Ex-Wirecard manager Jan Marsalek found in Moscow working for Russian intelligence, revealed by investigative journalists after over a year of tracking.

Intelligence & EspionageHuman Intelligence (HUMINT)Recruitment of locals

Aggressor

Summary

Investigative journalists from Spiegel, ZDF, Austrian Standard, PBS, and The Insider tracked fugitive ex-Wirecard manager Jan Marsalek in Moscow for over a year and revealed he is working for the Russian foreign intelligence service. His phone was detected 304 times near the FSB headquarters in Moscow between January and November 2024. Marsalek reportedly uses multiple aliases including a Russian passport under the name Alexander Michajlowitsch Nelidov and has traveled to the conflict zones in eastern Ukraine including Mariupol. The investigation highlighted failures by German authorities to actively pursue his arrest, despite the high-profile Wirecard scandal and international search. Journalists also noted the role of women close to Marsalek in revealing his whereabouts and the use of artificial intelligence to analyze social media data and metadata from Russian data brokers. Investigative journalist Christo Grozev reported personal threats and a need to leave Austria for safety.

Classification

Confidence: High

The article clearly describes hostile hybrid warfare activity involving a high-profile fugitive working for Russian intelligence services inside Moscow, confirmed by multiple journalist investigations and phone metadata. German officials are accused of failing to act, confirming aggressor activity.

Source URL

https://tagesschau.de/ausland/marsalek-gefunden-moskau-recherche-100.html

Open source

Provenance

Publisher: extension
Submitted: Apr 28, 2026, 12:49 UTC
Last updated: Nov 4, 2026, 08:35 UTC
Event time: Jan 1, 2024, 00:00 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "6414dcc5-9568-446b-94ac-3b7f744d9dbe",
  "url": "https://tagesschau.de/ausland/marsalek-gefunden-moskau-recherche-100.html",
  "source": "extension",
  "status": "approved",
  "category": "Intelligence & Espionage",
  "subcategory": "Human Intelligence (HUMINT)",
  "incident_type": "Recruitment of locals",
  "country": "Russian Federation",
  "source_reliability": "C",
  "info_credibility": "3",
  "tags": [
    "Jan Marsalek",
    "Wirecard scandal",
    "russian intelligence operations",
    "FSB",
    "espionage",
    "investigative journalism",
    "Moscow",
    "russia–ukraine war",
    "artificial intelligence",
    "German authorities failures"
  ],
  "nodes": [
    "Node 2: 5th Column"
  ],
  "countries": [],
  "where_text": "Land",
  "headline": null,
  "description": "Jan Marsalek, former Wirecard board member implicated in major financial scandal, was found in Moscow by an international team of journalists who tracked him for more than a year. Evidence shows he works for the Russian intelligence services (FSB), including multiple sightings near the FSB Lubjanka headquarters in Moscow, phone metadata confirming 304 detections from January to November 2024, and usage of multiple cover identities including a Russian passport under the name Alexander Michajlowitsch Nelidov. Data analysis showed Marsalek traveled to Eastern Ukraine conflict zones, including Russian-occupied Mariupol. Investigative reporter Christo Grozev criticized German authorities for inadequate pursuit and revealed threats to Grozev’s personal safety from Russia-related actors. The journalists also used AI and social media data fragments to confirm Marsalek's location and affiliations. Marsalek has been internationally wanted since Wirecard's insolvency in 2020 and is under investigation in Munich for organized fraud and other economic crimes.",
  "summary_short": "Ex-Wirecard manager Jan Marsalek found in Moscow working for Russian intelligence, revealed by investigative journalists after over a year of tracking.",
  "summary_extended": "Investigative journalists from Spiegel, ZDF, Austrian Standard, PBS, and The Insider tracked fugitive ex-Wirecard manager Jan Marsalek in Moscow for over a year and revealed he is working for the Russian foreign intelligence service. His phone was detected 304 times near the FSB headquarters in Moscow between January and November 2024. Marsalek reportedly uses multiple aliases including a Russian passport under the name Alexander Michajlowitsch Nelidov and has traveled to the conflict zones in eastern Ukraine including Mariupol. The investigation highlighted failures by German authorities to actively pursue his arrest, despite the high-profile Wirecard scandal and international search. Journalists also noted the role of women close to Marsalek in revealing his whereabouts and the use of artificial intelligence to analyze social media data and metadata from Russian data brokers. Investigative journalist Christo Grozev reported personal threats and a need to leave Austria for safety.",
  "actor_primary": "Jan Marsalek",
  "target_primary": null,
  "location_text": "Moscow, near FSB Lubjanka headquarters",
  "location_region": "Moscow",
  "location_coordinates_lat": 55.7558,
  "location_coordinates_lon": 37.6173,
  "location_precision": "Approximate",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The article clearly describes hostile hybrid warfare activity involving a high-profile fugitive working for Russian intelligence services inside Moscow, confirmed by multiple journalist investigations and phone metadata. German officials are accused of failing to act, confirming aggressor activity.",
  "event_time_utc": "2024-01-01T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "pm24h",
  "created_at": "2026-04-28T12:49:00.247Z",
  "updated_at": "2026-11-04T08:35:32.139Z",
  "reliability_band": "strong",
  "location_precision_band": "approximate",
  "time_precision_band": "within_24h",
  "severity_band": "significant",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}

