A most wanted man: Fugitive Wirecard COO Jan Marsalek exposed as decade-long GRU spy

This is a joint investigation with Der Spiegel, ZDF, and Der Standard.

In the city of Lipetsk, 300 miles south of Moscow, stands a yellow chapel. Somewhat out of place next to a modern mirrored-window building, situated on the lip of a roundabout, the 200 year-old Church of Holy Transfiguration caters to the faithful of a large mining town that dates back to the era of Peter the Great. Inside, Father Konstantin Baiazov performs the customary rites and rituals for his flock. Dark and bearded, with a short, military-style buzz cut, the church’s archpriest’s routine is standard — services twice a day. Father Konstantin inherited the job — and the calling — from his own father, a revered Orthodox priest who, as local legend goes, had challenged the authority of the formidable KGB during Soviet times.

Konstantin, a father of three, used to travel abroad. He liked visiting Europe, and was particularly fond of Rome. However, he has not left Russia since September 2020. Since the fifth of that month, Father Baiazov’s official passport, numbered 763391844, has not belonged to a man of God. Rather, it belongs to someone who wears a different kind of white collar, looks a lot like him, and is the most wanted man in Europe.

For nearly four years, Austrian national Jan Marsalek has been living in Russia under the assumed identity of Konstantin Baiazov, the real-life Orthodox priest. Marsalek, the former chief operating officer of the disgraced German financial services company Wirecard, has been living in Russia under the protection of the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU), a year-long investigation by The Insider, Der Spiegel, ZDF, and Standard has uncovered. Wirecard, the German equivalent to PayPal, was once a DAX-30 listed company, one of the wealthiest traded entities on the German stock exchange, with a valuation of $28 billion. Then came June 2020, when, in the midst of an audit, Wirecard could not locate €1.9 billion in assets it claimed were being held somewhere in the world — Russia, the United Arab Emirates, or the Philippines. In fact, the money didn’t exist. Wirecard’s worth was predicated on commissions supposedly earned from three companies, Al Alam, Senjo, and PayEasy, based in Dubai, Singapore, and Manila, respectively. Wirecard money flowed into all three, but as the defunct company’s imprisoned former CEO Markus Braun claims, it had then been funneled away into a complex web of offshore accounts controlled by his then number two, Jan Marsalek.

Marsalek, the man responsible for overseeing the forging of company records, its money-laundering operations, and extensive espionage and harassment campaigns against the journalists and speculators who exposed the enormity of Wirecard’s graft, fled in a sinuous route from Germany to Russia via Austria and Belarus on June 19, 2020, at a moment when COVID-19 lockdowns made movement across borders more difficult than usual for ordinary citizens. But Marsalek is not only an internationally accused swindler. He is also an agent of the GRU, Russia’s military intelligence service, and he has been for the last decade. More recently, since his defection to Russia, he has also done jobs for the FSB.

The Insider’s investigation is based mainly on confidential documents, emails, and chat transcripts, as well mobile phone and travel data. Research into Marsalek’s past also included interviews conducted by our consortium partners with people close to the accused. Among these are his mother and his longtime recruiter-handler, whom Der Spiegel met up with in February at a five-star hotel in Dubai.

The never-before-told story of how the Austrian-born “whiz kid” was recruited to Russia’s largest and most notorious spy agency, the GRU, bears all the hallmarks of a genre-bending ham thriller. Sacha Baron Cohen as Bernie Madoff the Bond villain. It is a saga replete with honey traps, MiG fighter jets, erotic models, sinister ex-spooks, even more sinister mercenaries, counterfeit passports, fake priests taking Syphilis tests, and cheap disguises. More ominously, the story also involves surveillance and kidnapping plots, including surveillance targeting a member of the team that investigated Marsalek’s case, Christo Grozev.

“World Domination”

Born in Vienna on March 15, 1980, and raised in the nearby suburb of Klosterneuburg, Jan Marsalek was, in the recollections of his mother, a “presumptuous show-off.” Marsalek’s father was a Czech factory worker who eventually became managing director of a company in the newly independent Czech Republic — “a small man with small ideas,” in the words of his eldest son. Marsalek’s parents divorced when he was a teenager, and he would remain estranged from his family from that point on.

Growing up, everyone who knew him recalls, the young Marsalek had two principal talents: he could talk, and he could charm. “A sales genius, a catcher of people,” says a former friend. Even at an early age, Marsalek seemed to be mugging for the cameras, an international man of mystery in development. One photo from his boyhood shows him in a gray trench coat and oversized floppy hat — the secret agent as envisaged by Titin. He was tall, around 5’11, slim and fond of martial arts, always with a close-cropped haircut. He was educated at Vienna’s Lycée Français, and by the time he left, Marsalek could speak several languages, including computer code. Clearly, his outsized ambitions matched his capacity for persuading others to facilitate his realization of them.

Wirecard was founded in 1999 in Munich at the height of the dotcom boom as a credit card payment processor for online vendors. Then as now, the internet’s truly big business came from revenues connected to gambling and pornography, paid for by Visa and Mastercard customers whose “discretely charged” debits Wirecard was all too happy to transact — for a commission. And if that eventually meant miscategorizing transactions for newly proscribed online gambling sites, so what?

