Join War on the Rocks and gain access to content trusted by policymakers, military leaders, and strategic thinkers worldwide.
On the afternoon of May 11, 2024, two men arrived at a modest hotel in Paris. One of them, identifying himself as Mircho Angelov, presented a Bulgarian ID card at the reception desk, though the booking had been made days earlier from Bulgaria by another man named Nikolay Ivanov. Over the next 24 hours, Angelov and Georgi Filipov toured the French capital, before being joined the next day by a third man, Kiril Milushev. The three men spent the day of May 13 in cafés across the Marais district. But that very same night, their activity took a more covert turn: At 3:52 a.m., Angelov and Filipov approached the Wall of the Righteous outside the Shoah Memorial and began spraying red handprints. At 3:56 a.m., a security guard intervened, prompting the pair to flee. Milushev entered the Allée des Justes, filmed the stencils — about 35 in total — and left. Hours later, images of the defaced Memorial went viral, amplified by local officials, French media, and a network of inauthentic accounts related to the Doppelgänger Russian information ecosystem. The inflammatory debate would last for weeks.
Held in Paris from October 29 to 31, 2025, the “red hands” trial is the first judicial proceeding in France against an alleged network of operatives related to Russian intelligence services. Following the approach of colleagues who attended the major espionage trial in the United Kingdom earlier in 2025, I sat in the courtroom during the entire proceedings. The “red hands” incident exemplifies the adaptive logic of Russian covert action. It shows that traditional intelligence frameworks operate alongside more decentralized structures. The operational recklessness of the perpetrators also reflects a recurring feature of Russian tradecraft: the deliberate recruitment of individuals from environments where material insecurity, personal instability, and ideological extremism intersect, allowing handlers to externalize risk and minimize the chances of direct attribution. The case further reveals an emerging pattern in which the same recruits participate in multiple operations, challenging the widely held assumption of single-use operatives.
The “red hands” case is part of Russia’s broader wartime strategy in Europe. It demonstrates how Russian intelligence services integrate traditional covert practices with contemporary methods of political subversion to sow confusion and undermine cohesion in democratic societies. These operations have surged since the beginning of the Russo-Ukrainian War.
A Traditional Intelligence Network
Traditional Russian intelligence methods sit at the heart of the “red hands” operation. The network structure revealed by the trial is characterized by a very common operational hierarchy. At the top sits an individual acting as principal agent, responsible for overall coordination and logistical supervision of the operation. Investigative findings indicate that the principal agent maintained sustained communication in Russian with his case officer via Telegram, in a relationship likely conducted to the benefit of the Main Intelligence Directorate, Russia’s military intelligence service also known as the GRU. In this case, Ivanov appears to have acted as the principal agent, overseeing the organization of the operation, managing funds, and arranging transport as well as exfiltration logistics.
At the intermediary level, a second individual was recruited directly by the principal agent. This person ensured the execution of the mission on the ground while maintaining regular contact with the principal agent. In the “red hands” operation, that role was filled by Angelov, who had been recruited by Ivanov himself, and in turn recruited the operatives. Angelov did not appear at trial, as he has not yet been apprehended. He is the subject of an international arrest warrant.
At the lower end of this structure, operatives executed instructions transmitted by the intermediary tier. Milushev and Filipov appear to have acted as the operatives, but with differing levels of responsibility. Milushev, who arrived in Paris the day after the first night of tagging, did not directly participate in the stenciling at the Shoah Memorial. Instead, he maintained close contact with the principal agent during the operation. Evidence discussed during the trial suggests he was responsible for acting as a lookout, overseeing the area, and subsequently recording the stencils as proof of mission completion to report back to the principal agent and for later diffusion on social media.
The operational structure of the “red hands” network is of particular interest to contemporary Russian intelligence practices. For starters, it had a very traditional structure. The network resembles established and well-documented patterns observed in Russian intelligence operations: a case officer based in Russia, an agent recruited from within the populations of former Soviet republics, and the enlistment of operatives from the agent’s immediate personal circle, tasked with carrying out specific assignments abroad.
But this structure also differs markedly from more complex and decentralized networks used for espionage and sabotage operations in Europe in the last few years, most notably the one prosecuted in the United Kingdom in March 2025. As documented by Daniela Richterova, the structure in that case more closely resembled an outsourced, multilayered model, in which a “contract manager” — Jan Marsalek — delegated the development of operational plans to a designated “country manager,” who in turn entrusted further responsibilities to a close associate.