Public assessmentReliability: StrongSeverity: SignificantAttribution: HighSingle sourceTime: Same dayLocation: Approximate

Source reliability

Info credibility

Event time

Jan 1, 2024, 00:00 UTC

Event time confidence

pm24h

Location

Moscow, near FSB Lubjanka headquarters

Region

Moscow

Primary actor

Jan Marsalek

Country

Russian Federation

Tags

Jan Marsalek, Wirecard scandal, russian intelligence operations, FSB, espionage, investigative journalism, Moscow, russia–ukraine war, artificial intelligence, German authorities failures

Nodes

Node 2: 5th Column

Loading signal...

{ "id": "6414dcc5-9568-446b-94ac-3b7f744d9dbe", "url": "https://tagesschau.de/ausland/marsalek-gefunden-moskau-recherche-100.html", "source": "extension", "status": "approved", "category": "Intelligence & Espionage", "subcategory": "Human Intelligence (HUMINT)", "incident_type": "Recruitment of locals", "country": "Russian Federation", "source_reliability": "C", "info_credibility": "3", "tags": [ "Jan Marsalek", "Wirecard scandal", "russian intelligence operations", "FSB", "espionage", "investigative journalism", "Moscow", "russia–ukraine war", "artificial intelligence", "German authorities failures" ], "nodes": [ "Node 2: 5th Column" ], "countries": [], "where_text": "Land", "headline": null, "description": "Jan Marsalek, former Wirecard board member implicated in major financial scandal, was found in Moscow by an international team of journalists who tracked him for more than a year. Evidence shows he works for the Russian intelligence services (FSB), including multiple sightings near the FSB Lubjanka headquarters in Moscow, phone metadata confirming 304 detections from January to November 2024, and usage of multiple cover identities including a Russian passport under the name Alexander Michajlowitsch Nelidov. Data analysis showed Marsalek traveled to Eastern Ukraine conflict zones, including Russian-occupied Mariupol. Investigative reporter Christo Grozev criticized German authorities for inadequate pursuit and revealed threats to Grozev’s personal safety from Russia-related actors. The journalists also used AI and social media data fragments to confirm Marsalek's location and affiliations. Marsalek has been internationally wanted since Wirecard's insolvency in 2020 and is under investigation in Munich for organized fraud and other economic crimes.", "summary_short": "Ex-Wirecard manager Jan Marsalek found in Moscow working for Russian intelligence, revealed by investigative journalists after over a year of tracking.", "summary_extended": "Investigative journalists from Spiegel, ZDF, Austrian Standard, PBS, and The Insider tracked fugitive ex-Wirecard manager Jan Marsalek in Moscow for over a year and revealed he is working for the Russian foreign intelligence service. His phone was detected 304 times near the FSB headquarters in Moscow between January and November 2024. Marsalek reportedly uses multiple aliases including a Russian passport under the name Alexander Michajlowitsch Nelidov and has traveled to the conflict zones in eastern Ukraine including Mariupol. The investigation highlighted failures by German authorities to actively pursue his arrest, despite the high-profile Wirecard scandal and international search. Journalists also noted the role of women close to Marsalek in revealing his whereabouts and the use of artificial intelligence to analyze social media data and metadata from Russian data brokers. Investigative journalist Christo Grozev reported personal threats and a need to leave Austria for safety.", "actor_primary": "Jan Marsalek", "target_primary": null, "location_text": "Moscow, near FSB Lubjanka headquarters", "location_region": "Moscow", "location_coordinates_lat": 55.7558, "location_coordinates_lon": 37.6173, "location_precision": "Approximate", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The article clearly describes hostile hybrid warfare activity involving a high-profile fugitive working for Russian intelligence services inside Moscow, confirmed by multiple journalist investigations and phone metadata. German officials are accused of failing to act, confirming aggressor activity.", "event_time_utc": "2024-01-01T00:00:00.000Z", "end_time_utc": null, "event_time_confidence": "pm24h", "created_at": "2026-04-28T12:49:00.247Z", "updated_at": "2026-11-04T08:35:32.139Z", "reliability_band": "strong", "location_precision_band": "approximate", "time_precision_band": "within_24h", "severity_band": "significant", "attribution_confidence_band": "high", "attribution_basis": "single_source" }