The conviction of three Bulgarian nationals in London has shed new light on the murky intersection between financial fraud and Russian espionage. A jury at the Old Bailey found the three guilty of spying for Russia, operating as part of a sophisticated intelligence network allegedly orchestrated by Wirecard’s fugitive COO, Jan Marsalek. Investigators revealed that Marsalek, who fled Germany in 2020 following the collapse of Wirecard, directed espionage operations across Europe.
Overview of the Conviction
On the afternoon of Friday, March 7, 2025, a London jury at the Central Criminal Court (Old Bailey) convicted three Bulgarian nationals—Katrin Ivanova (33), Vanya Gaberova (30), and Tihomir Ivanchev (39)—of spying for Russia. The verdict concluded a three-month trial that began in November 2024, following an extensive investigation by British counterterrorism police. The trio was found guilty of conspiring to gather information useful to an enemy state between August 2020 and February 2023, aligning with the prosecution’s accusations of their involvement in a sophisticated Russian espionage network. The three defendants face up to 14 years in prison, with sentencing scheduled for May 2025.
The court’s decision came after more than 32 hours of jury deliberation, affirming the prosecution’s case that the group operated as part of a six-member spy ring directed by Orlin Roussev (47), a Bulgarian IT specialist based in Great Yarmouth, UK. Roussev, along with two other accomplices—Bizer Dzhambazov (43) and Ivan Stoyanov (33)—had previously pleaded guilty to espionage charges in 2024, prior to the trial of Ivanova, Gaberova, and Ivanchev. According to British investigators, the mastermind behind this network was Jan Marsalek, the fugitive former Chief Operating Officer (COO) of the German fintech company Wirecard, who is widely believed to be a Russian spy operative now residing in Russia.
Details of the Espionage Operation
The prosecution outlined how the Bulgarian spy ring conducted six major surveillance operations across Europe—spanning the UK, Austria, Spain, Germany, and Montenegro—targeting individuals and locations of interest to the Kremlin. These targets included investigative journalists, Russian dissidents, and a US military base in Germany (Patch Barracks near Stuttgart), where Ukrainian forces were reportedly training during Russia’s invasion of Ukraine.
Among the high-profile targets was Christo Grozev, a Bulgarian journalist with Bellingcat, known for exposing Russian intelligence operations, including the 2018 Salisbury poisoning. Evidence presented in court revealed that Roussev and the former Wirecard COO Jan Marsalek exchanged over 70,000 Telegram messages between 2020 and 2024, discussing plans to surveil, rob, kidnap, or even kill Grozev.
The group employed advanced technology, including drones, hidden cameras (disguised in objects like rocks and ties), Wi-Fi eavesdropping devices, and a military-grade mobile phone interception tool valued at £120,000. Police raids on Roussev’s former guesthouse in Great Yarmouth uncovered a trove of espionage equipment, including 221 mobile phones, 495 SIM cards, 11 drones, and 75 fake passports from multiple countries. The operation was well-funded, with Marsalek reportedly transferring at least £204,000 (approximately €200,000) to Roussev to finance their activities. Commander Dominic Murphy of London’s Counter Terrorism Command described the case as one of the most significant espionage investigations in the UK in decades, labeling it “industrial-scale espionage on behalf of Russia.”
Context: Wirecard and Jan Marsalek
Jan Marsalek’s involvement ties this espionage case to the spectacular collapse of Wirecard, a German payment processing company once valued at €24 billion. Marsalek served as Wirecard’s COO from 2010 until June 2020, when the company admitted that €1.9 billion in cash it claimed to hold did not exist, triggering its insolvency. Marsalek fled Germany shortly after his dismissal, reportedly traveling to Belarus and then Russia, where he is believed to reside under the protection of Russian intelligence services, possibly the GRU or FSB. Interpol issued a Red Notice for his arrest in August 2020, linked to his role in the Wirecard fraud scandal, but his current whereabouts remain unknown.
Investigations by Bellingcat, Der Spiegel, and The Insider have suggested that Marsalek had ties to Russian intelligence since at least 2010, potentially recruited via a “honey trap” operation involving his partner, Natalia Zlobina, who introduced him to GRU handler Stanislav Petlinsky. During his tenure at Wirecard, Marsalek allegedly used the company’s resources to support Russian military and influence operations, including Wagner Group activities in the Middle East. His role in the Bulgarian spy ring further solidifies suspicions that Wirecard served as more than just a financial enterprise—it may have been a front for Russian espionage.
Austrian Investigations
Parallel to the UK case, Austrian authorities are investigating former secret service agents in connection with Marsalek and Russian espionage activities. In 2024, reports emerged that Egisto Ott, a former Austrian intelligence officer, received €20,000 from Marsalek for a SINA laptop, a secure device used by government agencies. These probes suggest that Marsalek cultivated a network of contacts within Austria’s security apparatus, potentially compromising national security. Austrian media and German outlets like Die Welt have reported that Marsalek’s activities extended beyond financial fraud, aligning with a broader pattern of Russian intelligence outsourcing operations to proxies across Europe.
Hypothesis: Wirecard and Marsalek’s Deep Involvement in Russian Espionage
The evidence from the London trial and related investigations supports the hypothesis that Wirecard and Jan Marsalek were deeply enmeshed in Russian espionage activities. Marsalek’s ability to direct a sophisticated spy ring from abroad, his access to significant funds (potentially siphoned from Wirecard), and his reported residence in Russia under intelligence supervision indicate a strategic role beyond mere financial misconduct.
The use of Wirecard’s infrastructure to facilitate payments and operations for Russian interests—coupled with Marsalek’s decade-long relationship with Russian handlers—suggests that the company may have been exploited as a cover for covert activities. This hypothesis is bolstered by the targeting of high-value Kremlin adversaries and military sites, operations that align with Russian state priorities rather than personal gain.
Individuals Involved:
| Name | Role in the Case |
|---|---|
| Katrin Ivanova | Convicted Bulgarian spy, part of Russian espionage ring |
| Vanya Gaberova | Convicted Bulgarian spy, part of Russian espionage ring |
| Tihomir Ivanchev | Convicted Bulgarian spy, part of Russian espionage ring |
| Orlin Roussev | Alleged mastermind of the Bulgarian spy ring, IT specialist |
| Bizer Dzhambazov | Pleaded guilty to espionage in 2024, part of the spy ring |
| Ivan Stoyanov | Pleaded guilty to espionage in 2024, part of the spy ring |
| Jan Marsalek | Former Wirecard COO, alleged Russian spy and orchestrator of the espionage ring |
| Christo Grozev | Investigative journalist targeted by the spy network |
| Egisto Ott | Former Austrian intelligence officer investigated for ties to Marsalek |
| Natalia Zlobina | Alleged recruiter of Marsalek for Russian intelligence |
| Stanislav Petlinsky | Alleged GRU handler of Jan Marsalek |
Conclusion
The conviction of Ivanova, Gaberova, and Ivanchev marks a significant victory for British counterterrorism efforts in dismantling a Russian proxy network operating on UK soil. The case underscores the evolving nature of espionage, with state actors like Russia outsourcing operations to foreign nationals directed by intermediaries like Jan Marsalek. As sentencing approaches in May 2025, attention will likely shift to Austria’s ongoing investigations and the broader implications of Wirecard’s collapse—not just as a financial scandal, but as a potential node in Russia’s global intelligence apparatus.
The full extent of Marsalek’s activities, and Wirecard’s role, may yet unravel as international probes continue.