The CEO of the company was Markus Braun, a former KPMG consultant from a middle-class family in Vienna. Braun modeled his appearance on Steve Jobs, always wearing a black turtleneck and wire-frame eyeglasses, even if the tech visionary look was undercut by the clashing black sports jacket Braun insisted on wearing as part of the outfit. With his alleged PhD in social and economic sciences, Doktor Braun wanted to be taken seriously by the Central European financial elite, but he lacked the charisma and ostentatiousness necessary to sell an emerging tech company.

Enter Marsalek. Braun recruited him from a two-man startup to Wirecard a year after its formation, on Marsalek’s 20th birthday. Even though he held no university degree, the “whiz kid” was immediately branded the company’s chief technology officer.

His first major act was a major screw-up, albeit a characteristically self-interested one. Marsalek unwisely “routed all of the company’s internet traffic through his own PC, rather than the dedicated hardware in the server room – a set-up ideal for snooping,” writes Financial Times reporter Dan McCrum, author of the 2022 book Money Men, which chronicles the rise and fall of Wirecard (along with the reporter’s own role as the target of a well-financed vilification campaign).

A favorite word of Marsalek’s was “brilliant,” which he’d use to describe things that impressed or amused him, very often because they involved some form of corner-cutting — if not outright con artistry. Marsalek’s icon in business was a fellow Austrian, Dietrich Mateschitz, the creator and promoter of the energy drink Red Bull, which outsourced production and distribution to others while keeping the profits for itself. Marsalek seemed fond of generating money on the back of a highly touted idea without any tangible product undergirding it, a real-life Joe MacMillan, the fast-talking, overpromising Silicon Valley guru in the TV series Halt and Catch Fire. But whereas the fictional MacMillan was an incorrigible idealist who serially failed in his poorly executed revolutions in personal computing, the all too real Marsalek reveled in being a hollow man. A new software for more secure payment processing? He spent months talking it up, and getting the Wirecard sales team to do likewise, with nothing but scraps of nonsense code to show for it. Any other company might have gone under. Instead, Wirecard ballooned, relentlessly acquiring subsidiaries and subcontractors, including prepaid card concerns and smaller payment processing outfits overseas.

In most cases, the paper trails led nowhere — or, more specifically, they led to shell companies whose nominal directors worked out of slapdash offices atop fast food joints in Bahrain, or that consisted of the unsuspecting local population of an impoverished former steel town in Consett, County Durham, England, where residents were compensated fifty quid for every company they registered. One Wirecard partner was in fact a Filipino family, doorstepped at their villa three hours’ drive north of Manila while in the middle of grooming their poodle with clippers.

The entire empire ran on a Ponzi scheme dedicated to moving money from one Wirecard account into another — a process euphemistically called “round tripping” — and raising ever more cash from deceived shareholders taken in by the smoke and mirrors. More impressive was how Wirecard dealt with critics: the hedge fund analysts and short sellers and financial journalists who were onto its fraud and who, thanks to Marsalek’s silky evasions and dirty tricks, were for years cast as the real criminals in the company’s saga. Wirecard hired goons and snoops who spied on and hacked its enemies, which included the FT’s McCrum, who himself became the target of a German financial regulatory investigation thanks to lies told by the company. Marsalek’s money-launderers exploited Germany’s sterling reputation for commercial probity and Berlin’s defensiveness about its prized Bavarian asset to boost Wirecard’s market capitalization. All the while, Marsalek enjoyed the high life, zipping around the world on a private jet, entertaining associates and casual acquaintances, dropping a grand a pop on bottles of Château Haut-Brion or €15,000 on dinner at the Mandarin Oriental.

Until June 2022, when the whole thing came crashing down thanks in no small part to forensic accountants at KPMG, Wirecard CEO Markus Braun’s former employer. They realized, in the words of Dan McCrum, that Wirecard’s “core European payment processing operations made no profit at all.”

“The problem with us Austrians,” Marsalek liked to quip around the office, “is we always want world domination.”

Blood Lust

Taking over the world usually involves conquering Moscow. Braun’s relationship with the great and the not-so-good of the Austrian establishment opened that door.

Florian Stermann was the chairman of the Russian-Austrian Friendship Society and a fixer for the right-wing populist Austrian Freedom Party (FPÖ). Thanks to Stermann, Wirecard had entered into negotiations for the provision of wireless payment technology with three Russian mobile operators. One of these projects was a joint venture with the mobile giant Megafon to provide NFC payment services to the Moscow Metro, a sprawling subway system that serves more than seven million passengers daily. That one was delegated to Marsalek. But by 2013, the project with Megafon had come to a halt as negotiations with the city-owned subway operator stalled after Megafon began pursuing the development of an in-house solution for NFC payments. Other attempts to offer Wirecard’s payment technology to Russian counterparts also failed, either because Wirecard’s solutions were too expensive or due to delays on the German side.

The Megafon failure wasn’t Marsalek’s first in Russia. Beginning in July 2010, not long after he was elevated from chief geek to chief operating officer at Wirecard, Marsalek began traveling to the country, sometimes making as many as four trips a month. In the space of the next decade, he would visit Russia more than sixty times, with the highest concentration of visits occurring between 2013 and 2016 — exactly when Wirecard’s attempts to export their business eastward were coming to dust.

This was because Marsalek had found new dissipations in Russia, one of them in the form of a tall blonde putative deal-saver named Natalia Zlobina. Born in Tashkent, Uzbekistan, the then 29-year-old Zlobina was already an advertising executive. However, she was more recognizable from her previous career in erotic modeling and B-movie acting, where her best-known feature was Red Lips 2 – Blood Lust, a sexy-schlocky vampire flick in which the thirteen-year-old Zlobina plays a Russian secret agent who kills her victims using a nerve agent.