The “red hands” case demonstrates therefore that traditional frameworks continue to be employed in parallel with these more decentralized structures. The coexistence of these different models underscores the operational adaptability of Russian intelligence services, which appear capable of tailoring network structures to the specific objectives, contexts, and risk thresholds of a given mission.
Covert Action by Dummies
While Russian influence operations in Europe have grown more clandestine in form over the last few years, the “red hands” case reveals a persistent thread of operational recklessness and improvisation characteristic of recent Russian covert actions. Throughout the trial, the three defendants adopted a posture of exaggerated incompetence, portraying themselves as unaware participants and shifting all responsibility onto the missing figure of Angelov. Their behavior at times recalled the staged absurdity of the Main Intelligence Directorate agents involved in the Skripal poisoning, who famously claimed in a television interview to be tourists visiting Salisbury Cathedral. As noted by David Père, lawyer for the Shoah Memorial during the trial, the defendants:
present themselves as the “reluctant participants” in antisemitism — a friendly Nazi who wears an Adolf Hitler T-shirt to sleep, an alcoholic videographer, an overly helpful holiday camp host … and this group exaggerates the bumbling, comic aspect of their escapade.
The limited professionalism of the operation was further exposed by the volume of evidence investigators were able to collect in the immediate aftermath of the incident and the speed with which the suspects were identified. All members of the network operated under their real names, using personal mobile phones to travel and communicate with one another. While encrypted messaging apps were used, this had little impact on investigative progress: After identifying the perpetrators on surveillance footage, authorities traced them to a hotel where they had left copies of their identification documents and geolocated their phones during the operation.
This reliance on clandestine methods reflects a pragmatic adaptation by Russian intelligence to reduced operational access and heightened security, following the widespread expulsions of Russian intelligence officers after the Skripal poisoning in 2018 and the 2022 invasion of Ukraine — as well as growing difficulties in securing accreditation for new operatives in many European countries. But rather than investing in more advanced covert capabilities, Russian services appear to rely on minimalist operational cover designed primarily to obscure direct attribution. The emphasis is not on professional secrecy in the classical sense, but on maintaining (im)plausible deniability. Far from undermining the seriousness of the operation, this apparent amateurism reflects a recurring feature of Russian covert action in Europe: low cost, low discipline operations designed for quick impact, where strategic intent is cloaked in deniability and theatrical incompetence.
Recurring Patterns in Recruitment
The profiles of those involved in the “red hands” case closely align with previously observed patterns of recruitment in Russian-linked influence networks in Europe. As in other documented cases, recruitment appears to be shaped by a combination of financial vulnerability, ideological affinity, and personal connections. Ivanov, identified as the coordinator of the operation, reflects this convergence. Born in Luhansk, Ukraine, he has a military background in the Bulgarian army, spent several years living in Russia, and was affiliated for nearly a decade with a Bulgarian nationalist party, suggesting a measure of ideological alignment with the Russian government. Filipov, although claiming to have renounced his earlier beliefs, bears tattoos depicting swastikas and Third Reich iconography, and was living on the economic margins in Bulgaria, working low-wage jobs. Angelov, likewise, displayed Nazi tattoos, suggesting a similar ideological profile.
These elements are consistent with a broader trend in which Russian intelligence recruits operatives from environments where material precarity, personal instability, and ideological extremism intersect. Ideological alignment, especially with far-right or ultra-nationalist views, can serve as both a motivating factor and a tool for fostering cohesion and loyalty within loosely organized networks.
At the same time, because these individuals come from the social and economic margins, they usually have neither public visibility nor state protection, making it easier for those who recruit them to send them abroad for covert tasks. This combination makes such individuals particularly useful for low-cost and deniable operations, enabling Russian services to deploy them with minimal investment — Filipov was reportedly paid $1,200 and Milushev $600 — while externalizing operational risk and reducing the likelihood of direct attribution to the sponsoring service.
Russian Operatives Are Not For “Single-Use”
Recurring patterns in recruitment are increasingly accompanied by an observable shift in the operational use of these individuals. The trial of the “red hands” challenges the widely held assumption that Russian operatives are recruited for isolated, “single-use” operations. Filipov is implicated in the “coffins” case of June 2024, which involved placing coffins draped in French flags and painted in red to symbolize French blood in the war in Ukraine. Milushev is also suspected of having participated in two other operations: the defacement of Stepan Bandera’s grave in Munich shortly after the Paris incident and the distribution of pro-peace stickers related to Ukraine in a Swiss municipality.
