In September 2025, severed pig heads bearing the name of French President Emmanuel Macron appeared outside nine mosques and Islamic centers in and around Paris.
Serbian authorities arrested 11 suspects in late September 2025. Three — Aleksandar Savić, Filip Petrović and Nemanja Ćevap, all from the town of Velika Plana — later reached plea agreements with prosecutors. Serbia’s Smederevo Higher Court convicted the three in separate rulings issued on December 22 and 24, 2025, finding they had acted under the direction of “structures of the intelligence service of the Russian Federation,” with the goal of inciting religious and national intolerance. The other eight suspects remain uncharged and are not in custody.
Now, a cache of leaked internal documents and chat logs offers a glimpse into what investigators say was a much broader influence campaign — one that discussed covert provocations, political manipulation and election-related operations across Europe and beyond.
The files were obtained by Delfi Estonia and shared with the Organized Crime and Corruption Reporting Project (OCCRP) and partner outlets including Le Monde, Profil and Dossier Center. The investigation was first published on May 24, 2026.
From Paris provocations to a wider influence strategy
The Paris mosque incident is not based solely on the leaked documents.
Court records reviewed directly by the press-freedom outlet Forum 18 show the same group was convicted over an earlier operation too: on the night of May 30–31, 2025, attackers sprayed green paint on three Paris synagogues, the city’s Holocaust memorial and a restaurant in the historic Jewish quarter. The mosque attacks followed in September. Both operations, the courts found, were intended to inflame tensions between Jewish and Muslim communities in France and Germany, and involved acts as far afield as plastic skeletons left near Berlin’s Brandenburg Gate.
The convicted men were minor operatives, paid roughly 1,000 to 1,500 euros per completed job. The group itself was run by two unnamed handlers who took instructions from Russian intelligence — one identified only by the initials “M.G.,” later reported by Balkan Insight to be Momčilo Gajić, a Serbian national who relocated to Moscow; the other known only by the codename “Hunter.” Neither has been charged.
Separately from the Serbian case, Mediapart reported in December 2025, citing French intelligence documents, that the Russian presidential administration had “directly approved” the operation against Jewish sites — a finding independent of both the Serbian verdicts and the OCCRP leak. Le Monde separately reported that French investigators were examining a possible role for the GRU’s Unit 29155.
The leaked material goes further still, describing detailed internal planning. A document titled “Report on Operation Pig’s Head” describes a six-person team arriving in Paris on September 7, conducting reconnaissance the following day, carrying out the mosque operation that night and then leaving the country.
OCCRP and its partners caution that authorship of a significant portion of the leaked documents could not be established. It is not always possible to determine whether a particular proposal originated with the communications firm identified in the files, officials in Russia’s presidential administration or another actor.
The Social Design Agency and the Kremlin connection
The documents repeatedly point to the Social Design Agency, or SDA, a Moscow-based communications firm already sanctioned by the United States, the United Kingdom and the European Union over previous influence operations.
The company had surfaced before.
A separate 2024 leak examined by European journalists linked SDA to campaigns aimed at weakening Western support for Ukraine and promoting far-right political forces ahead of elections to the European Parliament.
That same year, the U.S. Department of Justice said in an unsealed affidavit that SDA, along with two related firms, operated under the “direction and control” of Russia’s presidential administration — and specifically of Sergei Kiriyenko, the administration’s first deputy chief of staff.
The newly leaked chats also contain references to Sofia Zakharova, an official in the Russian presidential administration who was sanctioned by the European Union in December 2024 over her work alongside SDA chief Ilya Gambashidze, as part of the bloc’s first-ever sanctions package targeting Russian hybrid activity.
A spreadsheet contained in the cache identifies Zakharova as the user behind one of the chat accounts discussing project funding and approvals.
In one conversation, she appears to say that approval is being awaited from a more senior figure identified only by the initials “SVK.”
OCCRP noted that those initials correspond to Sergei Kiriyenko. That specific identification is an inference based on the initials in this particular chat and has not been independently established by OCCRP — though it is consistent with the broader Kiriyenko-SDA relationship that U.S. prosecutors have separately alleged.
Neither Russia’s presidential administration nor SDA responded to OCCRP’s requests for comment. In a related inquiry, Forum 18 wrote separately in April 2026 to Russia’s Foreign Ministry, its Foreign Intelligence Service (SVR), the Defence Ministry, and the Russian Embassy in Belgrade, asking why the Russian state was instructing and financing attacks in Western Europe. Only the SVR replied, referring the outlet to its public website without addressing the question.