In a fitting turn of life-imitating-art, Zlobina became a Russian spy.

When she met Marsalek, Zlobina claimed to have an investor who could set up an entity for Wirecard to do business with in Russia. In August 2013, she even incorporated a company called ByteMax Ltd. as a payment facilitation start-up intended to be the German giant’s main Russian partner. She was one of two shareholders, the other being a business partner of Dimitri Pyankovski, who was Moscow’s head of electronic payment services. Everything seemed poised for success.

Email correspondence and travel records reviewed by The Insider and Der Spiegel show that, over the ensuing years, Marsalek and Zlobina’s relationship became an intertwined mix of business and personal pursuits. Despite Zlobina’s connections in Moscow, the professional side didn’t go so well for Wirecard. ByteMax ran up a large bill to Marsalek’s company that it didn’t have the funds to repay. But Marsalek hardly minded. His emails to Zlobina show he’d taken to coaching her on how and to whom at Wirecard she should address her requests for extensions to the payment deadlines. The dues were never repaid. ByteMax was wound down.

At the same time, the personal relationship between Marsalek and his protege blossomed. The two traveled both together and separately in Russia and abroad, with Wirecard fronting the costs for some of the trips. Emails show Marsalek’s personal assistant booking travel for Zlobina to Barcelona in March 2015; she stayed at a ​​€695-a-night hotel. Marsalek would sometimes fly into Russia on his private jet just to pick up Zlobina and then fly on to the Greek island of Santorini for a weekend getaway. They were more than associates; they were lovers.

And they liked it rough. Marsalek was drawn to BDSM, and so was Natalia. They were also drawn to others for whom violence was less a leisure activity than a means of retaining political power.

Travel records show that Marsalek and Zlobina traveled in September 2013 to Grozny, the capital of Chechnya. Witnesses have told Der Spiegel the purpose of the unlikely tourist trip was to meet the family of Ramzan Kadyrov, the Putin-installed strongman president of the Russian republic. Kadyrov’s clan had a few hundred million squirreled away in banks in Hong Kong, and they needed a way to move it to Europe without arousing any suspicions. According to Zlobina, by then au fait with Wirecard’s global network of matryoshka companies and their dummy deposits, Marsalek was the Kadyrov clan’s man for the job. According to witnesses, two additional meetings between Marsalek and the Kadyrov family were arranged — one in Vienna and another in Asia, the site of the dirty money. On the Chechen side in Vienna was the silver-haired Akhmed Pakaev, who claimed to be a major from the FSB, Russia’s Federal Security Service and one of the successors to the Soviet-era KGB. Leaked Russian bank credit records examined by The Insider show Pakaev had previously served as a Russian representative to Interpol.

In January 2014, Marsalek jetted Zlobina to Kyiv at the very moment when the Ukrainian capital was mired in a protest movement against its pro-Russian President, Viktor Yanukovych, who at Putin’s prompting and financial encouragement had reneged on a campaign promise to sign an association agreement with the European Union. By the time the power couple arrived, the Euromaidan movement was already under physical threat from officers of the Yanukovych-loyal Berkut riot police and plain clothes hired thugs called titushki. The anti-revolutionary activities were being orchestrated by the FSB’s Fifth Service, the Russian organization’s foreign intelligence arm. In Kyiv, Marsalek and Zlobina again met with Pakaev, who had arrived in Ukraine in November at the start of Euromaidan for purposes that can only be guessed at.

Leaked emails show that Pakaev introduced Marsalek to Konstantin Torop, the self-styled director of the International Police Corporation for Public Security, a non-government militia that has reportedly been investigated by Interpol over accusations that it was impersonating a public police body. In one letter to Marsalek, who used an email account that itself spoofed a state official from Grenada (jan.marsalek@stateofgrenada.org), Torop informed him that, on Pakaev’s recommendation, Marsalek had been issued a membership ID from the “police” club.

Marsalek and Zlobina continued to travel, and not only to earthly destinations. In May 2016, Zlobina booked her boyfriend on a flight into the stratosphere aboard a Russian MiG fighter jet. But while images of the lovebirds on their adrenaline-filled extreme romantic getaways were known to Russian social and business elites at the time, the affair remained a mystery to all but a few employees at Wirecard. Back in Munich, Marsalek was involved in a steady, long-term relationship with Viola, his German girlfriend and eventual fiancée. The COO even boasted to his Russian friends that he’d relocated Viola to Hamburg, making it easier for Zlobina to visit him in Munich without any worry she might bump into her rival.

Jan and Natasha were also busy outside of the bedroom.

While Wirecard’s entry into the Russian market foundered, Marsalek and Zlobina launched at least one joint enterprise together, a cryptocurrency mining farm located in the far northeastern region of Yakutia, Russia. The three megawatt farm, called Atlas Mine, was built with equipment purchased by Marsalek through offshore accounts using a UK intermediary. The project followed Marsalek’s tried-and-true method of revenue generation: a pyramid scheme in which for the low, low price of $100, investors were guaranteed enormous returns within the space of six months and continuing payouts in perpetuity. The prospectus for Atlas Mine’s initial coin offering (ICO) also referred to a previous project by the same operator, this one based in China. A YouTube video uploaded in May 2018 shows the installation process and “operational” phase of what appears to be a large crypto mining farm. It is not known how many, if any, investors the ICO project attracted. Its website has been defunct since at least 2021.

