{ "id": "3cdee2c1-3449-49d2-9d70-f587e07cff47", "created_at": "2026-04-06T00:15:39.083415Z", "updated_at": "2026-04-10T03:25:23.341206Z", "deleted_at": null, "sha1_hash": "f3689f177e84f86339bbf081e256c5279fc9247a", "title": "‘World’s Most Wanted Man’ Involved in Bizarre Attempt to Buy Hacking Tools", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 828621, "plain_text": "‘World’s Most Wanted Man’ Involved in Bizarre Attempt to Buy\r\nHacking Tools\r\nBy Lorenzo Franceschi-Bicchierai\r\nPublished: 2020-07-21 · Archived: 2026-04-05 17:47:03 UTC\r\nThe fugitive executive of the embattled payment startup Wirecard was mentioned in a brazen and bizarre attempt\r\nto purchase hacking tools and surveillance technology from an Italian company in 2013, an investigation by\r\nMotherboard and the German weekly Der Spiegel found.\r\nJan Marsalek, a 40-year-old Austrian who until recently was the chief operating officer of the rising fintech\r\ncompany Wirecard, seems to have taken a meeting with the infamous Italian surveillance technology provider\r\nHacking Team in 2013. At the time, Marsalek is described as an official representative of the government of\r\nGrenada, a small Caribbean island of around 100,000 people, in a letter that bears the letterhead of the Grenada\r\ngovernment. The documents were included in a cache published after Hacking Team was hacked in 2015. In\r\nrecent days, Marsalek has been described as the ‘world’s most wanted man.’\r\nVideos by VICE\r\nIt is unclear from the documents alone whether Marsalek played any role in the attempt to procure hacking tools,\r\nor whether his name was simply used. However, months before Marsalek appears to have contacted with Hacking\r\nTeam, several websites with official sounding names such as StateOfGrenada.org were registered under the name\r\nof Jan Marsalek, as Der Spiegel reported last week. Some of the sites were registered with Marsalek’s phone\r\nnumber and his Munich address at the time, and the servers were apparently operated from Germany.\r\nWirecard provided digital payment services and was considered one of the most important companies in the\r\nfinancial tech industry. Wirecard offered a mobile payment app called Boon, which was essentially a virtual\r\nMasterCard card, it also offered a prepaid debit card called mycard2go, and worked with companies such as KLM,\r\nRakuten, and Qatar Airways to manage their online transactions. The company suddenly collapsed in June after\r\nGerman regulators raided its headquarters as part of an investigation into fraudulent stock price manipulation and\r\n1.9 billion euros that are missing from the company’s books. Marsalek is now a fugitive and a key suspect in the\r\nGerman investigation. He reportedly fled to Belarus, and is now hiding in Russia under the protection of the FSB,\r\naccording to German news reports. In the past, he was involved in other strange dealings: he bragged about an\r\nattempt to recruit 15,000 Libyan militiamen, and about a trip to Syria along with Russian military, according to the\r\nFinancial Times.\r\n“Further to your discussion with our representative, Mr. Jan Marsalek, we would like to hereby confirm the\r\ninterest of the Government of Grenada in exploring a potential acquisition of the smartphone interception platform\r\nof your company,” reads what appears to be an official Grenada government letter dated October 31, 2013\r\nallegedly signed by the Minister for Foreign Affairs Nickolas Steele.\r\nhttps://www.vice.com/en_us/article/jgxvdx/jan-marsalek-wirecard-bizarre-attempt-to-buy-hacking-team-spyware\r\nPage 1 of 3\n\nA letter that was attached to emails between a Mexican intermediary and Hacking Team.\r\nAlong with a Mexican intermediary, Marsalek appears to have brokered a meeting in Milan at Hacking Team’s\r\nheadquarters on November 27, 2013, according to the leaked emails. An email dated November 28 mentions a\r\n“fruitful meeting” with Marsalek and an associate “regarding Grenada.”\r\n“Mr. Marsalek will report his impressions to the Grenada officers, if positive, the process will take around three\r\nweeks. Please keep us updated,” wrote Marco Bettini, one of Hacking Team’s founders and the then sales\r\nhttps://www.vice.com/en_us/article/jgxvdx/jan-marsalek-wirecard-bizarre-attempt-to-buy-hacking-team-spyware\r\nPage 2 of 3\n\nmanager.