The elite Russian spy embedded in the heart of Europe


Even before this week, the case of the Bulgarian spy ring was not short on intrigue. In a story as rich as anything John Le Carré or Ian Fleming might have concocted, three Bulgarian men and two women stand accused of running a two and a half year espionage campaign in Britain.

The Crown alleges that Orlin Roussev, 45, of Great Yarmouth, Norfolk; Bizer Dzhambazov, 41, of Harrow, north-west London; Katrin Ivanova, 31, of the same Harrow address; Ivan Stoyanov, 31, from Greenford, west London; and Vanya Gaberova, 29, from Churchway, north-west London, conspired to abduct targets on behalf of the Russian security services.

These people were doing normal jobs. Gaberova, for instance, ran an award-winning beauty salon, Pretty Women. Material enough to keep the newspapers happy for weeks.

But at Westminster magistrates’ court yesterday came a twist so extraordinary that if you tried to put it in a thriller, any decent editor would throw it out for being too on-the-nose.

Kathryn Selby, the prosecuting lawyer, claimed: “Information was fed back to the UK and reporting was sent from the UK to a tasker on behalf of Russia, a person known as Jan Marsalek.”

Alleged Russian spies Orlin Roussev, Vanya Gaberova, Bizer Dzhambazov and Katrin Ivanova
Alleged Russian spies Orlin Roussev, Vanya Gaberova, Bizer Dzhambazov and Katrin Ivanova

For followers of global crime, it was a marmalade-dropper of a moment. Marsalek’s alleged involvement in the Bulgarian spy ring is the latest turn in one of the most extraordinary criminal sagas of recent times: the Wirecard fraud.

Until the spring of 2020, the payments company Wirecard was a pin-up for the German financial services sector, proof the country could compete with the Americans when it came to dynamic fintech businesses. Marsalek, its chief operating officer, was a pillar of the European business community, a charismatic and smooth-talking executive who spoke three languages and always had time for his colleagues. “For you, always,” he would say, no matter how busy he was.

But on June 18 that year, the company reported that nearly €2 billion was missing from its accounts, practically all the profit it had ever recorded, in what it would later call an “elaborate and sophisticated fraud”. The money had vanished, presumed stolen, from two banks in the Philippines, a region under Marsalek’s aegis.

Wirecard suspended him at once. That evening, Marsalek met Martin Weiss, a friend who had previously been a member of the Austrian intelligence services, for pizza in Munich. Weiss arranged for Marsalek to get out of the country. The next day Marsalek was driven across the border to Vienna and took off in a private jet from Bad Voslau, a small airfield outside the Austrian capital for Minsk, and then on to Russia. It was the last time Marsalek, who had at least eight passports, travelled under his own name.

Today Marsalek, 43, is one of the world’s most wanted men. He is not charged in the Bulgarian spy case, but plenty of other authorities would like to ask him a question or two. Interpol, for example, on whose “Red” list of the most notorious criminals at large his name is listed, next to two pictures: in one he is clean cut, every inch the executive. In the other he has a thick beard, the kind you would grow to disguise your identity.

Jan Marsalek is still at large
Jan Marsalek is still at large

He is presumed to be living somewhere in Russia, having allegedly pulled off the biggest fraud in German history. Compared with the Wirecard case, a five-person Bulgarian spy ring barely registers.

The Wirecard story starts more than two decades ago. Wirecard was founded in 1999, based in Aschheim, a suburb of Munich, as a financial payments company. Marsalek, a talented computer hacker from Austria, joined the following year, on his 20th birthday, tasked with helping the company modernise for the mobile era. He almost brought down the company as soon as he arrived after an “accident” in which he sent all the incoming traffic through his own computer rather than the company servers. In hindsight, it was a warning.

Over the following years, under the leadership of its CEO, Markus Braun, Wirecard expanded into payments for online gambling and pornography. Deals tended to be structured in ways that avoided excess scrutiny, but through a series of acquisitions, the firm grew. In 2009, Braun appointed Marsalek, then 29, as COO. He proceeded with a series of forays into unregulated health supplements and foodstuffs. Customers would hand over their credit card information for a “trial”, which it would be difficult to cancel. In 2010, a man living in Florida, who was linked to Wirecard, was charged with suspected fraud, and pleaded guilty to a lesser charge. Apparently undeterred, Marsalek turned his attention to Asia, buying up several small companies.

CEO Markus Braun was introduced at conferences as the ‘Steve Jobs of the Alps’
CEO Markus Braun was introduced at conferences as the ‘Steve Jobs of the Alps’ - CHRISTOF STACHE/AFP via Getty Images

By 2014, the story had been brought to the attention of Dan McCrum, a reporter on the Financial Times. Leo Perry, a hedge fund manager, had asked him if he would be interested in some “German gangsters”. adding that he ought to “be careful”. When McCrum went to visit one of Wirecard’s supposed companies in Bahrain, he found no trace. He started publishing articles about the firm under the title House of Wirecard. But although McCrum – and Perry – suspected fraud, there was little in the way of hard evidence.

Wirecard went after its detractors aggressively. In 2008, Tobias Bosler, a Munich-based investor who had shorted Wirecard, was confronted by a lawyer and two boxers at his office. One of the boxers punched the wall next to his head, while the other threatened to kill him. Another investor, Fahmi Quadir, was knocked unconscious by a masked man while she was walking on the Upper West Side of New York. At one point, McCrum was so scared he slept with a hammer under his pillow, and would check hedges for secret cameras.

“We knew they had shady connections,” Paul Murphy, McCrum’s editor, recalled later. “It has an effect on your families. As a journalist it was quite exciting. We knew we were right, that this was a criminal enterprise and it was a matter of time before we cracked it. But you get worried about whether you’re being monitored. It gets draining.”

In 2018 Marsalek approached Murphy through an intermediary, who said he would pay “good money” if Murphy stopped writing reports about the company, quoting the figure “10 million.”

German payments company Wirecard reported that nearly €2 billion was missing from its accounts
Wirecard might be down, but that is only half the story - Sven Hoppe/AP

Through another set of intermediaries, a dinner in London was brokered between Murphy and Marsalek, according to a report by Ben Taub in The New Yorker. Over expensive wine and Wagyu beef, which Marsalek paid for with a golden credit card, he hinted that he knew details about McCrum and Murphy’s lives. Murphy told Marsalek he wouldn’t run any more stories about their past activities. But he suspected something fishy. Meanwhile Wirecard carried on growing. By 2018, it was worth more than €30 billion, and Braun, on paper, was a billionaire. It claimed to have more than 5,000 employees. Braun was introduced at conferences as the “Steve Jobs of the Alps”.

Alongside expanding Wirecard’s business, or apparent business, Marsalek had a number of more or less shady connections with the Russian state and other government agencies. In Munich his office was decorated with Russian hats and dolls. He rented a mansion across the street from the Russian consulate, where he hosted parties with spies. He and Braun were members of the “Austrian-Russian Friendship Society”. He issued credit cards under false names to the German intelligence services. In 2016, Masalek helped arrange a deployment of Russian mercenaries to Libya after the death of Colonel Gaddafi, under the guise of a security firm, the RSB Group. In the autumn of 2018, several months after Russian agents poisoned Sergei and Yulia Skripal in Salisbury with Novichok, Marsalek invited Murphy to Germany for lunch. There he showed the journalist a stack of files, including the chemical formula for Novichok. He told Murphy he had got them from “friends”.

He made other attempted political connections, to Donald Trump, and in Syria and Israel. As Taub wrote, “It is unclear what Marsalek was up to. He seemed to take every opportunity to play a part in political matters, no matter how strange or futile.” But in this light, it seems less surprising that Marsalek’s name has come up alongside the Bulgarians.

A wanted poster for Marsalek at Munich Airport
A wanted poster for Marsalek at Munich Airport - Alamy

By 2018, the case against Marsalek and Wirecard was becoming irresistible. Having come to suspect foul play, the firm’s lawyer in Singapore, Pav Gill, had quit, taking a large cache of emails with him, which he passed on to McCrum. On January 30 2019, the FT published the first of a series of stories detailing the allegations against Wirecard. The German regulators, unable to believe this could be true of one of their stock market darlings, banned short selling of the Wirecard stock. German prosecutors, egged on by Marsalek, prepared a case against the FT. Many sided with Wirecard. Spooked by aggressive counteraction, the FT even hired outside counsel to investigate Murphy and McCrum for possible wrongdoing. But they were cleared. Eventually Wirecard ran out of cards.

Shortly after Marsalek fled, Wirecard filed for bankruptcy, the first company listed on the DAX index of the 30 biggest German companies to do so. The case led to a reckoning in Germany about regulation and oversight. In his book about the case, Money Men, McCrum wrote he was driven on by the thought of delivering justice to Marsalek.

Wirecard might be down, but that is only half the story.  Back at Westminster Magistrates’ Court, the trial of the five Bulgarians continues. The slippery Marsalek, or whichever name he uses these days, it seems is still at large.