It is also unknown whether Zlobina’s work for the Russian security services preceded or followed her personal and professional involvement with Marsalek, but in any case, she certainly enjoyed the kinds of unusual state protections typically associated with Russian intelligence operatives. For instance, her passport dossier — something usually obtainable through the transparent Russian personal data trading market on the dark web — was replaced by another woman’s file when The Insider attempted to acquire it. Subsequent attempts to retrieve the file were returned with a “missing person” notification. Likewise, all of Zlobina’s travel records for the two years after Marsalek fled to Russia have been purged from the comprehensive Russian database, Magistral, presumably in order to prevent anyone from tracing the Austrian fugitive’s movements by using his girlfriend as a proxy. Data for Vadim Krasikov, the FSB hitman who fatally gunned down Georgian intelligence asset Zelinkham Khangoshvili in Berlin’s Tiergarten park in August 2019, was similarly removed from the Russian system. (Krasikov, convicted in 2021, is currently serving a life sentence in a German prison.)

Stas, the General from GRU

On July 6, 2014, Zlobina turned 30. It was also the day Marsalek met his GRU handler.

Zlobina was waiting for her beau aboard a dingy Greek-flagged cutter, “Poseidon III,” in the Mediterranean waters off the coast of Nice. Marsalek arrived with a second man, who was carrying his suitcase. Marsalek climbed down a ladder into the vessel and gave Zlobina a perfunctory peck on the cheek. He was clearly angry, which was the point of this vignette, captured on marina security camera footage retrieved by Der Spiegel. The Poseidon III was a ruse, Natasha’s joke.

Zlobina’s birthday gift to Marsalek — or maybe to herself — was an introduction aboard the yacht to a man named Stanislav Petlinsky. Zlobina introduced Marsalek to Petlinsky as “Stas, the General from GRU.” At the time, Petlinsky was dating Zlobina’s best friend, and she promised Marsalek that “Stas” would be a terrific addition to his thickening rolodex of influential Russian contacts.

So he would.

In the 90s, Petlinsky had been a supervising officer in the GRU Spetsnaz, or special forces, and fought in Chechnya. He spent that floating evening with Marsalek regaling him with his exploits — particularly as a marksman, as Marsalek expressed an interest in guns. Petlinsky’s exact rank and role in Russian intelligence — hinted at by the man himself to an intimate circle of contacts, either in truth or as provocatively sprinkled bits of disinformation aimed at burnishing his legend — is murky, but Western spy agencies do not doubt that his employer is the Russian state.

Among those Petlinsky has regaled is a reporter from Der Spiegel. That conversation occurred mere weeks ago at the Jumeirah al-Naseem beach resort in Dubai — amid a plentiful selection of champagne, Beluga caviar, and young Russian women.

Petlinsky is found sitting on the terrace overlooking the Persian Gulf. Not far from him is another Russian, Alexander Lebedev, the ex-KGB officer turned oligarch and publishing magnate who controls Britain’s Independent and Evening Standard newspapers. The two clearly know each other and nod a silent greeting.

Trim at 60, dressed in a gray pinstripe, black tee, and mirrored aviator sunglasses, Petlinsky confirms meeting Marsalek aboard the yacht in Nice in July 2014. “You know, I fell in love with him from the first moment,” he said. “He has such a beautiful mind. I always think so small, in dimensions of what’s possible,” Petlinsky continues, echoing Marsalek’s animadversions about his own father. “Jan always thinks big, very, very big.” Being chancellor of Germany? Too small for Marsalek. “But uniting China, Russia, and Europe as a counterbalance to the USA? That would interest him.”

Fancy toys and women aren’t Marsalek’s motivation, Petlinsky insists before describing the Austrian’s “beautiful mind” as being “a bit autistic.” While Marsalek’s acquaintances almost universally define him with the word “charisma,” Petlinsky says Marsalek’s weak point is dealing with people. “He lacks empathy,” the Russian spy says, not noting that the trait he describes is a telltale sign of the sociopath.

What about Marsalek’s espionage and Petlinsky’s role in it? The Austrian is just playacting at spy games, Petlinsky maintains, inhabiting a theatrical role with no real-world legitimacy to it. Marsalek is “obsessed” with spycraft and all its mystique, something others also attest to. As for Petlinsky himself, he swears he’s merely a “security advisor” with a big portfolio in Africa, the kind of man who sometimes meets with Putin and chases down FSB agents. He offers a robust critique of the amateurish nature of the Khangoshvili assassination in Berlin — no small thing given that Putin has recently praised the killer Krasikov as a “patriot” in a much-discussed sit-down interview with Tucker Carlson. Petlinsky admits to introducing Marsalek to a host of colorful characters in Russia. He doesn’t want to talk about which ones were Russian intelligence officers, and he changes the subject.

But to his close circle of friends, Der Spiegel has learned, Petlinsky boasted about handing Marsalek off to the GRU after that first meeting in the South of France in 2014. Friends of Marsalek say the Wirecard fraudster’s life can be divided in two halves: “before Stas” and “after Stas.”