“Cognitive strikes”
Inside the leaked material, the operations are described using an unusual term: “cognitive strikes.”
According to the documents, their purpose was to deepen divisions among Western political elites, encourage protest activity and exploit tensions surrounding issues such as migration and religion.
Some of the proposals relied on provocation and false attribution.
One operation described in the files involved spraying foam into car exhaust pipes in Germany and leaving stickers designed to make the Green Party appear responsible.
Another proposed vandalizing a monument to Charles de Gaulle in Paris while allegedly misleading the people carrying out the act into believing that they were working on behalf of a Ukrainian charity.
A separate plan involved floating dozens of inflatable dolls carrying anti-migrant messages down the Seine.
Not every operation described in the documents was necessarily carried out. Investigators were unable to independently confirm the execution of several proposals, which appear in the files only as plans.
Armenia emerges as another target
The leaked material also points beyond Western Europe.
A separate group of documents concerns Armenia, where parliamentary elections have become increasingly important as Prime Minister Nikol Pashinyan pursues closer relations with Europe and seeks to reduce the country’s traditional dependence on Moscow.
The files describe plans for a media outlet targeting Russian-speaking Armenian voters. Its stated purpose was to support political candidates favoring closer ties with Russia while undermining Pashinyan.
The outlet is formally operated by another company, which did not respond to requests for comment cited in the investigation.
The documents also describe two disinformation campaigns and include internal estimates of their reach.
One falsely claimed that Pashinyan had purchased a villa in Marseille. Internal reporting from the operation claimed that the story generated more than 10 million views.
Another circulated the debunked claim that Ukrainian President Volodymyr Zelensky had purchased an apartment for his mother in Dubai’s Burj Khalifa. Internal figures put its reach above 86 million views.
Those numbers come from the operation’s own internal reporting and have not been independently verified.
The broader allegation of SDA interference in Armenia is also supported by an independent UK government assessment. On May 11, 2026, the UK’s Foreign, Commonwealth & Development Office sanctioned 49 individuals linked to SDA, stating the firm’s campaigns were “almost certainly tasked by the Russian Presidential Administration” and citing its attempts to install pro-Russia figures ahead of the vote — a conclusion British officials reached independently of this specific leak.
Using Western voices to carry Russian narratives
The files also describe attempts to place pro-Russian narratives through Western commentators.
They reference retired French general Dominique Delawarde, who told Russian state news agency TASS in April 2025 that the war in Ukraine would end “under Russian conditions.” Delawarde died the following month.
Another name appearing in the chats is retired U.S. Major General Paul Vallely.
Internal communications describe efforts to place Vallely with Israeli media and refer to him as being “close to Trump.” TASS later published statements from an interview Vallely had given to an Israeli radio station.
When contacted by OCCRP, Vallely said he did not recall the interview and had no formal relationship with any Russian entity.
Crucially, neither the leaked documents nor independent evidence cited in the investigation establishes that either Delawarde or Vallely knew they were being approached as part of a state-linked influence operation.
The plans for 2026
One document titled “Projects 2026” suggests that the network’s ambitions extended well beyond individual provocations.
Among the initiatives described in the file is an English-language online platform targeting Western think tanks, with German, French and Spanish versions reportedly planned.
Another project is described as an AI-generated “knowledge base” focused on Germany that the documents claim already contained more than 200,000 pages.
The files also refer to a database monitoring roughly 10,000 social media accounts classified as Western “opinion leaders.”
A project named “Mitteleuropa,” meanwhile, proposes strengthening political ties among Austria, Hungary and Slovakia, with the stated long-term objective of fragmenting the Visegrad Group.
These projects appear in internal planning material. OCCRP said it could not independently establish whether all of them became operational.
A glimpse inside the operation
The leaked chats also suggest growing concern about operational security inside the network itself.
After an earlier SDA leak became public in 2024, Zakharova is described as demanding an explanation from Gambashidze about why notes had been taken during closed-door meetings.
In another exchange, a participant appears to report on Gambashidze’s movements in language suggesting that he was being monitored by his own colleagues.
Taken together, the court findings and leaked files offer a rare view of how modern influence operations can move between physical provocation, online disinformation, political messaging and attempts to exploit existing social divisions.
But the evidence is not uniform.
Some elements are backed by criminal convictions, reporting based on French intelligence documents, and official sanctions records. Others come from leaked internal documents whose authorship or real-world execution has not been independently established.
