was that it might help preempt Russia’s attempt to secure the return of its spy. Cherkasov was charged with illegally operating as a foreign agent as well as multiple counts of bank, wire and visa fraud.
The Russian Embassy in Washington did not respond to requests for comment.
A convoluted ‘legend’
The creation of the Victor Ferreira character began in layers of fraudulent documents that functioned as a kind of chrysalis.
A replacement birth certificate bearing the Ferreira name was purportedly issued in 2009, a year before Cherkasov entered Brazil, according to Brazilian court files. A driver’s license followed with a photo of someone other than Cherkasov. The paper trail suggests that Cherkasov’s path was cleared in advance by Russian enablers and agents already in place.
The GRU appears to have exploited vulnerabilities in Brazil’s immigration and record-keeping system, while also relying on inside help. A notary who signed off on many of Cherkasov’s fraudulent submissions received gifts including a Swarovski necklace, according to Brazilian records and the U.S. indictment. The role of the notary is one focus of an ongoing Brazilian investigation into Cherkasov’s espionage activities in the country and the activities of the GRU, officials said.
Having gained a foothold, Cherkasov proceeded to collect additional residency documents under the Ferreira identity, including a taxpayer ID, a new driver’s license with a photo that actually matched his appearance, as well as a Brazilian passport.
During these early years in Brazil, he held jobs including one at a travel agency that the FBI suspects was run by a GRU operative, according to the affidavit. The travel agency — another echo of “The Americans” television show — has since closed down.
Cherkasov’s “legend” — the espionage term for a fabricated backstory — was convoluted and tragic. It depicted an almost Dickensian upbringing involving a series of surrogate caretakers and extended departures from the country after the death of his mother. To bolster this biography, the GRU cast Cherkasov as the son of Juraci Eliza Ferreira, a Brazilian woman who died in 1993.
In reality, she died childless, according to court records as well as her nephew, Juliano Arenhart. “As far as we know, she never had a child,” Arenhart said in an interview with The Post.
One of the more bizarre pieces of evidence to emerge in the case is a rambling four-page document found on Cherkasov’s computer that is written in Portuguese and reads like the notes of an actor trying to familiarize himself with a part.
“I am Victor Muller Ferreira,” it begins, before unspooling a contrived hard-luck story sprinkled with random details. He describes his aversion to the smell of fish near a bridge in Rio de Janeiro, and a pinup poster of Pamela Anderson in a mechanic’s shop where he supposedly worked.
Other passages seem to anticipate suspicion about his blond hair and puzzling accent, rehearsing ways to deflect such attention by claiming German ancestry and long stretches out of the country during which his Portuguese skills declined.
“My fellow pupils often used to joke about my looks and my accent,” it says about his days at schools he never truly attended. “They called me ‘gringo.’ That is why I did not have many friends.”
On its own, the clunky script reflects a lack of professional polish. The fact that he was still carrying it with him on a laptop a decade later, according to the FBI affidavit, is a startling breach of operational security.
In some ways, shoddy discipline has become a signature of Cherkasov’s alleged employer. In recent years, GRU operatives have seemed to make little effort to cover their tracks in brazen operations including the hacking of Democratic National Committee computers in 2015, the poisoning of Russian defector and former spy Sergei Skripal in England in 2018, and the attempted assassination of Russian dissident Alexei Navalny nearly three years ago.
Despite the tradecraft lapses, Cherkasov made remarkably swift progress toward his goal of infiltrating Western institutions.
After obtaining an undergraduate degree at Trinity College Dublin, he applied to two graduate programs in Washington, according to the FBI affidavit. The document does not name the universities, but professors and students at Johns Hopkins confirmed his attendance.
James Steinberg, the dean of the School of Advanced International Studies, declined to comment on any aspect of the case or its aftermath at Johns Hopkins.
The glee Cherkasov expressed about his admission was followed with similar elation weeks later when he obtained a student visa to enter the United States.
“Man, I got it! I f---ing got it!” he wrote in an email to his handlers, according to the affidavit. “We go there being welcomed! We won, bro. Now we are in the big-boys league.”
Cherkasov, who was 33 when he started at Johns Hopkins but was posing as a student in his late 20s, aroused only the vaguest of suspicions among his professors and classmates.
“I didn’t suspect any Russian in his behavior or accent,” said Eugene Finkel, a professor and native Russian speaker who had Cherkasov in two classes at Johns Hopkins, including one on genocide. In a posting on Twitter after the case became public, Finkel said Cherkasov had been “very smart and competent” and presented himself as Brazilian with Irish roots, so his “weird accent made sense.”
One classmate, however, described an awkward encounter. A former U.S. Navy officer also fluent in Russian said the two briefly bonded after class one day over their shared appreciation for motorcycles.
“I said we should ride together,” said the former officer, who spoke on the condition of anonymity, citing concern for his safety. As the two students talked, the former officer said, he detected a trace of Russian in Ferreira’s diction and thought it odd that a Brazilian would have such a Russian-sounding first name.
“I said, ‘I grew up speaking Russian — do you have any Russian ancestry,’” the former officer said. Ferreira recoiled and replied, “No, I have German,” the former officer said. After initially expressing enthusiasm about riding motorcycles together, Ferreira dropped the plan and kept his distance, said the former officer. “He really stepped back from answering questions at that point.”
During his final year at Johns Hopkins, Ferreira took part in a field trip to Israel with classmates, a trip he used to collect information on U.S. and Israeli officials as well as others the students met with, according to the affidavit. He then shared the list with a Russian handler he met secretly during a January 2020 trip to the Philippines.
Other mysteries about Ferreira appear to have gotten little scrutiny from the university, including how someone from such a supposedly impoverished background — who was offered no scholarships — could afford tuition and other charges that exceeded $119,000 over two years.
After his arrest in Brazil, Cherkasov claimed to authorities that he had covered his costly education with shrewd bets on bitcoin. The FBI affidavit alleges that he was receiving regular cash infusions from his Russian handlers, money he then routed through U.S. and Irish bank accounts.
As graduation approached in 2020, Cherkasov flooded the field with applications for internships and other positions. Among those he targeted, according to the affidavit, were the United Nations as well as “U.S. think tanks, U.S. financial institutions, a U.S. media outlet and a position in the U.S. government.”
Dead drops in the jungle
With the coronavirus pandemic causing a downturn in hiring, it’s not clear how many offers, if any, Cherkasov received. He left the United States in September 2020, according to the affidavit, just months before his student visa was set to expire.
Even from Brazil, Cherkasov continued to find ways to tap into his Washington network. In late November 2021, as Russia was massing forces on the borders of Ukraine, Cherkasov filed a series of reports to his handlers about how senior officials in Washington were interpreting Moscow’s moves.
The affidavit cites emails that Cherkasov sent describing information gleaned from advisers at think tanks, some supposedly in contact with senior Biden administration officials including Secretary of State Antony Blinken. Another report relayed that Defense Secretary Lloyd Austin had been cautioned “not to give any conceivable signal of the U.S. military involvement” to his counterpart in Ukraine.
“Meaning: the administration is definitely not in any position to help Ukrainians, if the fight breaks out,” Cherkasov wrote, according to the affidavit. “The administration does not want this conflict, because they don’t have any meaningful way of gaining something out of it.”
The information was attributed to one of Cherkasov’s former professors, who is not identified in the affidavit. The professor told the FBI that he could not recall any post-graduation interactions with Cherkasov but that he had held online discussions about the threat of Russian invasion. The bureau concluded that Cherkasov was probably “participating in one of those online sessions.”
Cherkasov seemed convinced that Russia would face little backlash from the United States for a Ukraine invasion, saying in one message that there were “no signs indicating that the U.S. is going to provide any but political support to the Ukrainians in case of war.”
His sanguine reports tracked the deeply flawed assessments that Russian spy agencies rendered in the months before the invasion, as well as Putin’s own expectations that the war would end quickly with little interference from the West.
Cherkasov got his next big break soon thereafter, an internship offer from the International Criminal Court. Created two decades ago to enforce international laws against genocide, war crimes and other atrocities, the court has long been perceived by Moscow as hostile. Last month, prosecutors there issued an arrest warrant for Russian President Vladimir Putin, accusing him of war crimes in Ukraine.
As an unpaid intern, Cherkasov would have been in position to roam the court’s glass-enclosed corridors and try to probe its firewalled computer system, according to Western security officials, who said Russia increasingly uses human spies to install software or devices that enable technical penetrations.
By March 2022, just a few weeks after Russia’s Feb. 24 invasion, Cherkasov had “passed the security checks of the ICC and was accepted to the position of junior analyst,” according to the affidavit.
In Brazil, Cherkasov began tidying his affairs. He sought to “meet with a courier” to stockpile cash to sustain him in his unpaid position. He stashed computer drives and other devices in dead-drop locations along a jungle hiking trail near São Paulo, sending instructions to his Russian handlers on where to find them. He also discussed strategies for future meetings with his handlers, proposing return trips to Brazil that would be easy to explain to the ICC.
On March 31, as he boarded a flight to Amsterdam, neither Cherkasov nor his GRU handlers seemed aware of the net closing in on him. By then, the Dutch intelligence service had picked up its own signals that the Russian Embassy in The Hague was making preparations for the arrival of an important new illegal, according to a Western security official.
Authorities in the Netherlands then received a dossier from the FBI with so much detail about Cherkasov’s identity and GRU affiliation that they concluded the bureau and the CIA had been secretly monitoring Cherkasov for months if not years, according to a Western official familiar with the matter.
Dutch officials intercepted Cherkasov at the airport, questioned him for several hours, scoured his devices and used facial recognition software to match the photo on his passport to online images of Cherkasov during his pre-GRU days in Kaliningrad. The Dutch then forced him to board a return flight to Brazil.
He was detained upon arrival in Brazil, where he denied that he was a Russian operative, insisting that the whole matter was a mix-up and that his Ferreira identity was real. Before landing back in Brazil, however, he had sent agitated messages to a woman in Russia he had been romantically involved with for years, according to the affidavit, seeking to enlist her to help in contacting one of his GRU superiors.
Two months after Cherkasov’s expulsion, Dutch authorities issued an extraordinary news release about his failed attempt to enter the country, posting the clumsy biography they said he had composed in about 2010. Dutch officials said the decision to go public was part of an effort to expose Russia’s conduct and call allied governments’ attention to the threat of illegals.
The news quickly rippled through the ranks of Cherkasov’s classmates and professors at Johns Hopkins.
No one was more dismayed than Finkel, the professor, who had written a letter of recommendation to support Cherkasov’s application to the ICC. “I had good reasons to hate Russian security services before. Now I am just exploding,” Finkel, a native of Ukraine who had denounced the Russian invasion and called for investigations of war crimes, wrote in anguished posts on Twitter. “I will never get over this fact. I hate everything about GRU, him, this story. I am so glad he was exposed.”
In Brazil, Cherkasov was confident the 15-year sentence would not stick.
“No f---ing way I’m staying here,” he said in a June 7 message to the Russian woman, whom he had sought permission from his GRU handlers to marry, according to the affidavit. “They ‘had’ to give me a big sentence to save their faces ok? Nobody is going to sit here serving f---ing 15 years for a fake passport!”
In a message sent in late August, he assured the same woman that his case would be finished in a matter of weeks and that by New Year’s the two would be strolling around the Winter Palace in St. Petersburg. “All will be well,” he said, signing off as “Prisoner of War.”
The affidavit indicates that Cherkasov used messaging apps to send photos of handwritten messages to the woman, presumably on devices he was able to use while meeting with Russian diplomats during his detention.
Eight months later, Cherkasov remains in prison amid mixed signals about his eventual fate. The Brazilian Supreme Court recently granted tentative approval to Russia’s extradition request. Russian Foreign Minister Sergei Lavrov is scheduled to visit Brazil in late April, raising the prospect that Moscow will find a way to secure his release.
Even so, Brazil’s high court has said that no extradition can occur until the country’s federal police conclude a second investigation that is focused on Cherkasov’s alleged espionage activities.
The Cherkasov case has been a source of embarrassment for Brazilian officials about their system’s susceptibility to fraud and the frequency with which it has been used by Russian intelligence services as a launchpad for illegals. Another alleged GRU operative relying on a false Brazilian identity was arrested in Norway last year.
Brazilian officials declined requests for on-the-record interviews but said the government is instituting new procedures including national identity checks to help curtail such fraud. Cherkasov’s long-term plan was to use his false Brazilian identity to apply for Portuguese citizenship, which would have enabled him to roam freely across Europe, according to officials and details in the affidavit.
The Cherkasov case has also raised difficult questions for Johns Hopkins, including whether it should do more to screen applicants, whether Cherkasov’s degree should be rescinded, and what the university should do with tuition payments it presumably received indirectly from the GRU.
Gabriela Sá Pessoa in São Paulo, Marina Dias in Brasília and Cate Brown in Washington contributed to this report.