They traveled together, often as a trio, with Zlobina in tow. One such trip was to Tunisia via private jet from Moscow in March 2016. The next month, they returned to Nice, the scene of Marsalek and Petlinsky’s meet-cute recruitment; then it was on to Tel Aviv. Stas pulled plenty of strings, as Russian border records demonstrate that much of his foreign travel is designated as “official visit to a diplomatic mission,” a category typically reserved for Russian Foreign Ministry officials.

The relationship was so close that, at one point, Petlinsky even told friends that he relocated his own mother, who suffered from health problems, to a clinic in Munich just to be closer to Marsalek, who built himself his own back office for Wirecard and other pursuits in a villa at Prinzregentenstraße 61, right in the center of the Bavarian capital. Johanna Singer, an employee of Wirecard (name has been changed on her request), recalled meeting Petlinsky at the gourmet Munich restaurant Tantris, where the GRU officer celebrated one of his birthdays with Marsalek, complete with a cake shaped in uncanny resemblance to the Soviet red star. One of the toniest areas of Munich, the high-ceilinged, white-columned digs cost €680,000 per year in rent, all paid for, of course, by Wirecard via its manifold holdings. A germaphobe in the mold of Donald Trump (the Wirecard executive somehow unsurprisingly owns a life-sized cut-out of the 45th U.S. President), Marsalek even had a field hospital built in the villa during the pandemic. The back office was conveniently situated directly across from the Russian consulate in Bavaria.

Marsalek's Mercenaries

Stas was also a connector.

A proud owner of a Harley Davidson himself, he introduced Marsalek to a heavy-set man fond of Hells Angels attire, whom Petlinsky referred to as “Vladimir, my mercenary.” Vladimir’s actual name is Anatoliy Karaziy. Like Petlinsky, Karaziy is a former GRU Spetsnaz officer, and the two are thought to have served together in Chechnya. At the very least, the mercenary part of the story proved true, as Karaziy belonged to a guns-for-hire outfit that gained in infamy after its debut on the battlefields of eastern Ukraine in 2014. It was called the Wagner Group, and it was founded by catering magnate and ex-con Yevgeny Prigozhin, a personal friend of Putin’s from their native St. Petersburg.

By 2017, Karaziy was the head of Wagner’s intelligence service. Travel data examined by The Insider confirms that on May 5, 2017, Karaziy flew from Moscow to Munich to meet with Petlinsky and Marsalek. From there, the three men flew to Beirut and then took a car into war-torn Syria, visiting the ancient city of Palmyra, which Russian forces backed by Wagner had recently captured from the terrorist group ISIS. The three men remained in Palmyra for a week, with Marsalek dressed as a soldier in aviator headgear, a flak jacket, and combat helmet (witnesses told Der Spiegel that Marsalek initially showed up dressed in brand-new state-of-the-art camouflage garb and military gear — a “shiny object in the desert” that would have attracted enemy fire within seconds; he was quickly given standard Russian attire to change into). He’s alleged to have shot live rounds at Islamist militants.

In Dubai Petlinsky suggested the rounds had come from a rocket launcher, and that Marsalek had even been given a tutorial in how to position himself properly in order to fire it. The visit to Syria, Petlinsky says, was “a dream of Jan’s that I made come true… Jan imagined a helicopter flight and loud music and Ray-Ban sunglasses. Of course, that didn’t happen. Too dangerous.”

Another high-flying Russian to whom Petlinsky introduced Marsalek was Andrey Chuprygin, also a former GRU officer — a colonel — who worked for Petlinsky’s Center for Eastern Civilization Studies. Chuprygin was an academic, too, with a teaching job in African studies at the Moscow School of Economics. He also served as an adviser on Libya to Russia’s Foreign Ministry, a title Petlinsky even arranged for Marsalek to acquire.

Marsalek’s interest in Libya wasn’t confined to ego-gratifying honorifics from the Russian government. Upon his return from Syria, Petlinsky persuaded him to invest in the North African country, which was still reeling from the brutal civil war that ended Col. Muammar Gaddafi’s three decades of iron fisted rule. Someone recommended Marsalek buy cement factories, without which postwar Libyan reconstruction would be impossible. And he did. But as usual, Marsalek was thinking bigger.

In June 2017, Marsalek arranged to meet an Austrian UN worker named Kilian Kleinschmidt at the popular Munich cafe Käfer-Schänke. Kleinschmidt had decades of experience helping refugees get out of hot spots and, persuaded by Marsalek’s apparent concern for Libya’s wretched of the earth, he agreed to accept €200,000 to conduct a study on rebuilding the country. The invoice, Marsalek told Kleinschmidt, was to be sent to the Russian-Libyan Cultural Institute in Moscow. That should have been an immediate red flag. It was also bait.

At a second meeting, at Marsalek’s Prinzregentenstraße back office, Kleinschmidt was horrified to discover the Wirecard exec’s real intention: to train up a private army of 15,000 to 20,000 Libyan mercenaries who would be put in charge of guarding the country’s southern border and restricting migration flows at gunpoint — the opposite of Kleinschmidt’s life work. Marsalek even giddily recounted how mercenaries could be outfitted with state-of-the-art body cams to record “awesome video material” of them shooting people, which could be streamed live to the internet. Stas had told him all about how Wagner was using this technology already, the only hiccup being that the footage couldn’t be used for marketing purposes since Wagner had a habit of executing all of its POWs. Still, Marsalek and his “lack of empathy” wanted a brand all his own. Kleinschmidt could not escape the meeting fast enough.

