Russia's disinformation machine: France in the crosshairs
Leaked files from a Kremlin-linked PR firm expose the planning behind pig-head mosque attacks and green-paint synagogue vandalism in Paris.
In September 2025, nine severed pig heads — each marked with the word “Macron” in blue ink — were left outside mosques and Islamic cultural centers in the Paris region. Months later, three Serbian men were convicted at home for the crime. Now, a cache of leaked documents from a Russian disinformation operation reveals what was hidden behind those images: spreadsheet-level planning, internal after-action reports, and a chain of command reaching into the Russian presidential administration.
The files implicate the Social Design Agency (SDA), a Moscow-based PR firm already sanctioned by the United States, the United Kingdom, and the European Union for previous influence campaigns linked to the Kremlin.
This image is used for illustrative purposes only.
At a Glance
Internal SDA documents detail the logistics of the “Operation Pig’s Head” attacks on Paris mosques in September 2025, including photos of the pig heads prepared before they were placed — images that had never been made public.
The same files reference a separate operation targeting three Paris synagogues and the Holocaust Memorial in May 2025, listing the exact addresses and stating a goal: to “discredit French authorities” and damage President Macron’s image.
A file labeled “Projects 2026” lists eight active or planned operations, including AI-generated video campaigns targeting France and a network of fake think-tank websites designed to shape Western policy debates.
Two operations, one alleged mastermind
The internal “Report on Operation Pig’s Head” reads like a military after-action review. Six operatives arrived in Paris on September 7, 2025. They conducted “reconnaissance” the following day. On the night of September 8–9, the pig heads were placed. The team then “successfully left the country.” An appendix tracked media coverage across French, English, and Russian outlets, concluding:
“The operation received wide coverage in world media outlets.”
A few months after the attacks, a Serbian court convicted three men for the crime. The verdicts stated they had been directed by “structures of the intelligence service of the Russian Federation.”
The leaked files offer a possible link between those verdicts and a specific chain of command. A separate screenshot of an internal chat thread sheds light on the so-called “green synagogues” operation. In May 2025, the facades of three Paris synagogues and the Mémorial de la Shoah — France’s national Holocaust memorial — were sprayed with green paint overnight. The internal exchange names the targeted addresses and frames the objective as twofold: to “discredit French authorities, unable to stem the wave of Islamist antisemitism in Paris,” and to deal a blow to Macron’s international standing.
The pattern across both operations is consistent. Exploit or manufacture an existing social tension. Execute a physical act of provocation. Document the media fallout as a measure of operational success.
The SDA: a sanctioned firm with an industrial playbook
The Social Design Agency is not a new name to Western security services. It was sanctioned for its role in the so-called Doppelganger campaign — a large-scale operation that used fake websites cloned from established news outlets to erode Western support for Ukraine ahead of the 2024 European Parliament elections. In 2024, the U.S. Department of Justice released an affidavit in which an FBI agent testified that the SDA operated under the “direction and control” of the Russian presidential administration.
What this latest leak adds is visibility into the command structure itself. The documents include screenshots of internal chats on a workplace collaboration platform in which SDA staff and presidential administration officials appear side by side — the latter exercising budgetary oversight and monitoring the movements of the agency’s director, Ilya Gambachidze.
Kevin Limonier, a researcher at the GÉODE center at the University of Paris 8 — one of France’s leading specialists in Russian digital geopolitics — has previously described the SDA’s operations as calibrated around measurable metrics, adapting their targeting to each country. He has noted that France became a priority target after President Macron shifted away from a conciliatory posture toward the Kremlin in 2022. That policy shift is a documented fact of French foreign policy; whether it directly drove the intensification of Russian influence operations on French soil remains, at this stage, a plausible hypothesis rather than an established causal link.
The documents themselves do not always allow reporters to determine whether a specific operation originated with the SDA, the presidential administration, or another structure. Neither the agency nor the Russian presidential administration responded to requests for comment.
France as a laboratory for hybrid destabilization
The “Projects 2026” file extends the scope of what the documents reveal well beyond physical provocations. Among the eight projects listed — some described as already underway — are an AI-driven video propaganda program targeting French audiences, large-scale databases tracking thousands of social media “opinion leaders,” and a network of websites designed to look like independent Western think tanks. One of them, the World Center for Strategic Studies, was registered on March 30, 2026, and publishes unsigned analyses in English.
This sequence — physical provocations, media amplification, fake intellectual infrastructure, mass influencer surveillance — suggests an operation designed to work across multiple layers simultaneously. Whether it constitutes a single coordinated architecture or a portfolio of parallel initiatives remains to be established by the ongoing judicial investigations in France and elsewhere.
For American readers unfamiliar with Europe’s hybrid threat landscape, the closest analogy might be a government-sponsored covert action program — but one run not through a directly accountable agency like the CIA, but through a private contractor that provides its state patron with an additional layer of deniability. That structural ambiguity is, experts suggest, a feature rather than a bug.
James Pamment, who directs the Psychological Defence Research Institute at Sweden’s Lund University and has extensively researched the SDA, described the documents as evidence of “a pattern of reckless escalation.” Security analysts specializing in hybrid threats have warned that the long-term effects of such campaigns may not become fully visible for years — and that by the time they do, the window for an effective response may have already closed.
The bottom line
The documents do not leave much ambiguity about the “who” — the internal chain of command points toward Moscow with an unprecedented level of documentary detail. The harder question is the “how far.” If a single planning file already lists eight active operations targeting France and other European democracies in 2026, how many more provocations, fake think tanks, and influence campaigns are running quietly, with no leaked files to expose them? And do European democracies have the legal, diplomatic, and digital tools to counter a form of warfare deliberately designed to remain just below the threshold of open conflict?
Sources: France 24 · Le Monde · GÉODE — Université Paris 8