When in March 2018 news broke that former Russian double agent Sergei Skripal and his daughter Yulia may have been poisoned with a nerve agent called Novichok by spies working for Russia's GRU, Bulgarian arms dealer Emilian Gebrev became alarmed.

Three years earlier, in April 2015, he had been in a coma after being poisoned with an unknown substance. His son and an employee of his company also fell ill and were treated in intensive care. Although the Bulgarian authorities opened an investigation into the matter, they closed it in 2016 for lack of any progress.

Feeling that the Skripal case was similar to what he went through, Gebrev alerted the Bulgarian authorities. He believed he had been attacked because of his intention to buy a stake in a Bulgarian arms factory and that Russian GRU agents, potentially linked to a competitor, were involved in his poisoning.

The Bulgarian law enforcement agencies and the government were slow to respond and so was the prosecution under the leadership of General Prosecutor Sotir Tsatsarov, who was said to have close relations with his Russian counterpart, Yuri Chaika.

Unlike most other European Union and NATO members and Western Balkan countries like Albania, North Macedonia and Montenegro, Bulgaria refused to expel Russian diplomats over the Skripal case. "Usually these cases are not what they seem to be," commented Prime Minister Boyko Borisov in Brussels at the time.

But now Sofia is changing tack. On January 23, 2020, the prosecution under the new prosecutor general, Ivan Geshev, charged three Russian citizens believed to be GRU agents with attempted murder. A day later, the Ministry of Foreign Affairs ordered a first secretary at the Russian Federation's embassy as well as an employee at the trade bureau to leave the country. It had already expelled another Russian diplomat in October.

A report released in November by the investigative websites Bellingcat and The Insider claimed that one of the GRU agents who was involved in Gebrev's poisoning was Sergey Fedotov (real name Denis Sergeev), who coordinated the Salisbury hit squad. He had booked a hotel room close to Gebrev's office and was caught on security cameras walking around in its car park.

The revelations surrounding the 2015 incident come on the heels of a string of spying scandals in the Balkans involving Russian citizens over the past five years. It is no secret that the region has long been a stomping ground for the Kremlin's security services.

Though Russia has no troops on the ground, it has waged a war against the West and its influence on the Balkans by other means - from propaganda and disinformation to assistance to nationalist and far-right groups, all the way to targeted assassinations.

In October 2016, the Montenegrin authorities uncovered a plot hatched by Serb ultranationalists and rogue security officers to overthrow the Montenegrin government. According to the prosecutors, they acted in league with two GRU agents, Eduard Shirokov and Vladimir Popov. Both were sentenced in absentia in May 2019.

Bellingcat and The Insider established that "Popov" (real name Vladimir Moiseev) frequently visited Bulgaria in 2014, possibly preparing for the attack against Emilian Gebrev.

Russian agents also sought to torpedo efforts by Greece and North Macedonia to settle their long-standing name dispute. In July 2018, weeks after the landmark Prespa Agreement was signed settling the issue, Athens expelled two Russian diplomats for stoking opposition against the deal in the northern regions. The move came despite the fact that Prime Minister Alexis Tsipras had refused to do the same in reaction to the Skripal affair four months earlier.

At about the same time North Macedonia's prime minister, Zoran Zaev, pointed a finger at a Greek-Russian businessman for paying Slav Macedonian nationalists to attack the Prespa agreement.

Russian spies have stirred trouble in Serbia, a close partner of Moscow, as well. In November 2019, President Aleksander Vucic accused a former assistant military attache at the Russian embassy of bribing a retired officer in order to obtain confidential information. He was forced to speak up publicly about it after a video of the encounter was posted on YouTube and caused outrage among the Serbian public.

The recurrent spy scandals, however, are unlikely to disrupt Russia's close ties to the region. On the whole, Balkan governments believe in engagement and in recent months they have all showed a willingness to maintain close relations with Russia, despite the spying incidents.

In February 2019, a few months before he was elected prime minister of Greece, Kyriakos Mitsotakis travelled to Moscow to meet a number of top-level Russian officials and express his support for close bilateral ties.

Then, in November last year, North Macedonia held a joint business forum with Russia, headlined by Zaev and Aleksei Gruzdev, the Russian deputy minister of industry and trade.

And earlier this year, Bulgarian Prime Minister Borisov and President Vucic of Serbia were side by side with Russian President Vladimir Putin at the inauguration of the TurkStream natural gas pipeline in Turkey.

No leader seems interested in ramping up rhetoric against the Kremlin at this point. At a time when French President Emmanuel Macron is vociferously arguing for a diplomatic reset with Russia and German Chancellor Angela Merkel is defending the Nordstream 2 pipeline, the Balkans has no reason to strain its relations with the Kremlin.

Yet a pushback against Moscow by the security and the law enforcement agencies is a fact. Russia has gone too far in its disruptive tactics, with GRU's daredevil mindset doing the greatest harm. Western states are no doubt encouraging local efforts to resist infiltration.

GRU operatives will surely continue to roam the neighbourhood but they will be watched closely.

The views expressed in this article are the author's own and do not necessarily reflect Al Jazeera's editorial stance.