Leaked documents obtained by Delfi Estonia and shared with OCCRP and other media partners reveal the Russian presidential administration's role in directing false-flag vandalism attacks and influence campaigns across Europe and beyond. The files point to the Social Design Agency, a Russian PR firm already sanctioned by the United States, the United Kingdom, and the European Union for previous influence operations. Internal reports and chat screenshots show officials from the presidential administration overseeing the firm's work, with operations described internally as "cognitive strikes" against Western nations.

The documents originate from the Social Design Agency, which operates under the supervision of Sergei Kiriyenko, Deputy Chief of Staff of the Russian Presidential Administration. A key figure identified in the correspondence is Sofia Zakharova, an employee of the Presidential Administration who uses the pseudonym Sofia and is also referred to as Kristin Killer. The leaked chats show Zakharova held significant authority, demanding explanations from SDA head Ilya Gambashidze after a previous leak in 2024 and receiving security updates including plans to disconnect webcams and microphones on office laptops and switch to Russian-made VPN services.

One of the most detailed operations in the leak is the September 2025 attack on nine mosques and cultural centers in and around Paris, where bloody severed pig heads marked with the word "Macron" in blue ink were left outside their doors. A document titled "Report on Operation Pig's Head" includes photos of the prepared pig heads before distribution and details a group of six operatives arriving in Paris, conducting reconnaissance, delivering the heads, and leaving the country. Three men from Serbia were later convicted in their home country of carrying out the attack under the direction of Russian intelligence structures. The same group also targeted the Jewish community, pouring green paint on Paris' Holocaust Museum and several synagogues and leaving plastic skeletons at the Brandenburg Gate near Berlin's Holocaust memorial. A court concluded the goal was to incite religious and national intolerance between Jews and Muslims and destabilize the situation in both countries.

The leaked files describe other planned and executed operations across multiple countries. In France, hundreds of pro-Armenian stickers printed in Serbia appeared in Paris on Armenian Genocide Remembrance Day in 2025, with the stated aim of inciting conflict between France's Armenian and Azerbaijani communities. The same individuals who carried out the mosque operation had previously distributed forget-me-not leaflets near the Azerbaijani embassy in Paris while posing as members of an Armenian political party. Other French operations included a scheme to photograph expensive cars with Ukrainian license plates to create the impression that wealthy Ukrainians were living extravagantly in France. Among the operations that were planned but apparently not carried out were desecrating a statue of Charles de Gaulle with the words "Glory to Ukraine," with instructions that the perpetrators be misled into believing they were acting on behalf of a charity founded by Ukraine's first lady, and launching 30 inflatable sex dolls into the Seine River carrying an anti-migrant message.

In Germany, operations were particularly active during the 2025 parliamentary elections. Hundreds of cars had their exhaust pipes filled with expanding foam and were defaced with stickers reading "Be greener" in an apparent attempt to implicate the Green Party. Stickers featuring Green Party candidate Robert Habeck with the phrase "Be Greener" were placed on damaged cars in an attempt to discredit him. The documents describe a project to create more than 200,000 pages of pro-Russian content optimized for search engines and artificial intelligence. The agency also discusses coordination with Maximilian Krah, a member of the European Parliament from the Alternative for Germany party, and mentions plans for video debates involving Russian Foreign Ministry spokesperson Maria Zakharova and AfD co-chair Alice Weidel.

In Armenia, one of the most prominent operations involved a fabricated story claiming that Prime Minister Nikol Pashinyan had purchased a luxury mansion in Marseille, France. The story was published on a newly created French website and then amplified by Armenian media and social media, reaching approximately 10.6 million views. The debunking of the story reached only about 1.1 million views. The agency operates a Russian-language website called Yerevan1 (also referred to as erevan.one), which targets the Armenian community in Russia and the Armenian diaspora with content designed to generate negative sentiment toward the Armenian government and form a positive attitude toward candidates favoring close union with Russia. The outlet has published content including a negative horoscope describing Pashinyan as a symbol of Armenia's deep national crisis. Another project involves creating more than 50,000 fake Wikipedia-style websites optimized to influence artificial intelligence systems like ChatGPT to produce answers favorable to the Kremlin when asked about politicians.

In Ukraine, one of the most successful operations involved a fabricated story claiming that President Volodymyr Zelenskyy had purchased real estate in the Burj Khalifa tower in the UAE, which reportedly received 86 million views. The agency also created Telegram channels disguised as pro-Ukrainian outlets that subtly promoted the idea that Ukraine's defeat was inevitable, with goals including discrediting military leadership and demoralizing the armed forces.

In Moldova, the focus was on discrediting President Maia Sandu through campaigns targeting her foundation and using Romanian activist Sebastian Ghiță to promote claims of corruption. A website called SNG.TODAY, allegedly owned by the agency, listed Sandu as one of its primary targets.

The documents also reveal efforts to amplify pro-Russian messages through Western public figures. A senior presidential administration official using the pseudonym Sofia discussed securing statements from French and American retired military figures, including a French general who predicted in a TASS interview that the war in Ukraine would end under Russian conditions, and a retired U.S. Major General close to Donald Trump, identified as Paul Vallely, who predicted a quick change of power in Ukraine and was tasked with spreading the narrative that NATO is losing and Russia is winning. The documents do not confirm whether these individuals were aware they were part of a Russian state-linked campaign.

Plans for 2026 outlined in the files include an English-language website called the World Center for Strategic Studies featuring unattributed analyses, an AI-driven knowledge base for Germany containing over 200,000 pages, a database monitoring nearly 10,000 social media opinion leader accounts, a website called "Russian Wave" in French, German, and Russian, and an AI news project for France producing hundreds of videos across six social networks. A separate plan called "Mitteleuropa" proposes building close political and economic ties between Austria, Hungary, and Slovakia with the long-term goal of dismantling the Visegrad Group and replacing it with a "Vienna Agreement."

The documents reveal efforts to maintain secrecy and financial accountability within the agency. Employees used pseudonyms and took measures to prevent leaks. Cost estimates for operating research centers in Israel included 1.5 million rubles per month for running costs and an additional 3 million rubles for content distribution and paying influencers. An operation in Egypt was estimated at 5 million rubles per month.

Experts who reviewed the documents described a pattern of reckless escalation, noting that the operations aim to create conflicts between groups in Western societies by inflaming existing tensions around migration and religious issues. An analyst from Hybrid CoE in Helsinki warned that the long-term consequences of such operations may take years to become fully visible, by which point it could be too late to respond effectively.

The United Kingdom announced new sanctions against the SDA targeting 49 individuals, including writers, translators, and video makers responsible for Kremlin propaganda. In total, 50 people associated with the agency have been placed on the British sanctions list.

Original Sources: 1, 2, 3, 4, 5, 6, 7, 8 (paris) (serbia) (france) (germany) (armenia) (ukraine) (austria) (hungary) (slovakia) (tass) (sanctions) (reconnaissance) (operatives)

This article provides substantial factual reporting on Russian-linked influence operations across Europe, but its practical value to an ordinary reader is limited when examined carefully.

The article offers almost no actionable information. There are no steps a reader can take, no choices presented, and no tools or resources described that would allow someone to act on what they have learned. A reader who is not directly involved in investigating these operations, not working in law enforcement or intelligence, and not personally affected by the specific incidents described cannot use this information in any direct way. The article mentions organizations like OCCRP, Hybrid CoE, and various courts and sanctions bodies, but it does not provide contact details, guidance on reporting suspicious activity, or instructions for engaging with any of these institutions. There is nothing a reader can do or try based on what is presented here.

The educational depth is moderate. The article provides detailed descriptions of specific operations, the organizational structure behind them, and the stated goals of the campaigns. It explains the concept of false-flag operations, the use of front organizations, and the targeting of social divisions around migration and religious issues. It names specific individuals, firms, and government bodies involved, which adds concreteness. However, it does not explain how an ordinary person might recognize an influence operation in progress, how to evaluate whether a news story or social media campaign might be part of such an effort, or how the legal frameworks for sanctions and prosecution actually work. The article mentions that the SDA had been previously sanctioned but does not explain what those sanctions mean in practice or how they are enforced. The reader learns what happened and who was involved but not how to think about such operations in a broader context or how to detect similar efforts in the future.

Personal relevance varies significantly depending on who is reading. For people living in the countries mentioned, particularly those belonging to religious or ethnic communities that were directly targeted, the information has clear relevance to personal safety and community security. For journalists, researchers, or policymakers working on disinformation or national security, the article has direct professional relevance. For a general reader without a personal connection to the events described, the information is something to be aware of rather than something that affects daily decisions, safety, or finances. The article does attempt to broaden relevance by framing the operations as part of a larger pattern of escalation, but for many readers the connection to their own life remains indirect.

