Jan Marsalek, Europe’s most-wanted fugitive and alleged Russian spy, secretly invested millions in Libyan cement factories and oil-related assets linked to Russian-backed warlord Haftar; disputes over these holdings have sparked legal battles and possible espionage-related hacking in London.

Intelligence & EspionageHuman Intelligence (HUMINT)Recruitment of locals

Aggressor

Summary

A secret financial and corporate arrangement was uncovered involving Jan Marsalek, Europe’s most-wanted financial criminal and alleged Russian spy, who covertly invested millions in Libyan strategic assets including three cement factories and the drilling rig operator Lorasco. Marsalek's investments were channeled through offshore shell companies to mask his involvement, with links to influential figures in Libya, including Ahmed Ben Halim (founder of Libya Holdings Group) and businessman Joe Bowman. The cement factories were sold in 2022 to a Libyan-Emirati businessman connected to General Khalifa Haftar, a Russian-backed warlord. Marsalek used these financial channels to blend personal gain with Russian geopolitical interests, including ties to Russian mercenary groups for securing assets and efforts to influence Libyan politics. Despite Marsalek's current confinement to Russia under state protection, disputes over his Libyan holdings have escalated into legal battles among former associates in London. Recent leaks and investigations suggest Marsalek may be actively attempting to regain control or punish former partners by hacking operations, illustrating ongoing covert influence efforts connected to Russian espionage in North Africa. The complexity of the network, the involvement of multiple jurisdictions (UK, Libya, Cyprus, Dubai), and connections to convicted spies deepen concerns about Russian financial penetration and influence in Libya as a geopolitical lever against Europe.

Classification

Confidence: High

This event involves covert financial and espionage activities by Jan Marsalek, an alleged Russian spy, to build influence in Libya—an active aggressor hybrid warfare tactic. There is no indication of allied defense preparations in the source.

Source URL

https://archive.is/Gq5se

Open source

Provenance

Publisher: hwt_web_submit
Submitted: Feb 14, 2026, 12:22 UTC
Last updated: Nov 4, 2026, 08:35 UTC
Event time: Jan 1, 2022, 00:00 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "8b6dda66-fda0-475a-80fb-33584d6aa28c",
  "url": "https://archive.is/Gq5se",
  "source": "hwt_web_submit",
  "status": "approved",
  "category": "Intelligence & Espionage",
  "subcategory": "Human Intelligence (HUMINT)",
  "incident_type": "Recruitment of locals",
  "country": "United Kingdom",
  "source_reliability": "B",
  "info_credibility": "3",
  "tags": [
    "Jan Marsalek",
    "russian intelligence operations",
    "Libya investments",
    "Libya Holdings Group",
    "Wirecard fraud",
    "General Khalifa Haftar",
    "Human intelligence",
    "Espionage finance",
    "Legal dispute",
    "Offshore shell companies",
    "Russian mercenaries",
    "London",
    "Geopolitical influence"
  ],
  "nodes": [
    "Node 2: 5th Column"
  ],
  "countries": [],
  "where_text": "Land",
  "headline": null,
  "description": "A secret financial and corporate arrangement was uncovered involving Jan Marsalek, Europe’s most-wanted financial criminal and alleged Russian spy, who covertly invested millions in Libyan strategic assets including three cement factories and the drilling rig operator Lorasco. Marsalek's investments were channeled through offshore shell companies to mask his involvement, with links to influential figures in Libya, including Ahmed Ben Halim (founder of Libya Holdings Group) and businessman Joe Bowman. The cement factories were sold in 2022 to a Libyan-Emirati businessman connected to General Khalifa Haftar, a Russian-backed warlord. Marsalek used these financial channels to blend personal gain with Russian geopolitical interests, including ties to Russian mercenary groups for securing assets and efforts to influence Libyan politics. Despite Marsalek's current confinement to Russia under state protection, disputes over his Libyan holdings have escalated into legal battles among former associates in London. Recent leaks and investigations suggest Marsalek may be actively attempting to regain control or punish former partners by hacking operations, illustrating ongoing covert influence efforts connected to Russian espionage in North Africa. The complexity of the network, the involvement of multiple jurisdictions (UK, Libya, Cyprus, Dubai), and connections to convicted spies deepen concerns about Russian financial penetration and influence in Libya as a geopolitical lever against Europe.",
  "summary_short": "Jan Marsalek, Europe’s most-wanted fugitive and alleged Russian spy, secretly invested millions in Libyan cement factories and oil-related assets linked to Russian-backed warlord Haftar; disputes over these holdings have sparked legal battles and possible espionage-related hacking in London.",
  "summary_extended": null,
  "actor_primary": "Jan Marsalek",
  "target_primary": null,
  "location_text": "London Mayfair",
  "location_region": "Greater London",
  "location_coordinates_lat": 51.5128,
  "location_coordinates_lon": -0.1391,
  "location_precision": "Approximate",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "This event involves covert financial and espionage activities by Jan Marsalek, an alleged Russian spy, to build influence in Libya—an active aggressor hybrid warfare tactic. There is no indication of allied defense preparations in the source.",
  "event_time_utc": "2022-01-01T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "pm24h",
  "created_at": "2026-02-14T12:22:52.605Z",
  "updated_at": "2026-11-04T08:35:32.139Z",
  "reliability_band": "strong",
  "location_precision_band": "approximate",
  "time_precision_band": "within_24h",
  "severity_band": "moderate",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}

