Several major human pathogens, including the filoviruses, paramyxoviruses and rhabdoviruses, contain single-stranded, negative-sense, RNA genomes, packaged within helical nucleocapsids. The nucleocapsid buds through the plasma membrane of an infected cell to release enveloped virions. We have applied cryo-electron tomography and sub-tomogram averaging methods to derive structures of Marburg virus, a filovirus, post-release and in situ, during assembly within infected cells. The data provide a detailed description of filovirus structure. By resolving the 3D structure of the nucleocapsid before, during, and after membrane envelopment, we identify striking architectural homology between the nucleocapsids of rhabdoviruses and filoviruses, but fundamental differences in the mechanism by which these are assembled into virus particles and initiate virus budding. The study demonstrates the potential of cryo-electron tomography methods to derive structural information for intermediate steps in biological pathways in situ.