The experienced UN worker was no longer an option, but Petlinsky had an alternative solution. Marsalek should enlist the services of a Russian private security company whose owner, Oleg Krinytsin, was also a Petlinsky acquaintance. Krinytsin’s outfit was RSB Group, one of Russia’s oldest PMCs, with international experience in Somalia, South Africa, Egypt, and Sri Lanka. Among its stated achievements were counter-terrorism operations and anti-piracy protection for marine vessels, a task that involved the use of non-lethal acoustic sound cannons.

Marsalek again had wider eyes than did his case officer. He didn’t just want to hire RSB Group; he wanted to buy it outright. Not only would he use it to clean up the cement company, he would have his private army on the ground in a strategic country in Northern Africa. Petlinsky negotiated a purchase price for RSB Group with Krinytsin. The deal was for Krinytsin to remain nominally as the public-facing owner, but to hand over the levers of control to Marsalek and Petlinsky.

The purchase price was paid in cash, which Marsalek provided to Stas in tranches of several hundred thousand dollars shuttled on his private jet from Munich to Moscow. The formal ownership of the original Russian company called RSB Group remained unchanged; however, its business was de facto moved to two new companies: a newly formed Russian entity with the identical name, OOO RSB Group, and an Isle of Man-registered offshore firm called RSB Group Ltd.

The Russian company was wholly owned by Kirill Korobeynikov, Petlinsky’s son. The Cayman Island firm, which had a contract with the Libyan Cement Company, was owned 25% by Korobeynikov, and 25% by Victoria Bowman, the Russian wife of Marsalek’s long-standing business partner Joe Bowman. The remaining 50% was owned in proxy by a Swiss lawyer, Richard Cedric Harry Ritter.

The integration of Marsalek’s personal and professional lives with Petlinsky’s followed much the same trajectory that Marsalek’s development under Zlobina had. By 2017, both of Petlinsky’s sons were fully mobbed up in Wirecard’s off-books and illegal operations. Korobeynikov, The Insider has learned, supervised a group of hackers for Wirecard. Their target list included the short sellers out to prove the company’s stated value was pure fiction, along with McCrum and other journalists at the FT who were looking to report the same. The email address Korobeynikov used for several Russian e-gov services was FTraid@gmail.com.

Petlinsky’s other son, Allen Petlinsky, an attorney based in Israel, acted in a legal capacity in mergers and acquisitions on behalf of Wirecard, Marsaleks’s email correspondence further shows.

Spies ‘R’ Us

All of this took place as Wirecard’s stock market value skyrocketed — and as Marsalek’s willingness to rely on intelligence operatives to help furnish the propellent grew bolder and more reckless.

One of his hirelings was Rami El Obeidi, the former head of foreign intelligence for Libya's post-Gaddafi transitional government. A lover of Italian haute couture and expensive vintages, El Obeidi helped spy on Wirecard detractors and even concocted a doctored sting operation to suggest that the FT was conniving with short sellers to sink the company — an allegation German regulators took seriously enough that they opened criminal investigations against McCrum and his colleagues.

Germany's financial regulator, BaFin, is notably supervised by the Federal Ministry of Finance, which at the time of Wirecard's collapse was headed by current Chancellor Olaf Scholz.

Two other accomplices to Marsalek’s cloak-and-dagger sideline were recently retired officials from Austria’s domestic security service, the BVT, officially known as the Federal Office for the Protection of the Constitution and the Fight against Terrorism. (The agency was disbanded in 2021 after it failed to stop an Islamist terror attack in Vienna that killed four and injured 23.)

Until 2017, Martin Weiss was the head of BVT’s Department II, which was in charge of intelligence gathering and investigations. Weiss had therefore had access to all relevant classified information collected by BVT or given to it by allied foreign services. Marsalek hired Weiss as a “consultant” in 2018, using his extensive network of agents and informants in the West to gather information on anyone Marsalek or Wirecard needed to know about, including journalists in Europe. Weiss brought on one of his former deputies at BVT, Egisto Ott, who was suspended from the service in 2017 on the suspicion that he was transmitting information to Moscow. Ott ran background checks for Marsalek.

Weiss was arrested and interrogated after Wirecard’s implosion and Marsalek’s disappearance from Europe. Austrian investigators found that he and Marsalek were part of an “intelligence cell whose capacities and capabilities were used by Russian intelligence services.” He currently resides in Dubai.

Ott was detained but released from pre-trial detention in the spring of 2021. In a brief interview with Der Spiegel, which met up with him at his home in Carinthia, Austria, in the Eastern Alps, Ott denied he was any kind of Russian spy. However, text messages examined by The Insider show Ott asking a police officer in Italy for help in understanding why the mistress of Russian oligarch Arkady Rotenberg and her sister were having difficulty crossing borders. The answer came back: they’d both been flagged in the European border surveillance system SIS.

By this point, Wirecard’s client list included Germany’s Federal Criminal Police Office, giving Marsalek — and the Russian intelligence services — access to sensitive data about German law enforcement’s slate of confidential informants. Marsalek even received a confidential report prepared by the Organization for the Prohibition of Chemical Weapons (OPCW) about the poisoning of Sergei and Yulia Skripal in Salisbury, England in 2018. Sergei Skripal, a GRU defector to British intelligence, was targeted for liquidation by members of the GRU’s assassination and sabotage team, Unit 29155, and the highly restricted document Marsalek had in his possession contained the chemical formula for the toxin used: Novichok, a Russian military-grade nerve agent. Marsalek received the report from Johannes Peterlik, the former Secretary General in the Austrian Foreign Ministry. A video of the document was even recorded on Ott’s cell phone on October 5, 2018. Of course, the GRU could have gotten its hands on this material through more above-board means. Russia, after all, is a party to the OPCW and thus would have been privy to the Novichok report, even if it implicated Russian spies in the failed murder attempt.