The public service function is weak. The article does not offer safety guidance, warnings, or practical information that a general reader can use. It does not tell readers how to report suspicious activity to authorities, how to protect themselves from being manipulated by influence campaigns, how to verify whether a news source or social media account might be part of a state-backed operation, or what steps a person can take if they encounter materials that appear designed to incite hatred. The closest it comes to service is the implicit message that such operations exist and that readers should be aware of them, but this is never translated into practical guidance.

There is no practical advice to evaluate. The article does not give steps for protecting oneself or one's community, for engaging with law enforcement or civil society organizations, for evaluating media critically, or for responding to incidents of hate or intimidation. No resources, tools, or contact information are mentioned that a reader could use.

The long term impact of reading this article is modest. It does provide awareness that state-backed influence operations targeting social divisions are an ongoing concern, which could help a person contextualize similar news in the future. However, the article does not help a person plan ahead, build better habits, or make stronger choices in any direct way. The information is tied to specific operations and does not offer lasting principles that apply broadly, except in the general sense that influence campaigns are a real phenomenon and that social divisions can be exploited deliberately.

The emotional impact is significant and concerning. The article describes disturbing acts of vandalism and intimidation, including severed pig heads placed at religious sites, desecration of Holocaust memorials, and plans designed to inflame hatred between communities. It describes a pattern of escalation and warns that the long-term consequences may take years to become fully visible. This content is unsettling and is not balanced with any constructive guidance or actionable information. The reader is left feeling alarmed and possibly helpless without any clear way to process those feelings or respond to them productively. The warning from the Hybrid CoE analyst that it could be too late to respond effectively adds to this sense of dread without offering any counterbalancing sense of agency.

The language shows some signs of dramatic framing. The phrase "cognitive strikes" is presented as an internal Russian term and carries a tone of novelty and menace that may amplify fear beyond what the facts alone warrant. The detailed description of the pig heads operation, including photos and the specific marking in blue ink, is vivid and disturbing in a way that serves to generate outrage but does not add practical value. The article does present court convictions and sanctions as factual outcomes, which provides some balance, but the overall framing leans toward emphasizing the scale and audacity of the operations.

The article misses several important chances to teach or guide. It could have explained how to recognize signs that a local incident might be part of a broader influence campaign, what steps a person can take if they encounter hate materials or suspicious activity in their community, and how to report such incidents to the appropriate authorities. It could have described how to evaluate whether a news source, social media account, or public figure might be part of a state-backed influence effort, including basic media literacy principles like checking multiple independent sources and looking for corroboration. It could have offered guidance on how to talk to others about influence campaigns without spreading fear or conspiracy thinking, or how to support community resilience against attempts to inflame social divisions. It could have explained what sanctions mean in practice and how ordinary citizens can engage with the political processes that lead to such measures. None of that appears here.

To add real value, a reader encountering this type of story should consider several general approaches. When you learn about influence operations or hate incidents in your area, remember that the goal of such campaigns is often to provoke strong emotional reactions and deepen divisions between groups. Recognizing this can help you respond more thoughtfully rather than being drawn into the conflict the operation is designed to create. If you encounter suspicious materials or activities in your community, such as unexplained vandalism, suspicious flyers, or social media campaigns that seem designed to inflame tensions, consider reporting them to local authorities or community organizations that track hate incidents. You do not need to investigate on your own, but documenting what you see and sharing it with trusted institutions can be helpful. When you want to evaluate whether a news story or public statement might be part of an influence campaign, look for independent corroboration from multiple sources, consider whether the story seems designed to provoke a specific emotional reaction, and ask yourself who benefits from the narrative being promoted. When you discuss these issues with others, focus on the facts you can verify and avoid amplifying unconfirmed claims, as spreading unverified information can itself be a tool of influence operations. If you belong to a community that has been targeted, consider connecting with local organizations that provide support, security guidance, and advocacy, as collective action is often more effective than individual responses. These habits help you think more carefully about influence campaigns and make more informed decisions about how to respond to such stories in your own life.

The text uses strong, negative words to make the Russian actions seem very bad. The exact words are "false-flag vandalism attacks and influence campaigns." These words make Russia look like a liar and a bully from the very start. This trick pushes the reader to feel angry at Russia before learning all the details. It helps the side that is against Russia by making everything Russia does seem evil.

