“There are no spies in this dock; they have neither the charisma nor the stature of Daniel Craig". So began, not without irony, the plea of the defence for Kiril Milushev, one of the four Bulgarian nationals accused of defacing a downtown Paris Holocaust memorial by spraying dozens of red hands over its marble wall in May 2024. Unlike most graffiti cases, often featuring similarly unglamorous defendants, the crime on trial was no one-off act of vandalism. As the closely watched three-day court drama revealed, the 'Red Hands' affair was a symptom of something much more strategic: a protracted state-backed campaign to undermine, destabilise and fracture Western societies. France’s first trial over suspected Russian interference also showed how seemingly low-level yet performative acts – termed here 'strategic vandalism' – feed into the Kremlin’s broader hybrid warfare.
The Crime, the Trial and the Punishment
The Red Hands operation took place on the night of 13-14 May 2024. Under cover of darkness, three recently arrived Bulgarians carried out a large graffiti campaign, spraying hundreds of red handprints in various streets of the 4th and 5th districts of Paris, including on the Wall of the Righteous – a monument to those who saved Jews in the Second World War – a stone’s throw from the Seine. The choice of red hands was no accident; they are widely recognised as a symbol of killing Jews, rooted in a 1940s antisemitic pogrom in Iraq where red hand signs marked Jewish homes. The symbol resurfaced in October 2000 during the Second Intifada, when some celebrated the killing of two Israeli soldiers in Ramallah. On 26 April 2024, just a few days before the operation, the symbol resurfaced during pro-Palestinian demonstrations on the Sciences Po Paris campus, generating public outcry. Painting red hands on the Holocaust memorial echoed those episodes – suggesting French Jews are now targets too.
While the perpetrators were not caught red-handed, CCTV footage, phone and hotel records soon led French police to identify them. Following extradition requests, three suspects were handed over by Bulgarian and Croatian authorities: Donbas-born Nikolay Ivanov (42), a crypto trader-turned ringleader with links to Russian intelligence and a history in a pro-Russian militia; Georgi Filipov (36), a neo-Nazi tattoo enthusiast who spray-painted the memorial; and Kiril Milushev (28), tasked with filming the operation. A fourth suspect, the alleged second-in-command, Mircho Angelov (27) – who also sported graphic neo-Nazi tattoos – remained at large.
Less than eighteen months later, on 29 October 2025, the Red Hands case took centre stage at the Paris criminal court. Foreign interference sat at the core of the hearings, closely watched by French and international media. Throughout the proceedings, Moscow was cast as the culprit – the hidden hand behind the operation. While the curious crew in the dock owned up to the spray-painting, they denied any antisemitic intent or working at Moscow’s behest. Prosecutors, however, took a hard line, highlighting Russia’s central role in the vandalism spree, repeatedly citing assessments by France’s domestic intelligence agency, the Direction Générale de la Sécurité Intérieure (DGSI), and urging the judges to treat the act as “hostile” and aimed at a “national symbol”.
Three days into the proceedings, it was clear the prosecution’s strategy had paid off. The three defendants – and their fugitive accomplice – were convicted of defacing the monument, with antisemitism an aggravating factor because of the targeting of a Holocaust memorial. They received two to four years in prison, and a lifetime ban from entering France. Had the offence occurred a few months later, their sentences could have doubled. In July 2024, France passed a new foreign influence law which, similar to the UK’s National Security Act 2023, introduced tougher penalties for foreign interference operations, including “attacks on property or persons committed on behalf of a foreign power.” Although the statute could not be applied here, the judge cited in the final judgment “a coordinated action from abroad” with “hostile intent” to “stir up public opinion, exploit divisions, and fragment French society”.
Targeting France
The Red Hands affair is not an outlier: it is one of nine alleged Russian operations on French soil in a short period. In autumn 2023, dozens of antisemitic tags – blue Stars of David – appeared on buildings in central and suburban Paris amid a sharp rise in antisemitic acts following Hamas’ 7 October attacks. While a Moldovan couple was arrested and a pro-Russian Moldovan businessman identified as the alleged instigator, a leaked DGSI memo also showed that French security officials suspected the involvement of the FSB, Russia’s domestic security service. Soon after, in February 2024, the DGSI issued a note urging police to flag any “weak signals” – early, subtle indicators that may seem insignificant on their own – of Russian interference, warning that such subversive actions may appear as ordinary crimes like damage to public property or violent attacks against Ukrainian nationals or Russian dissidents.
On 1 June 2024, five plaster-filled coffins draped in French flags and marked “French soldiers of Ukraine” were placed at the foot of the Eiffel Tower – charges were dropped, but one arrestee returned weeks later to spray red handprints on the Holocaust Memorial, underscoring a systematic pattern rather than random vandalism. Most recently, on 9 September 2025, nine bloodied pig heads were left outside mosques in Île-de-France. Three weeks later, eleven foreign nationals also suspected of conducting similar acts in Germany were arrested in Serbia. Investigators are exploring links to the infamous GRU Unit 29155, long associated with sabotage and assassinations.