Not that Marsalek didn’t earn his keep in other ways. In 2019, he instructed his underlings at Wirecard to compile a database of customers from major international companies, purportedly for use by Germany’s Federal Intelligence Service, or BND, the country’s equivalent to the CIA. Only the BND never commissioned any such project, raising the immediate question as to who did.

As Petlinsky’s intelligence apparatus grew — thanks in large part to his Austrian asset — Wirecard’s bid to take over the world appeared unstoppable. In 2018, the company joined the DAX, meaning it had become one of the 30 most valuable companies in Germany. At one point, German Chancellor Angela Merkel even brought up Wirecard’s €109 million purchase of Allscore, a Beijing-based payments company, in a meeting with Chinese President Xi Jinping. Given that Wirecard wasn’t just a financial services giant, but also a bank — the “daughter,” as CEO Markus Braun awkwardly put it, of the original business — its only serious competitors in Germany were Commerzbank, which it had displaced on the DAX, and Deutsche Bank. In June 2020, as allegations of widespread stock manipulation, book-cooking (if not wholesale book-inventing), and money-laundering continued to bedevil Wirecard’s shareholder confidence, the company nevertheless launched a quixotic plan to buy Deutsche Bank. The scheme was described by Braun as both a reputation-salvaging PR move and a potential means of keeping Wirecard’s top management out of prison, as the company’s funny money could be confusedly mixed in with Deutsche Bank’s legitimate revenue.

That same month, Wirecard had to confess that it couldn’t account for the missing billions reported in its accounts. Braun resigned as CEO and was arrested later that year on charges of market manipulation and embezzlement, with gang fraud added to his rap sheet in 2022. Marsalek was placed on leave, but he had no intention of following his boss into a jail cell.

On June 18, 2020, Marsalek met Weiss at an Italian restaurant in Munich to plot his escape from Germany. The plan was to fly from the Bad Vöslau airfield 20 miles south of Vienna. Marsalek boarded a small private jet, paying the pilots €8,000. To throw his German pursuers off his trail, Marsalek even got sources in the Philippines to falsely suggest his plane had landed there. In reality, as The Insider and Bellingcat pieced together in 2020, Marsalek’s destination was Moscow, where he arrived via Minsk.

Based on leaked travel data and emails, it can now be revealed that Petlinsky, Marsalek’s GRU handler, was the lynchpin of the exfiltration.

From Germany to Crimea

Petlinsky had a plane at Bad Vöslau initially booked in the name of David Iakobashvili, a Georgian billionaire with formerly close ties to the Russian government. (Iakobashvili, who co-owns a Russian wholesale distributor called PI OO with Petlinsky, resides mainly in Monaco.) A copy of Iakobashvili’s passport was supplied to the private jet operator, though Iakobashvili told The Insider he wasn’t aware of his passport being used to ferry a fugitive out of Europe.

On the day of the flight from Austria to Belarus, Petlinsky called an Israeli flight logistics company named RS-LS Ltd. What role RS-LS played in the extraction is unclear, but Petlinsky’s communication with the company continued, phone traffic metadata shows. RS-LS Ltd is now a subcontractor of the U.S. Department of Defense.

Marsalek crossed from Belarus into Russia by car the day after his arrival, and his border crossing was organized by Lev Dengov, a Belarusian-Russian dual national who happened to serve as Putin’s special envoy to Libya.

On September 5, 2020, Evgeniya Kurochkina, an employee of Marsalek’s Russian mercenary outfit RSB Group and a woman with a professional history full of FSB links, accompanied the suspended Wirecard COO to the migration office in Moscow to receive his brand new passport. The name he was told he would use was that of Konstanin Baiazov, the Orthodox priest from Lipetsk. Kurochkina left her own phone number and email address as the contact information for “Baiazov.”

According to data connected with Kurochkina’s cell phone, on September 6 she rode in a minibus toward Crimea, the Ukrainian peninsula Russia illegally occupied not long after Marsalek and Zlobina’s first joint trip to Kyiv. Petlinsky and Marsalek flew to Crimea in parallel in a private jet. Marsalek would have had to use his new passport, issued in Baiazov’s name but bearing his own photograph, when boarding the flight.

By nightfall on September 8, Kurochkina’s phone logged in at Sevastopol, Crimea, the headquarters of Russia’s Black Sea Fleet. The following morning, she ordered taxis and toured hotels along the southern coast of the peninsula. Petlinsky, travel data shows, chartered a private jet from Simferopol, the provincial capital of Crimea, to Moscow on September 12 — only Petlinsky wasn’t on the plane. He couldn’t get on the chartered jet because he could not bring his gun on board, and he had to reschedule for a flight with a more understanding charter company the following morning.

Petlinsky told Der Spiegel that he was indeed in Crimea around that time but had nothing to do with Marsalek’s escape. He also said he had not communicated directly with Marsalek since the early days of his move to Russia.