The text uses the word "cognitive strikes" to make the Russian operations sound scary and new. The exact words are "operations described internally as 'cognitive strikes' against Western nations." This phrase makes the attacks seem like a special kind of war that is hard to fight. It makes Russia seem more powerful and clever than it might really be. This trick makes the reader feel more afraid of Russia.

The text uses very detailed, gross descriptions to make the reader feel sick and angry. The exact words are "bloody severed pig heads marked with the word 'Macron' in blue ink." These words paint a very clear and upsetting picture. They make the reader feel disgusted and push them to hate the people who did this. This trick helps the side that wants people to be angry at Russia.

The text uses passive voice to hide who exactly planned and ordered the attacks. The exact words are "A court concluded the goal was to incite religious and national intolerance." This sentence does not say who the court blamed for ordering the attack. It hides the chain of command and makes the crime seem less organized than the earlier parts of the text suggest. This trick makes it harder to know who is really responsible.

The text uses a broad claim about what the operations want to do without giving full proof. The exact words are "the operations aim to create conflicts between groups in Western societies by inflaming existing tensions." This phrase says Russia wants to cause big fights between people in the West. It does not show proof that this is the real goal and not just what some people think. This trick makes the reader believe Russia is more dangerous than the text can fully show.

The text uses a warning from an expert to make the reader feel scared about the future. The exact words are "the long-term consequences of such operations may take years to become fully visible, by which point it could be too late to respond." This phrase makes the reader feel that the danger is growing and that nobody can stop it. It pushes the reader to think that strong action is needed right now. This trick helps the side that wants more money and effort spent fighting Russia.

The text uses the word "reckless" to make the Russian actions seem careless and dangerous. The exact words are "Experts who reviewed the documents described a pattern of reckless escalation." This word makes Russia seem like it does not care about what happens next. It hides any reasons Russia might have and makes the reader think Russia is just causing trouble for no good reason. This trick makes Russia look more like a villain.

The text uses the word "apparently" to make it seem like some plans were not carried out, but does not prove it. The exact words are "Other planned but apparently unrealized operations include a scheme to desecrate a monument." This word makes the reader think the plan was stopped or never happened. But the text does not say why it was not done or if it was really stopped. This trick makes the reader feel a little safer without knowing the full truth.

The text uses the word "unattributed" to hide who wrote the analyses on the planned website. The exact words are "an English-language website called the World Center for Strategic Studies featuring unattributed analyses." This word makes it seem like the website will hide who is really writing the stories. It makes the reader think the website is trying to trick people. This trick helps the side that wants people to distrust Russian media.

The text uses the word "misled" to make the people carrying out the attacks seem like victims too. The exact words are "with instructions that the perpetrators be misled into believing they were acting on behalf of a charity." This word makes the reader think the people who did the attack did not know what they were really doing. It hides the fact that they still chose to take part. This trick makes the attackers seem less guilty than they might be.

The text expresses several meaningful emotions, both directly and through the way events are described. The most prominent is alarm, which runs throughout the entire piece. This alarm appears in the descriptions of disturbing acts such as bloody severed pig heads left at mosques, green paint poured on the Holocaust Museum, plastic skeletons placed at the Brandenburg Gate, and plans to throw sex dolls into the Seine River. These details are vivid and unsettling, designed to make the reader feel that something deeply wrong is happening and that the threat is serious and ongoing. The strength of this alarm is high because the text does not present these as isolated incidents but as part of a coordinated pattern directed from the highest levels of the Russian presidential administration. The purpose of this alarm is to make the reader take the threat seriously and to understand that these are not random acts of vandalism but deliberate operations with strategic goals.

A related emotion is outrage, which is strongest in the passages describing attacks on religious and cultural sites. The image of pig heads marked with a political leader's name and left at mosques is specifically chosen to provoke a strong reaction, as is the desecration of Holocaust memorials. These acts target communities that readers are likely to feel sympathy toward, and the text emphasizes the religious and cultural significance of the sites attacked. The outrage serves to build moral condemnation of the actors behind these operations and to frame the issue not just as a political or security matter but as an attack on shared values of tolerance and respect. The reader is guided to feel that the perpetrators have crossed a line that should not be crossed, which strengthens the case for taking action against them.