Public assessmentReliability: StrongSeverity: ModerateAttribution: HighSingle sourceTime: Same dayLocation: Approximate

Source reliability

Info credibility

Event time

Jan 1, 2022, 00:00 UTC

Event time confidence

pm24h

Location

London Mayfair

Region

Greater London

Primary actor

Jan Marsalek

Country

United Kingdom

Tags

Jan Marsalek, russian intelligence operations, Libya investments, Libya Holdings Group, Wirecard fraud, General Khalifa Haftar, Human intelligence, Espionage finance, Legal dispute, Offshore shell companies, Russian mercenaries, London, Geopolitical influence

Nodes

Node 2: 5th Column

Loading signal...

{ "id": "8b6dda66-fda0-475a-80fb-33584d6aa28c", "url": "https://archive.is/Gq5se", "source": "hwt_web_submit", "status": "approved", "category": "Intelligence & Espionage", "subcategory": "Human Intelligence (HUMINT)", "incident_type": "Recruitment of locals", "country": "United Kingdom", "source_reliability": "B", "info_credibility": "3", "tags": [ "Jan Marsalek", "russian intelligence operations", "Libya investments", "Libya Holdings Group", "Wirecard fraud", "General Khalifa Haftar", "Human intelligence", "Espionage finance", "Legal dispute", "Offshore shell companies", "Russian mercenaries", "London", "Geopolitical influence" ], "nodes": [ "Node 2: 5th Column" ], "countries": [], "where_text": "Land", "headline": null, "description": "A secret financial and corporate arrangement was uncovered involving Jan Marsalek, Europe’s most-wanted financial criminal and alleged Russian spy, who covertly invested millions in Libyan strategic assets including three cement factories and the drilling rig operator Lorasco. Marsalek's investments were channeled through offshore shell companies to mask his involvement, with links to influential figures in Libya, including Ahmed Ben Halim (founder of Libya Holdings Group) and businessman Joe Bowman. The cement factories were sold in 2022 to a Libyan-Emirati businessman connected to General Khalifa Haftar, a Russian-backed warlord. Marsalek used these financial channels to blend personal gain with Russian geopolitical interests, including ties to Russian mercenary groups for securing assets and efforts to influence Libyan politics. Despite Marsalek's current confinement to Russia under state protection, disputes over his Libyan holdings have escalated into legal battles among former associates in London. Recent leaks and investigations suggest Marsalek may be actively attempting to regain control or punish former partners by hacking operations, illustrating ongoing covert influence efforts connected to Russian espionage in North Africa. The complexity of the network, the involvement of multiple jurisdictions (UK, Libya, Cyprus, Dubai), and connections to convicted spies deepen concerns about Russian financial penetration and influence in Libya as a geopolitical lever against Europe.", "summary_short": "Jan Marsalek, Europe’s most-wanted fugitive and alleged Russian spy, secretly invested millions in Libyan cement factories and oil-related assets linked to Russian-backed warlord Haftar; disputes over these holdings have sparked legal battles and possible espionage-related hacking in London.", "summary_extended": null, "actor_primary": "Jan Marsalek", "target_primary": null, "location_text": "London Mayfair", "location_region": "Greater London", "location_coordinates_lat": 51.5128, "location_coordinates_lon": -0.1391, "location_precision": "Approximate", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "This event involves covert financial and espionage activities by Jan Marsalek, an alleged Russian spy, to build influence in Libya—an active aggressor hybrid warfare tactic. There is no indication of allied defense preparations in the source.", "event_time_utc": "2022-01-01T00:00:00.000Z", "end_time_utc": null, "event_time_confidence": "pm24h", "created_at": "2026-02-14T12:22:52.605Z", "updated_at": "2026-11-04T08:35:32.139Z", "reliability_band": "strong", "location_precision_band": "approximate", "time_precision_band": "within_24h", "severity_band": "moderate", "attribution_confidence_band": "high", "attribution_basis": "single_source" }