If France has become a key target for this wave of Russia-sponsored vandalism, it is largely because President Macron has adopted a more assertive posture in response to Moscow’s escalating aggression. Since the full-scale invasion of Ukraine in 2022, Paris has led within the EU in supporting Kyiv, through military aid, training and intelligence sharing. On 26 February 2024, Macron’s unexpected openness to deploying allied troops on Ukrainian soil – met with surprise by France’s partners – underscored that, two years into the war, France’s commitment to Ukraine remained firm.
This harder line towards Russia is reflected in doctrine. Breaking with long-standing restraint on cyber attribution, the French National Agency for the Security of Information Systems (ANSII) published a report on 29 April 2025 about the modus operandi of APT28 – a GRU-linked cyber threat actor. Active since 2004, APT28 has carried out wide-ranging cyber-espionage against government, military, and critical infrastructures. In 2016 the group reportedly compromised Hillary Clinton’s presidential campaign, since 2021 has targeted approximately ten French entities along with several NATO allies, and since 2022 has been particularly active in Ukraine. The report publicly named Unit 20728 for the first time – based in Rostov-on-Don and stemming from the GRU’s 166th Information Research Centre. Perhaps even more significant is the retrospective attribution to Russian military intelligence of the TV5Monde hack in 2015 and the emails from the 2017 presidential campaign, the famous MacronLeaks. This unprecedented public condemnation was paired with a warning from Macron on 13 May 2025: going forward, France would systematically attribute cyber-attacks, disinformation campaigns and interference carried out by Russia. The Foreign Ministry’s latest publication on information manipulation reiterated that stance and mapped Russia’s global offensive against France. Its effects have been particularly damaging in Africa, where leveraging anti-French sentiment on social media played a decisive role in one of this century’s most striking geostrategic shifts. In just a decade, Russia has muscled its way into Africa, both militarily and diplomatically, driving French and American forces out of parts of the Sahel, and overturning the region’s long-standing strategic balance.
A Growing Trend
France is not the only nation caught in the crosshairs of these campaigns. Since 2022, authorities across Europe have uncovered a recurring pattern of low-level politically motivated graffiti, slogans, and sticker campaigns sponsored by Russia. The primary targets are European partners at the forefront of the mobilisation to support Ukraine. In Estonia, prosecutors and security services tied a series of vandalism acts to a GRU handler, including a taunting slogan spray-painted along the wall of NATO’s cyber centre in Tallinn. In the wider Baltics, a dual Estonian-Russian citizen was detained for defacing memorial sites in both Latvia and Lithuania as part of a cross-border network. In Lithuania, prosecutors charged three Estonia-based residents over a 2024 GRU-ordered defacement of a monument to an anti-Soviet resistance leader. And in Poland, investigative reporters found Russia paying per-inscription to have thousands of slogans, such as “NATO go home”, sprayed across cities.
A similar pattern surfaced in a recent trial involving a UK-based network of Bulgarian operatives run by disgraced Wirecard Chief Operating Officer Jan Marsalek. To please their ultimate clients, Russia’s FSB and GRU, the group carried out a graffiti and sticker campaign in Austria and Germany. Within weeks of the Russian invasion of Ukraine, they were tasked to seed streets and monuments with a variety of political slogans linked to the war. One line pushed the idea that Ukraine and President Zelensky were tied to far-right extremism. Slogans like “I love Azov” – referring to a Ukrainian battalion with far-right roots that Russia cited as justification for its invasion – and battalion insignia appeared at sensitive sites such as Vienna’s Jewish Museum on Juden Platz. In parallel, crews pasted anti-Russia decals (e.g., pigs crossed out with “Russian” yellow labels striking through “Z”) on the Soviet war memorial, Russian-owned premises, and even the Hotel Sacher. This was meant to be a staged 'Russophobia' wave designed to let Moscow pose as a victim.
Taken together, these Europe-wide cases reveal a broad set of objectives: fabricate hostility and inflame culture-war flashpoints, widen existing social rifts, undermine political leaders or parties hostile to Russia, promote pro-Kremlin narratives, erode trust in the state, discredit legitimate Ukrainian opposition, drain security bandwidth, sow chaos and paranoia – all while keeping Moscow’s hand at arm’s length. In France, the second most targeted country by Russian disinformation after Ukraine, Moscow’s strategy extends well beyond the battlefield. It seeks to inflame debates around contentious policies, such as the possible deployment of troops to Ukraine, to deepen political polarisation and erode public trust. At the same time, Russia exploits other divisive issues that appear unrelated to Kyiv but serve the same purpose: destabilising France internally and diverting attention from the war.
Nowhere is this clearer than in Russia’s manipulation of Middle Eastern tensions. Since October 2023 – when Hamas carried out the largest terrorist attack in its history and Israel launched the war in Gaza – France has witnessed at least nine highly performative antisemitic or Islamophobic acts. In a country with the largest Muslim and Jewish populations in Europe, the Gaza conflict has sharpened long-standing sensitivities, fuelled protests and heightened intercommunal tensions. This has created fertile ground for Russia’s security and intelligence services, which have a century-long record of exploiting such social fault lines, amplifying division, insecurity, and a besieged mindset. The anatomy of the Red Hands operation, the first of these suspected foreign-orchestrated incidents to reach trial, leaves little doubt that the graffiti campaign formed part of this broader effort.