The text also conveys a sense of dread about the future, particularly through the warning from the Hybrid CoE analyst that the long-term consequences of these operations may take years to become fully visible and that by then it could be too late to respond. This emotion is quieter than alarm or outrage but serves an important purpose. It shifts the reader's focus from what has already happened to what might happen next, creating a sense of urgency. The dread is amplified by the description of planned operations for 2026, including AI-driven knowledge bases, social media monitoring, and new websites designed to spread pro-Russian messages. The reader is left with the impression that the threat is growing and that current responses may not be enough.

There is also an undercurrent of contempt directed at the methods described in the documents. Words like "false-flag," "misled," and "unattributed" carry emotional weight because they suggest deception and manipulation. The text describes how perpetrators were tricked into thinking they were working for a charity, how analyses would be published without attribution, and how operations were designed to implicate innocent groups like the Green Party or Ukrainian nationalists. This contempt serves to delegitimize the operations by showing them as dishonest and cowardly rather than as legitimate political action. The reader is guided to see the actors not as formidable adversaries but as sneaky and untrustworthy, which paradoxically both diminishes and amplifies the threat, they are dangerous precisely because they operate through lies.

A more subtle emotion is concern for vulnerable communities. The text mentions specific groups that were targeted, including Muslims, Jews, Armenians, Azerbaijanis, and migrants. By naming these communities and describing the attacks against them in detail, the text invites the reader to empathize with the people who were directly affected. This concern serves to humanize what might otherwise read as an abstract geopolitical story. It connects the reader emotionally to the real-world consequences of these operations and frames the issue as one that affects ordinary people, not just governments and institutions.

The writer uses several tools to increase the emotional impact of the text. One of the most effective is the use of specific, sensory details. Rather than saying that mosques were vandalized, the text describes bloody severed pig heads marked with a word in blue ink. Rather than saying that a museum was targeted, the text mentions green paint poured on the Holocaust Museum. These details make the events feel real and immediate, which is far more emotionally powerful than abstract descriptions. The reader can picture these scenes, and that mental image creates a stronger emotional response than a general statement would.

Another tool is the use of escalation. The text moves from individual attacks to broader campaigns, from executed operations to planned ones, and from current activities to future ambitions. Each step raises the stakes and increases the emotional intensity. The reader starts with a single disturbing incident and ends with a vision of AI-driven influence operations spanning multiple countries and social networks. This escalation serves to make the threat feel larger and more urgent than any single operation would on its own.

The text also uses authority to build trust and amplify emotion. By referencing court convictions, sanctions from multiple countries, and analysis from organizations like OCCRP and Hybrid CoE, the text signals that these claims are backed by evidence and expert judgment. This matters emotionally because it reassures the reader that the alarming content is not speculation or exaggeration. The emotional impact is stronger when the reader believes the facts are real, and the use of authoritative sources helps establish that credibility.

Repetition of certain ideas also plays a role. The text returns again and again to the themes of deception, escalation, and targeting of social divisions. Each new example reinforces the same emotional message, that these operations are deliberate, widespread, and designed to cause harm. This repetition builds a cumulative emotional effect, making the reader feel that the pattern is undeniable and that the threat is pervasive.

The text compares planned operations to executed ones, using words like "apparently unrealized" to describe schemes that may or may not have been carried out. This comparison creates a sense of uncertainty that adds to the dread. The reader does not know which planned operations might still happen, and that uncertainty is emotionally powerful because it leaves the imagination free to fill in the gaps. The possibility that some of these plans could still be executed makes the threat feel ongoing rather than contained.

Finally, the text uses the emotional weight of historical and cultural symbols to deepen its impact. The Holocaust Museum, the Brandenburg Gate, the Seine River, and the monument to Charles de Gaulle are not just locations, they carry deep meaning for the people who read about them. Attacking these sites is presented as an attack on shared memory, national identity, and cultural heritage. By choosing targets with such strong symbolic value, the text amplifies the emotional response and makes the operations feel like they are aimed not just at specific communities but at the foundations of Western society.

Together, these emotions and writing tools guide the reader toward a specific reaction. The reader is meant to feel alarmed by the scale of the threat, outraged by the methods used, concerned for the communities affected, and urgent about the need for a response. The text does not call for any specific action, but the emotional framing makes inaction feel irresponsible. The reader is left with the impression that these operations are serious, ongoing, and growing, and that understanding them is the first step toward doing something about them.