A senior Russian military intelligence officer coordinated the nerve-agent attack on Sergei V. Skripal, a former spy, from a hotel in the heart of London, making repeated phone calls to an unregistered, prepaid Russian number, the investigative group Bellingcat says.
The report sheds more light on a third figure in an attack that threw British and Russian relations into a tailspin — each expelled diplomats from the other country — and led to the fatal poisoning of a British woman after the discarded Novichok nerve agent was found in a perfume bottle in the trash.
Bellingcat said it had traced phone calls made by the officer, who was identified as Denis Sergeyev but who traveled under the name Sergei Fedotov. It obtained his metadata from an employee of a Russian mobile operator, who says that the leak did not breach privacy laws because Sergei Fedotov, the individual to whom the number is registered, does not exist.
Moscow has long denied any involvement in the attack on Mr. Skripal, who was living in the English city of Salisbury after being released from a Russian prison in a spy swap. He and his daughter, Yulia Skripal, survived the poisoning attempt, and now remain in an undisclosed location.
President Vladimir V. Putin of Russia insisted in an interview published on Friday by The Financial Times that Russia had not tried to poison Mr. Skripal, arguing that he had already served a sentence in a Russian prison for assisting British intelligence. He did, however, speak with open contempt for traitors in general.
“Treason is the gravest crime possible, and traitors must be punished,” he said, adding, “I am not saying that the Salisbury incident is the way to do it. Not at all. But traitors must be punished.”
British officials identified Mr. Skripal’s attackers as colonels in Russia’s military intelligence service, the G.R.U., who were caught numerous times on video surveillance footage near Mr. Skripal’s home, where traces of the nerve agent was found and which sickened a local police officer.
Bellingcat later revealed their true names as Anatoly V. Chepiga and Aleksandr E. Mishkin. But until now, few details about the “third man” believed to accompanied the team to London have been revealed.
The group’s findings suggest that the mission was put together hurriedly.
Mr. Sergeyev, it said, received confirmation that he would have to fly to London at 6 p.m. on March 1, just three days before the poisoning, and then called travel agencies, searching for last-minute flights from Moscow to London. He received a booking confirmation just after 8 p.m., Bellingcat reports, and then searched to see whether he would need a new data plan.
He arrived at Sheremetyevo Airport in Moscow at 6 a.m. the following day, and while he waited for his flight to depart — it was delayed by two hours — he downloaded several large data files and sent messages over the messaging applications Telegram, WhatsApp, Viber and Facebook Messenger. Before the flight left, he spoke twice to a Russian phone number belonging to a prepaid SIM card with no registered owner.
During the next three days, he would speak 11 times to someone over the unregistered Russian number, and no one else, Bellingcat reported.
Arriving in London, he checked into a hotel near Paddington Station and spent the next two days there, communicating via encrypted messaging apps and using 3G and 4G connections, Bellingcat said. He left only once, on March 3, during which, phone records reveal, he was near the Thames embankment — a short walk from the railway station where Mr. Skripal’s two attackers, Mr. Chepiga and Mr. Mishkin, would leave about 50 minutes later.
On the day of the poisoning, Mr. Sergeyev received a call from the unregistered Russian number around 9 a.m., and then sent a large data file — possibly a photo — an hour later, just as Mr. Chepiga and Mr. Mishkin headed to Salisbury. He then began his journey home to Moscow.
Bellingcat noted that Mr. Sergeyev’s phone signals in Moscow typically showed him leaving his home for one of two G.R.U. campuses, its headquarters and its training academy.
The patterns of use during the Skripal operation, it said, also suggest a methodology used in such operations, in which a senior coordinating officer communicates with Moscow, while agents on the ground — in this case, Mr. Chepiga and Mr. Mishkin — receive no instructions.