Just before 8pm one evening in September 2021, two men began an unusual conversation on the Telegram messaging app: how to kidnap a Russian fugitive they believed to be hiding in Montenegro.
One correspondent was Orlin Roussev, a Bulgarian IT expert who was in his home office in Great Yarmouth, a faded seaside town in the east of England. The other was Jan Marsalek, one of the most wanted men in Europe, the former chief operating officer of the fraudulent German payments company Wirecard, which had collapsed the year before.
Having fled to Russia to avoid prosecution, Marsalek now appeared to be working full time as a consultant to the country’s military intelligence (GRU) and domestic intelligence (FSB) spy agencies. Together with Roussev, he was running a network of Bulgarian spies based in the UK.
“We don’t mind if he dies by accident but better he finds his way to Moscow,” Marsalek wrote of their intended target — a former investigator who specialised in corruption cases and who fell foul of some powerful people in Russia.
“The kidnap part is easy . . . but then [for] transport part I suggest a private flight,” Roussev replied, urging that they take a considered “science approach”, rather than recruiting “the average killer for hire”. Roussev suggested that his father, presumably a pilot, could be trusted to fly the plane.
“Ok cool thanks!” Marsalek wrote. “That sounds sexy.”
This exchange was presented in a high-profile trial at the Old Bailey that concluded this week with three people under Roussev’s command being convicted on espionage charges. Over three months, jurors heard how Roussev co-ordinated six separate operations across Spain, Germany, Austria, Hungary, Montenegro and the UK to spy on individuals considered to be enemies of Russia — including journalists, dissidents and Ukrainian soldiers — as well as planning sabotage and disinformation schemes.
According to the prosecution, Marsalek received his orders directly from Russian intelligence agencies and passed these to Roussev who, in turn, tasked his associate Biser Dzhambazov.
While Roussev remained in Great Yarmouth, Dzhambazov travelled abroad alongside a band of trusted recruits. These included his long-term partner, Katrin Ivanova, as well as his girlfriend, Vanya Gaberova, and her former boyfriend, Tihomir Ivanchev.
Roussev, Dzhambazov and Ivan Stoyanov — the sixth member of the group, who are all Bulgarian — pleaded guilty to spying charges before the trial began; the remaining three were convicted by the jury.
The significance of this case will echo far beyond the marble-lined lobbies of the Old Bailey. It provides a striking insight into how Marsalek has reinvented himself since escaping the wreckage of Wirecard’s €1.9bn fraud and leaving his closest associates, including the chief executive, Markus Braun, to face justice in Munich.
The trial has also opened a window on how Russia’s intelligence agencies now operate — particularly since the start of the Ukraine war.
Following the attempted poisoning of the Russian double agent Sergei Skripal and his daughter Yulia in Salisbury in 2018, the British government and its European allies expelled over 600 Russian officials from across the continent, of whom more than 400 are thought to have been spies. According to evidence in the trial given by Matthew Collins, the UK’s deputy national security adviser, the resulting implosion in Russian intelligence networks forced Moscow to increasingly lean on non-Russian nationals to conduct espionage.
Spotting an opportunity, it seems that Marsalek found a group of Bulgarians to travel and work at arm’s length for the Russian state.
“We are doing all of this with foreigners . . . No [Russian] natives . . . or law enforcement people,” Roussev wrote proudly to Marsalek in October 2021 while bemoaning the inefficiency of professional spy agencies. “Our people do not need to prove they are ordinary . . . They are natural ordinary people, just more gifted and above average IQ.”
Ivanova, a lab technician, Gaberova, a beautician who had recently won an eyelash championship, and Ivanchev, a painter-decorator and world-class open water swimmer, did not look like spies — but that was precisely the point.
The Haydee Hotel is a three-storey former guesthouse painted gaudily in white and baby blue that sits on a road opening directly on to Great Yarmouth beach. Roussev, now 47, lived in the 33-room property with his wife and stepson, but it was less a family home than a hoard of spy gadgetry.
In Telegram messages, he described his house as an “Indiana Jones warehouse” packed with technology including listening devices, GPS trackers, radio jammers and disguises. When police raided the property on February 8 2023, they found his encrypted hard drive unlocked. The house took over a week to search and yielded nearly 2,000 exhibits.