\r\nA former Hacking Team employee, who asked to remain anonymous, confirmed receiving the emails regarding\r\nthe meeting. He said, however, that he was not present at the meeting.\r\nAs it turns out, Marsalek was never a Grenada government representative, Der Spiegel and Motherboard have\r\nfound.\r\nIn a phone call, Steele, who is now the Minister Health in Grenada said the document leaked in the Hacking Team\r\nemails is fraudulent.\r\n“I can categorically state that the letter in your attachment bearing a resemblance to my signature and office at that\r\ntime is a fraudulent document,” Steele said in the phone call, referring to the apparent business deal between\r\nGrenada and Hacking Team. “I certainly did not make that request or any such request.”\r\nDo you work or used to work at Hacking Team or another surveillance vendor? We’d love to hear from you.\r\nUsing a non-work phone or computer, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1\r\n917 257 1382, OTR chat at lorenzofb@jabber.ccc.de, or email lorenzo@motherboard.tv.\r\nSteele confirmed to Spiegel and Motherboard that he had met Marsalek and another person whose name is\r\nmentioned in the document in the summer 2013. “He was a very charismatic young man and a smooth talker,”\r\nSteele remembers. The meetings were about a business proposal from Marsalek involving Wirecard technology. In\r\nthe end, however, no deal was made, Steele said.\r\nThe head of Encryptech, a Mexican company that is mentioned in the letter, and which worked as an intermediary\r\nbetween Hacking Team and some government customers, called the letter “fake.”\r\n“They used the name of my company without authorization,” Alfonso Ayensa said in an online chat.\r\nThe spyware deal, however, never went through. It is impossible to say from the documents alone who was\r\nattempting to procure these hacking tools, what they were going to be used for, or how involved Marsalek was.\r\nHacking Team has always maintained that it only sold its products to government agencies, after obtaining an\r\nexport license from the Italian government. Had this deal gone through, it would have been the first known case\r\nwhere Hacking Team’s powerful spyware ended up in the hands of private citizens.\r\nPaolo Lezzi, the head of Memento Labs, the company that was born out of Hacking Team’s ashes, said Grenada\r\nwas never a customer, based on the company’s internal documents he has access to. Two other former Hacking\r\nTeam employees who worked there in 2013 and onwards, said Grenada never purchased the company’s products.\r\nSubscribe to our new cybersecurity podcast, CYBER .\r\nSource: https://www.vice.com/en_us/article/jgxvdx/jan-marsalek-wirecard-bizarre-attempt-to-buy-hacking-team-spyware\r\nhttps://www.vice.com/en_us/article/jgxvdx/jan-marsalek-wirecard-bizarre-attempt-to-buy-hacking-team-spyware\r\nPage 3 of 3", "extraction_quality": 1, "language": "EN", "sources": [ "Malpedia" ], "references": [ "https://www.vice.com/en_us/article/jgxvdx/jan-marsalek-wirecard-bizarre-attempt-to-buy-hacking-team-spyware" ], "report_names": [ "jan-marsalek-wirecard-bizarre-attempt-to-buy-hacking-team-spyware" ], "threat_actors": [ { "id": "a3687241-9876-477b-aa13-a7c368ffda58", "created_at": "2022-10-25T16:07:24.496902Z", "updated_at": "2026-04-10T02:00:05.010744Z", "deleted_at": null, "main_name": "Hacking Team", "aliases": [], "source_name": "ETDA:Hacking Team", "tools": [], "source_id": "ETDA", "reports": null }, { "id": "e90c06e4-e3e0-4f46-a3b5-17b84b31da62", "created_at": "2023-01-06T13:46:39.018236Z", "updated_at": "2026-04-10T02:00:03.183123Z", "deleted_at": null, "main_name": "Hacking Team", "aliases": [], "source_name": "MISPGALAXY:Hacking Team", "tools": [], "source_id": "MISPGALAXY", "reports": null } ], "ts_created_at": 1775434539, "ts_updated_at": 1775791523, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/f3689f177e84f86339bbf081e256c5279fc9247a.pdf", "text": "https://archive.orkl.eu/f3689f177e84f86339bbf081e256c5279fc9247a.txt", "img": "https://archive.orkl.eu/f3689f177e84f86339bbf081e256c5279fc9247a.jpg" } }