This latter claim, however, is belied by new evidence The Insider has obtained — namely, the results of a blood test.

In January 2021, a mysterious man by the name of Alexandr Schmidt summoned a nurse from the Russian lab franchise Gemotest to a posh penthouse in a luxury Moscow high-rise. Schmidt asked to have his blood drawn and analyzed. The apartment in fact belonged to Petlinsky, who now goes by his new legal name, “Boris Grin.” “Alexandr Schmidt” does not exist. It is an alias used by Marsalek to travel on a forged French passport, intelligence officials from two European countries told The Insider. The passport number given by “Schmidt” to the nurse — a requirement under Russian law — belongs to Ekaterina Kulikova, a long-time aide and friend of Petlinsky’s.

Just a month later, on February 28, 2021, another mysterious figure had his blood taken at the same luxury apartment. This time, two of the tests were for HIV and syphilis. The subject went by the name of “Vitaly Malkin” and was approximately the same age as Jan Marsalek. The real Malkin, like the real Baiazov, is a small town priest — from the Russian town of Vladimir.

Just before the syphilis screening, Malkin reported that his passport had been stolen and arranged to receive a new one. It was the old, lost passport that “Vitaly Markin” used for the blood test. Marsalek used the passport a second time, a year later, in February 2022. A nurse visited him at the same posh apartment in Moscow owned by Petlinsky.

The real Vitaly Malkin told The Insider that he did not know Petlinsky and certainly had never tested himself for syphilis. The fake Malkin provided enough blood measurements to allow The Insider to compare certain metrics to those of “Alexandr Schmidt.” The probability that the two men are the same is overwhelming. It appears that Vitaliy Malkin is another man of the cloth whose identity Marsalek has usurped with the help of the Russian security services.

Zlobina would not comment for this story. Father Baiazov — the real one — cryptically said that he couldn’t answer any questions about why his passport now belonged to another man, one on Interpol’s most wanted list. “Why do you refuse to understand that [I cannot answer this question]?” he told Der Spiegel.

The Bulgarians

The competition for Marsalek’s most audacious plot is fierce, but he really might have saved the best for last.

Between August 30, 2020 and February 8, 2023, Marsalek, the U.K.’s Crown Prosecution Service found, “conspired... to obtain, collect, record, publish or communicate documents or information which was calculated to be, or might be intended to be, directly or indirectly useful to an enemy for a purpose prejudicial to the safety and interest of the state.” The defendants in this case are a ring of Bulgarian nationals, five of whom were arrested in London in February 2023 on allegations of espionage. Leaving aside the central casting aspects of some of their biographies — one is an amateur mixed-martial-arts fighter nicknamed “the Destroyer” — they certainly behaved like spies. MI5, Britain’s equivalent of the FBI, had been surveilling the Bulgarians’ activities for a while, gathering passport data, evidence of international travel, and 80,000 chat messages, which included tasks assigned to them by Marsalek via his preferred mode of communication, the Telegram messenger app.

His years working on the Atlas Mine pyramid scheme were evidently not wasted, as Marsalek was compensating his agent network in cryptocurrency, along with cash delivered via a courier. Also in the possession of these Bulgarians were forged documents used for their legend, or cover stories: press badges and apparel with Discovery Channel and National Geographic logos emblazoned on them. After years of spying on and intimidating journalists, Marsalek had decided to use pretend journalists as snoops in the U.K. One of them, the presumed ringleader of the network, was Orlin Roussev, a 46 year-old surveillance expert who had known Marsalek since Wirecard was flush. A sixth Marsalek agent, Tihomir Ivanov Ivanchev, 36, listed in London as an interior decorator, was arrested on February 28, 2024, just as this story was being finalized. He had spied on targets for the Russian government, under Marsalek’s direct instruction, in Montenegro and in Austria.

Around the time the spy ring was being rounded up in the U.K., Christo Grozev, the Bulgarian-born head of investigations at The Insider and Der Spiegel journalist, and one of the bylines on this story, was informed by the law enforcement while on a visit to New York City that he could not safely return home to Vienna, as his life was in danger. Marsalek, it turned out, had requested Grozev’s home address from Weiss, the former Austrian spy, in December 2020, the day after Bellingcat, The Insider and Der Spiegel had published their joint investigation into the poisoning of Russian opposition leader Alexei Navalny. Weiss had sent an encrypted message to Egisto Ott: “Could we make a query about a Mr. Christo Grozev in Austria?” it read, ominously adding that Grozev was working “against our case.” Grozev, at both Bellingcat and The Insider, has been the lead sleuth in unmasking GRU and FSB assassination plots, from the poisoning of the Skirpals in Salisbury with the military-grade nerve agent Novichok, to the poisoning of Alexei Navalny with a similar substance.

Ott told Der Spiegel that he had complied with this request from Weiss. “I only went to the registration office and paid 3.40 euros for the information about where [Grozev] lives.” Ott further stated that he took photographs of Grozev’s apartment in Vienna. Asked why Weiss — and behind him, Jan Marsalek and Stanislav Petlinsky — wanted the home address of a prominent investigative journalist, Ott replied that he gave it no thought. “I have always fought the Russian intelligence service in my career,” Ott told Der Spiegel matter-of-factly.

Grozev now resides permanently in New York.

– With additional reporting by Kato Kopaleishvili, Kate Manchester, Fidelius Schmid, and Roman Lehberger