The profiles of the “red hands” defendants is therefore illustrative of what seems an emerging pattern of repeated use of the same operatives across multiple actions. This trend is supported by recent findings from the International Centre for Counter-Terrorism, which challenges the idea of lone, expendable agents recruited online for one-off missions. According to their report, approximately 62 percent of Russian-linked recruits have been involved in more than one operation.
These cases point to a strategy of repeatedly deploying low level operatives across low cost, symbolically charged actions in multiple European countries. This emerging pattern suggests a coordinated approach aimed at maximizing visibility and disruption through a series of discrete acts carried out within a short timeframe. This may also reflect what is known in the intelligence field as “operational testing,” in which recruited assets are given tasks — often involving minor illegal or borderline legal acts — to assess their reliability, test, and condition them before they are potentially deployed in more complex operations. Further arrests and prosecutions will be necessary to determine whether this reflects a broader operational model or an ad hoc adaptation to resource constraints.
Wartime Objectives of Subversion
The “red hands” case is not an isolated incident but part of a broader campaign of subversive acts linked to Russian intelligence in France over the last two years. At least ten similar operations likely related to Russian intelligence operations have occurred in France. The most notable include the painting of Stars of David on various buildings in October 2023 — attributed by French intelligence to the FSB’s Fifth Service, the defacement of the same Shoah Memorial with green paint in May 2025, and the placement of pig heads outside mosques in September 2025. These operations purposefully exploit historical and religious symbols that are highly sensitive in France to provoke outrage, polarize society, and erode public trust.
This growing pattern reflects a strategic shift in Russian intelligence priorities since the full-scale invasion of Ukraine in 2022. Russian covert structures have moved from targeting political opponents to conducting sabotage and influence operations to shape the information environment in support of wartime objectives. These networks are now instrumental in manipulating public perception, shaping narratives, and applying pressure on key European states. France, in particular, has become a primary target due to its vocal stance against Russian aggression and its leadership role in pushing for European strategic autonomy and building the so-called Coalition of the Willing. France is also perceived as vulnerable, politically unstable and riven by sharp political and ethnic divisions. The “red hands” operation contributes to a broader effort to weaken domestic cohesion in France and undermine its influence within the Western response to the Russo-Ukrainian War.
But what unites these seemingly disconnected incidents is not only their symbolic targeting or clandestine execution, but their systematic amplification through Russian-linked disinformation networks. In each case, the physical act is not an end in itself but the first step in a broader influence mechanism. These actions were all rapidly followed by their amplification across social media and their insertion into Russian-linked disinformation networks such as Doppelgänger. The pictures of the “red hands” went viral online only a few hours after the act of vandalism itself, with the Russian ecosystem of fake X accounts and coordinated bot networks injecting manipulated content into public debate.
These operations demonstrate that Russian intelligence services make use of traditional covert structures together with modern tools of digital influence. While the actions themselves are often low-cost and operationally crude, they are designed from the outset for online amplification. Using bot networks, inauthentic media outlets, and AI-generated content, these small-scale disruptions are rapidly transformed into far-reaching influence campaigns. This approach reflects the evolution of Russian intelligence tactics in which acts of vandalism serve primarily as triggers for larger information operations.
Ultimately, these interference activities reflect the growing strategic weight Moscow places on subverting public opinion in Europe in the context of war. These acts of subversion are not peripheral but closely linked to Russia’s broader war objectives, unfolding in parallel with espionage and sabotage efforts. Together, they reflect a coherent doctrine of offensive action rooted in the longstanding traditions of Russian intelligence. The “red hands” case therefore stands as both a testament to Russia’s tactical adaptability under constraint and a reminder that even seemingly amateur operations can contribute to an integrated strategy to destabilize democratic societies from within.
Clément Renault, Ph.D., is a senior research fellow in Intelligence, War, and Strategy at the French Institute for Strategic Research, Adjunct Professor at Sciences Po Paris School of International Affairs, and visiting fellow at the King’s Center for the Study of Intelligence at the Department of War Studies, King’s College London.
Image: Midjourney