Espionage operations are typically difficult to prosecute because they often rely on intercept evidence, which cannot be used in UK courts. But in this case, both Roussev and Dzhambazov were found with devices containing over 200,000 Telegram messages in total, which they had apparently failed to delete.
These messages — 80,000 were brought into trial evidence — describe the minutiae of their daily interactions and the planning and execution of surveillance schemes across the UK and the continent. By cross-referencing these with flight records and hotel bookings, police matched the spies’ communications with their movements on the ground.
Marsalek channelled funds to Roussev via a series of crypto wallets and bank transfers. Between 2021 and 2023, the period of the charges, Roussev transferred just over €200,000 on to Dzhambazov, some of which was distributed to other members of the team.
Much of what is revealed in the Telegram messages seems inspired by Hollywood fantasy and espionage legend. Roussev styled himself as “Q”, James Bond’s tech wizard; he and Marsalek also made frequent references to Mission Impossible, Inception and The Fast and the Furious. Roussev’s pseudonym on the Telegram chats was Jackie Chan, Dzhambazov’s was Jean-Claude Van Damme. The commander overseeing the police investigation team told reporters that his early briefings on the case were “like something you expect to be reading in a spy novel”.
Marsalek and Roussev compared themselves favourably to professional intelligence officers — notably the GRU unit that tried to murder Skripal — and criticised what they considered to be the botched murder of the dissident Saudi journalist Jamal Khashoggi. Marsalek bragged to Roussev in one message that “a successful operation on British ground would be amazing after the fucked-up Skripal stuff”.
The pair referred knowingly to the work of other spy agencies, including the French DGSE’s apparent use of limpet mines and a daring abduction by Israel’s Mossad.
With these examples in mind, Marsalek and Roussev set about planning the surveillance of four key targets chosen by intelligence officials in Moscow: Christo Grozev, an investigative journalist then at Bellingcat; Roman Dobrokhotov, a Russian journalist and editor of The Insider, an investigative media outlet; Bergey Ryskaliyev, a former Kazakh politician and opponent of the current Putin-supported government; and Kirill Kachur, a former investigator in Russia’s Investigative Committee, who was later designated a “foreign agent”. (Kachur was the Russian fugitive Marsalek and Roussev intended to abduct from Montenegro via private plane and he remains at liberty.)
Marsalek did not always agree with the orders he was given. Late in 2022, after some members of the Bulgarian team had spent months chasing Grozev around a Bellingcat conference in Valencia and staking out his flat in Vienna, Marsalek wrote to Roussev: “Personally I find CG [Grozev] not to be a very valuable target but apparently Putin seriously hates him.”
Whether or not they understood the rationale, trailing their targets around Europe gave the Bulgarian agents ample opportunity to test Roussev’s spy equipment. Roussev secured access to a travel industry booking system showing that Dobrokhotov, the Russian journalist, would be travelling from Budapest to Berlin in November 2021. Ivanova, who had been booked on to an adjacent seat on the plane, used a camera hidden in the shoulder strap of her bag to record surveillance footage. Peering over his shoulder, she memorised his phone’s pin code and reported it back to Roussev.
At around the same time, the group surveilled a woman believed to be the girlfriend of Kachur at the Adriatic resort of Budva in Montenegro. There, Gaberova used Ray-Ban smart glasses to record footage of the compound where the supposed girlfriend was staying — inadvertently capturing an image of herself conducting surveillance in a mirror she walked past. (This was shown several times in evidence.)
By far the most audacious operation — one the prosecution repeatedly returned to — was the planned surveillance of the US army base in Stuttgart, where Marsalek believed Ukrainian forces were being trained to use the Patriot surface-to-air missile defence system.
He and Roussev plotted to hide an IMSI device, which can track mobile phones and extract sensitive information such as passwords, in a car parked near the base: this would allow them to trace Ukrainian soldiers whose devices were caught in the sting once they returned to the front line. Dzhambazov and Ivanova were sent on a reconnaissance mission to scope out security on the barracks perimeter.
Marsalek appeared to be aware that this represented a new level of risk, warning Roussev in December 2022, less than two months before the arrests were made: “Our friends here [in Moscow] asked me to ask you/ the team to be extremely careful because the Germans are totally nervous at the moment regarding Russian intelligence activities on the ground . . . no point in anyone going to jail.” In the end, the operation never took place.
Dominic Murphy, head of the Metropolitan Police’s counterterrorism command, described the group’s activities as “highly skilled”, and said this was one of the most significant espionage investigations he had come across in 20 years.
Roussev was certainly adept at exploiting vulnerabilities, telling Marsalek he had recruited Bulgarians all over Europe — including cleaners and DHL drivers — to collect information about their employers and provide access to properties. He found an individual at Swissport, an aviation services company, who was willing to provide information on flight manifests for a salary of €1,000 a month. Roussev, Dzhambazov and Ivanova were also in possession of several fake passports, identity documents and driving licences in a range of different names that were judged by police to be high-quality forgeries.
But trial evidence also showed that while the ringleaders’ ambitions were lofty, the results were often underwhelming. The surveillance on individuals was intrusive, but it is unclear whether it secured any useful intelligence. The FT contacted both Dobrokhotov and Kachur to ask them about their experiences of being targeted: the journalist says he had been unaware of being tailed, and points out that his stolen phone pin code was in fact wrong.
The former corruption investigator — who says he was being followed by a number of teams aside from the Bulgarians — comments: “If these [Bulgarians] were professionals, they would have completed their task . . . it turned out that my security team has better skills.”
Roussev and Marsalek painstakingly planned the theft of Grozev’s laptop over several months beginning in the summer of 2021. But once it had been taken from his Vienna apartment and couriered secretly to Moscow for analysis, Marsalek admitted in July 2022: “Sadly . . . it isn’t very exciting.” Grozev, meanwhile, told UK police he hadn’t even noticed that it had gone. Ivanova’s defence barrister, Rupert Bowers KC, cast doubt on the reliability of the boosterish Telegram chats, painting Marsalek and Roussev as hapless fantasists, “sitting in their various bedrooms or wherever, sending these messages”.
It is difficult to be sure how much of a threat this group posed. “This is generally low quality and obviously hastily put together with pretty shonky tradecraft,” Sir Alex Younger, former chief of Britain’s Secret Intelligence Service, tells the FT. “Essentially, Russia doesn’t really care if these agents get caught, and have a pretty casual approach to the welfare of those foolish enough to throw their lot in with them.”
But Andrei Soldatov, an expert in Russia’s security services, believes that shonky tradecraft now matters less than it once might have done. Since the full-scale invasion of Ukraine, it seems that Russian intelligence agencies have calculated that, even if some operations fail, their targets will still be intimidated. They are increasingly using criminal gangs and proxies to do the work of professional spies.
“The very fact that you conduct this kind of operation already serves a purpose, and the purpose is to raise the stakes, to raise the costs of protection,” he says. Grozev, Dobrokhotov and Kachur, Soldatov points out, now need to think much more about their security. The same goes for other sabotage attempts launched by Moscow, including cutting undersea cables or a suspected plot to put bombs in DHL packages on cargo planes.
“They [the Russians] don’t need to conduct really successful operations,” he says. “They just need to indicate that they are willing to do it.”
Marsalek arrived in Moscow at exactly the right time to profit from the have-a-go attitude burgeoning within Russia’s spy agencies. He was named in the indictment as a Russian agent under the pseudonym “Rupert Ticz”, which he used in his Telegram communications with Roussev. Although the prosecution consider him to be a co-conspirator, they did not seek to charge him, most likely because they had no reasonable hope of bringing him to trial. Nevertheless, Marsalek’s voice echoed through the proceedings — a remote commander trailing remnants of his past life (his Wirecard business card was found in Roussev’s flat, while a picture of a “Wanted” poster bearing his image was on Gaberova’s phone).
Austrian by birth, he was recruited by the GRU as early as 2014, according to reporting by Der Spiegel. The FT first revealed his links to Russian intelligence as Wirecard finally crumbled. Having fled Germany in 2020, he made his way to Belarus, according to an investigation by Bellingcat, and then on to Moscow.
The Telegram messages with Roussev suggest that Marsalek exploited his fugitive status to reinvent himself as a freelance intelligence contractor, paying for some operations himself as a proof of concept before asking for funds from the GRU or the FSB. His chats include references to meetings with intelligence officials from both agencies, and expose frustrations with his new colleagues.
“Any idea how to geolocate the Russian mobiles of those guys [in Montenegro] without asking the Russians for help?” he asked Roussev on one occasion. “Seems we can’t trust the FSB unit responsible for this.” In between derogatory comments about work-shy Russians being too drunk to have meetings at weekends, he imagined a future where he was further up the chain of command. “One day I’ll set up an office specifically to run special operations,” he wrote wistfully to Roussev in November 2021.
The messages do not show exactly when the operations started, but there is evidence of a payment of £18,600 made from “Wirecard senior management” to an alias of Roussev’s in July 2019, which suggests that Marsalek had set his Bulgarian network in motion while he was still working for the payments company in Germany. The executive also made a payment of £2,800 to Roussev from his personal UniCredit account the same year.
Marsalek and Roussev had met four years earlier: the latter recalls in one Telegram chat that the pair were introduced in 2015 by a mutual friend whom Roussev had first encountered at the offices of Tim Levy, a London wealth adviser. Levy tells the FT that he met Roussev on two occasions and describes him as “a nerd, a technical geek” with “no charisma”. He says he had been “gobsmacked” to hear of his involvement in the spy ring. However, Levy insists he never met Marsalek and knew of him only via news stories about Wirecard. The identity of the mutual friend who brought Marsalek and Roussev together is unclear.
What is obvious, however, is that Marsalek had found, in his Bulgarian contact, someone with deployable technical skills. According to his LinkedIn profile, Roussev worked in a series of engineering companies in Bulgaria before moving to the UK in 2009. By the time he founded his umbrella company, NewGenTech Ltd, in 2012, he claimed to have expertise in artificial intelligence, secure communications and signals intelligence.
While this may have been bluster, Roussev is judged to have a high level of technical expertise, according to two people familiar with his activities. He purchased and modified equipment, hacking devices together to create viable surveillance technology. For the Stuttgart operation, the team planned to use a second-hand Chrysler in which the IMSI interception device had been installed so it could be activated via a red button next to the steering wheel. The FT was told this was a “legitimate” piece of engineering that was likely to have functioned as intended.
The messages suggest that even if Marsalek’s Russian bosses were nervous about the Bulgarians surveilling a German military base, they still considered it useful. According to Soldatov, Marsalek’s model of operating as a free agent between agencies was normalised by the Russian mercenary Yevgeny Prigozhin — whose Wagner Group operated “at a distance” from the GRU, carrying out operations on its behalf across Africa, South America and Asia.
“We have detected . . . several instances where you have got people who seem to be operating like free agents with really good contacts . . . playing the [GRU and FSB] off against each other, selling them products, and being always on the market,” says Soldatov. This is particularly characteristic of Russia’s relationship with cyber criminals, who are tasked by spy agencies with hacking operations against particular targets. Marsalek’s expertise in financial payments, which could be used to help conceal sensitive transactions, would have been particularly helpful to both the FSB and GRU, according to one person familiar with their operations.
Dobrokhotov — the Russian journalist surveilled by the Bulgarian group — says he has evidence that Marsalek was working for the same FSB unit that exfiltrated him to Russia after Wirecard collapsed. “It is very logical that they asked the person who they were controlling to help them to investigate [targets] in Europe where they don’t have any resources,” Dobrokhotov says. “They need his connections.”
While Marsalek is currently the subject of an Interpol red notice for his role in the Wirecard fraud, he is yet to be charged with any espionage activities. But this could change. An Austrian warrant for the arrest of former police and intelligence official Egisto Ott, seen by the FT, alleges that Marsalek was tasking Ott on behalf of the GRU and FSB from as early as 2017. (Ott, who is awaiting trial, has previously dismissed evidence against him as “games”.) The Austrians are investigating Marsalek’s spy operations, according to a government official. British police say that while Marsalek is wanted in the UK “at this time”, their inquiries are ongoing.
In the meantime, the fugitive fraudster appears to be adapting well to his new career — and apparently gaining deeper insights into Moscow’s intelligence shortcomings. One afternoon in January 2022, Roussev and Marsalek embarked on a favourite pastime: bemoaning the uselessness of Russian spy contacts who had supplied location details on a target that turned out to be nearly a week out of date.
“I honestly feel very sorry for you . . . you have to deal with those ‘amazing’ and ‘efficient’ people,” Roussev writes sarcastically. “Thank you sir,” Marsalek replies. “Its eye-opening to see how this stuff actually works from the inside.”
Additional reporting by Sam Jones in Vienna
Credit: Source link