Strategic Vandalism
In the current geopolitical context, carefully crafted slogans and symbols sprayed on monuments, public buildings, and security sites function as hybrid/grey-zone tools and point at a set of practices which are much bigger and strategic. These cheap and camera-ready graffiti, slogan or sticker campaigns are vandalism with a strategic purpose, designed to achieve political or informational effects. The term 'strategic vandalism', originally used to describe Danish artist Asger Jorn’s practice of defacing thrift-store paintings, is applied here to a post-2022 Russia-sponsored phenomenon linked to the War in Ukraine. This phenomenon is characterised by deliberate, instrumental acts of property damage and staged publicity stunts commissioned by Russian security and intelligence services or their proxies. Conceptually, strategic vandalism sits within the tradition of active measures: covert political-warfare methods such as disinformation, influence, and provocations, sometimes paired with sabotage. But its outsourced nature, social media amplification, and ultimate speed and scale distinguish it from earlier practices.
While strategic vandalism can be a stand-alone tactic, graffiti and slogan drops are often the noisy tip of the spear, frequently functioning as pipeline activity for much more aggressive tasks: the same recruits are tasked to reconnoitre transport, security sites, communications nodes, and other critical infrastructure to scope vulnerabilities and test responses. Crucially, some of the same vandals have crossed the line into sabotage – physical disruption and damage, including arson – turning cheap, deniable messaging ops into real-world risks for public safety and continuity of services.
Since the Russian invasion of Ukraine, we have seen an increase in outsourcing security and intelligence tasks to amateurs. There seem to be several recruitment models at play. The most common is the gig-economy model, where handlers post micro-tasks in encrypted channels and closed forums, price them per action, and pay small, rapid usually crypto bounties for proof-of-work. These are typically time-stamped photos, geotags, or short videos. In this model, turnover is high, skills are minimal, and layered cut-outs keep organisers deniable, effectively turning street-level influence and vandalism into on-demand piecework. By contrast, the Jan Marsalek-run Bulgarian spy network case points to another, contractor model. This is centred around a trusted intermediary who aggregates jobs from the sponsor, supplies materials and target lists, and subcontracts execution to small crews – typically friends, acquaintances, or colleagues.
In the Red Hands case, these two models appear to have co-existed. In line with a gig-economy approach, ringleader Nikolay Ivanov and his deputy, Mircho Angelov, received Russian-language instructions from unknown handlers via Telegram, while the operatives were motivated by quick cash – reportedly €500–€1,000 excluding expenses. They left France the next morning, and it appears they later took on other hybrid warfare jobs, fully in keeping with the gig-economy ethos. Yet this was not a purely platform-mediated job: the three men who travelled to Paris already knew one another, and Ivanov, Angelov and the on-site videographer, Kiril Milushev, all came from the same town. The operation blended gig-economy advantages – scale and flexibility – with old-school, relationship-based control and discretion.
At the heart of this new form of strategic vandalism lies the contemporary public sphere, defined by globalisation, speed, and amplification. Within such an environment, strategic vandalism operates as a series of communicative strikes, which follows a three-step logic: record, seize, amplify. First, the communicational dimension is often built into the operation. In the Red Hands case, Kiril Milushev’s primary task was to document the act on his phone. As with terrorism, mediatisation and global visibility are not by-products but central objectives of the act. Second, like artist Asger Jorn before them, strategic vandals seize attention through shock. But that is where the comparison ends: their goal is not artistic expression but to provoke tension and sway public opinion. Third, online amplification of photographs and graffiti linked to these incidents, often boosted through fake state-run accounts, has accompanied most cases of strategic vandalism. In the days after the Red Hands operation, a network of thousands of fake accounts on X, along with opportunistic French media outlets, tried to stir controversy. While the virality strategy of the Russian disinformation network Doppelgänger may have succeeded with the Stars of David in November 2023, partly explaining its pickup by traditional media, the Red Hands operation’s amplification never really took off. In the days that followed, it was Russian interference, more than the sensitive issue of antisemitism, that dominated attention.
While strategic vandalism is first and foremost a communicative act, so too are the responses it provokes. The heavily publicised Red Hands trial can itself be seen as a strategic communication effort, signaling to both allies and adversaries that France is adopting a more proactive and self-assured stance. Strategic vandalism thus operates along the continuum of information warfare, where symbols, images, and gestures become weapons in the struggle for narrative dominance. Unlike Cold War slogan drops, contemporary acts are designed not only to send a message but also to test manpower, tactics, and state responses, while spreading divisive narratives at scale. Equally important, strategic vandalism serves to inflate Russia’s symbolic power globally. By manipulating perceptions, provoking reactions, and projecting influence far beyond its borders, Moscow demonstrates its determination to shape events, control discourse, and unsettle rivals without direct confrontation, turning acts of vandalism into potent instruments of strategic authority and geopolitical leverage. In the digital age, control over narratives is as vital as control over territory.
Photo by Koshu Kunii on Unsplash
Written by:
