In September 2025, nine mosques and cultural centers in and around Paris were targeted with a grotesque Islamophobic stunt: Bloody severed pig heads, each marked with the word “Macron” in blue ink, were left outside their front doors.
A few months later, three men from Serbia were convicted of the crime in their home country. They had been directed, the verdicts read, by “structures of the intelligence service of the Russian Federation” in an effort to incite unrest and intolerance.
Now, a cache of leaked documents obtained by reporters from Delfi Estonia and shared with OCCRP and other media partners pulls back the curtain on that provocation. The files showcase the meticulous internal planning that went into the operation, shed new light on who was behind it, and unveil a swathe of other pro-Kremlin influence efforts across Europe and beyond.
The documents point to the Social Design Agency (SDA), a Russian PR firm already sanctioned by the U.S., the U.K. and the EU for previous influence campaigns — and to the Russian Presidential Administration, whose officials are seen overseeing the firm’s work.
The several dozen files include internal reports about planned and completed missions as well as screenshots of private conversations from a workplace collaboration tool used by both SDA staffers and administration officials.
They detail numerous operations — described internally as “cognitive strikes” against the West — that included other vandalism attacks in France and Germany, efforts to advance pro-Russian messages through Western opinion leaders, and election interference campaigns. Among the latter is a plan to influence the upcoming parliamentary election in Armenia through a media outlet aimed at Russian-speaking voters, with the goal of arresting the country’s geopolitical turn towards the West.
A document titled “Report on Operation Pig’s Head” details the internal planning that went into the Paris mosque attacks, including photos of the prepared pig heads before they were distributed, that have never appeared in public.
According to the document, a group of six operatives arrived in Paris on September 7, conducted “reconnaissance” on September 8, delivered the pig heads on the following night, and then “successfully left the country.”
The file concludes with a lengthy list of news articles in French, English, and Russian that covered the attack. “The operation received wide coverage in world media outlets,” it boasts.
One leaked message sets out one of the goals of this kind of information warfare: helping Russia “maintain the image of a superpower” on the world stage. “The more Russia participates in active influence campaigns all over the world, the stronger the image of a global Russian power,” it reads.
Because many of the leaked files lack a clear author, it is not always evident whether a specific document, and the operations it describes, originated with the SDA, the presidential administration, or elsewhere. The Russian presidential administration and the SDA did not respond to requests for comment.
This is not the first time the SDA has been accused of carrying out influence operations in concert with the Russian state. The firm was sanctioned by Western countries on that basis, and in 2024 reporters from Delfi Estonia, Süddeutsche Zeitung, and other European outlets obtained a previous set of leaked files that revealed the firm’s efforts to reduce Western support for Ukraine and boost far-right parties in European Parliament elections. The same year, the U.S. Department of Justice released an affidavit in which an FBI agent testified that the company was under the Russian presidential administration’s “direction and control.”
This latest leak, parts of which were first reported by the Armenian outlet Fact Investigation Platform, showcases the SDA’s operations throughout 2025 and contains plans slated for this year. It also provides further evidence of senior presidential administration figures directing the operations, wielding budgetary power, and even keeping track of the whereabouts of the SDA’s head.
James Pamment, an expert in hostile foreign interference who directs the Psychological Defence Research Institute at Sweden’s Lund University, said the documents indicate “a pattern of reckless escalation.”
“They are trying to create conflicts between groups [in society],” said Pamment, who has extensively researched the SDA. “We’re well aware of how easy it is to inflame existing tension in Europe at the moment, particularly around issues like migration or religious tensions. It is dangerous.”
An analyst from Hybrid CoE, an organization of security experts based in Helsinki that helps EU and NATO governments counter “hybrid threats,” said the danger of SDA’s work lies in its possible long-term consequences.
“It may take years before the effects become fully visible, and by the time they do, it could already be too late to respond effectively,” said the analyst, who requested anonymity per the organization’s policy. “This is why it is so important to counter these operations right now and prevent them from spreading any further.”
False Flags in Europe
In the leaked chats, participants use pseudonyms that consist mainly of generic English names, such as “Alex Abbot” and “Sam Spencer,” though a few more fanciful aliases, like “Bruce Lee” and “Immanuel Kant,” also appear.
The screenshots are shown from the perspective of a user who uses the alias “Kristin Kiler” — an apparent reference to Christine Keeler, the infamous English showgirl whose affairs with both a U.K. minister and a Soviet naval attache helped bring down the British government in the 1960s.
“Kiler” is referred to by colleagues as “Sofia,” and according to a spreadsheet found in the leak, the pseudonym belongs to Sofia Zakharova, a senior official in the Russian presidential administration. Zakharova was sanctioned by the EU in 2024 for her work with the SDA, with the sanctions notice describing her as a communications department chief who worked “directly with [SDA head] Ilya Gambashidze.”
In the leaked chats, Sofia appears to oversee funding-related matters and on one occasion appears to defer to an even more senior official. “We’re waiting for the go-ahead from SVK,” she writes in one conversation. These initials correspond to the full name of Sergei Kiriyenko, the administration’s first deputy chief of staff. Zakharova did not respond to a request for comment.
Most of the leaked chats show Sofia and her colleagues exchanging project reports and planning documents. One of these files lays out the broad parameters of an influence campaign aimed at Western countries that is intended to assist the Russian government’s foreign policy.
“We plan to achieve this goal primarily by deepening internal contradictions between [Western] ruling elites, stimulating protest activity among opposition forces, escalating anti-government protests, and ‘stirring up’ the amorphous portion of the electorate in NATO countries and their satellites,” the document reads, which according to its metadata was created in May 2023.
The text proposes “delivering consecutive cognitive strikes” against Western audiences “on the internet platforms they control” in an unconventional manner, including by “abandoning overtly pro-Russian messages.”
“We consider the organization of mass protest actions in NATO countries to be an important supporting measure,” it reads. “We have the necessary capabilities to involve a special contingent permanently residing abroad for such events.”
According to the court verdicts handed down to the Serbs convicted of involvement in Paris pig head incidents, the group also targeted the Jewish community. The men had poured green paint on Paris’ Holocaust Museum and several synagogues and left plastic skeletons at the Brandenburg Gate in Berlin, a short distance from the Holocaust memorial. The goal of the operation, the court concluded, was to “incite religious and national intolerance” between Jews and Muslims and “destabilize the situation” in Germany and France.
The leaked files reference the synagogue operation and lay out its ultimate goal. In one conversation with Sofia, a user using the pseudonym “Edward Bernays” — an apparent ironic nod to an Austrian-American pioneer in manipulative propaganda — provides an overview of the project, titled “Green Synagogues.”
“The event made the front pages of the global media,” Bernays writes. “The aim of the action [is] to discredit the French authorities, who have been unable to stop the wave of Islamic anti-Semitism in Paris. A blow to Macron’s image, who allowed himself to criticize Israel.”
Another conversation between Bernays and Sofia references an operation in Germany last year, when hundreds of cars had their exhaust pipes filled with expanding foam and were defaced with stickers that read “Be greener!” in an apparent attempt to implicate the Green Party.
“Deutsche Welle is writing about us,” he wrote to Sofia alongside a link to a story describing the vandalism.
The leaked files also contain plans for similar missions that either never materialized or were not publicly reported. One document outlines a plan to desecrate a Paris monument to General Charles de Gaulle in the name of “Ukrainian nationalists.”
Anticipating a “high likelihood” that the perpetrators would be arrested, the document lists “special requirements” for them, including that they themselves be misled about the nature of the operation.
They must not be involved in any previous attacks and must “be certain that they are operating in the interests of Ukraine and fulfilling an order by the Olena Zelenska Foundation,” the instructions say, referencing a charity founded by Ukraine’s first lady.
A separate plan for the same month describes an operation to launch 30 sex dolls into the Seine River carrying the message “Fuck migrants!”
Armenia in Focus
А presentation found in the leak suggests that the SDA is behind a media group active in the former Soviet countries called SNG Media. The goal of the group, the document reads, is to “compensate for the lost ties between residents of the countries of the post-Soviet space after the dissolution of the USSR, acknowledged as one of the largest geopolitical catastrophes in the world.”
Officially, the group of 12 outlets appears to be operated by a separate Russian company called SNG Media. It did not respond to a request for comment.
According to another project file in the leak, the SDA planned to use one of these outlets, erevan.one, to influence the outcome of Armenia’s upcoming June elections.
The vote is widely viewed as a test of whether the country will continue the geopolitical tilt away from Russia and towards Europe and the United States that Prime Minister Nikol Pashinyan has pursued. Western officials and analysts have warned that Russia is trying to influence the election through propaganda, cyberattacks, information manipulation, and illicit financial flows in an effort to keep Armenia within Moscow’s orbit.
A leaked document titled “Russian Armenians Decide” emphasizes that a large fraction of Armenian voters are also Russian citizens and that “these voters can have a very large and even decisive influence on the results.”
To that end, the document reads, the “Yerevan One” outlet is “specialized for the Armenian diaspora in Russia” and will be used to “form a negative attitude toward the current Armenian authorities and personally toward Prime Minister Pashinyan … and a positive attitude toward those … who advocate for the closest possible union with Russia.”
Another file contains an overwhelmingly negative horoscope for Pashinyan that describes him as a “symbol of Armenia’s deep national crisis.” A similar astrological forecast was published on erevan.one in early May.
Other project files summarize the results of disinformation campaigns targeting Pashinyan and Ukrainian President Volodymyr Zelenskyy, and even acknowledgement of the fact-checks that were later published to debunk them.
A document called “Media-case Marseille” describes a disinformation campaign claiming that Pashinyan had purchased a luxury villa in Marseille. The document provides a detailed overview of reactions in local media, and claims the campaign reached over ten million views around the world.
Another project file describes the spread of a subsequently debunked news story claiming that the Ukrainian president had purchased a luxury apartment in Dubai’s Burj Khalifa skyscraper for his mother. This story also went viral globally, reaching over 86 million views, according to the internal report.
Speaking Through Western Opinion Leaders
As another avenue of influence, the leaked chats and files reference efforts to sway opinion through prominent Western public figures. In one conversation with a person using the pseudonym “Karen Horney” — whom the leaked spreadsheet lists as another presidential administration staffer — Sofia provides an update on several projects in the U.S. and France.
“Statements from two French opinion leaders are ready,” she writes, mentioning “General Delawarde” and adding: “Brief topic summary: Russia is winning, peace will be on Moscow’s terms.”
A subsequent timestamp in the screenshot indicates that this message was sent sometime before January 23, 2025. In April of that year, the Russian state media outlet TASS indeed published an interview with French former general Dominique Delawarde in which he predicted that the war in Ukraine would wind down “under Russian conditions” by the end of 2025. Delawarde passed away the following month.
In the same conversation with “Horney,” Sofia also mentions Paul Vallely, a retired U.S. Major General.
“Preliminary agreements have been reached with major Israeli media outlets that Vallely will publish ‘his’ experts with them. We are currently preparing a letter from Vallely’s organization (Stand Up [America] U.S. Foundation) to the media and working through the financial aspect. The probability of success is 90%,” she wrote. “Important: Vallely is close to Trump and is perceived accordingly,” she added.
In March 2025, TASS published quotes from an interview with Vallely that had been aired by Galey Israel, a regional Israeli radio station, in which he predicted “a quick change of power in Ukraine and a warming of relations between Russia and the West.” The station did not respond to a request for comment.
The leaked documents do not state whether Vallely was aware that the individuals he was dealing with were acting on behalf of a Russian state-linked influence campaign. In a brief conversation with reporters, he said he did not recall the interview with Galey Israel and he did not have any formal relationship with any Russian entities.
Plans for 2026
The leaked documents also include initiatives for this year, including in a file titled “Projects 2026.” It lists eight projects, some described as partially begun, including:
-
An “internet resource” apparently meant to influence Western think tanks, described as already launched in English and also planned in German, French, and Spanish. A screenshot included in the leak shows a site called the World Center for Strategic Studies that was registered on March 30, 2026 and features analyses published without any named authors.
-
An AI-driven “self-filling knowledge base” aimed at Germany for which “servers have been launched and web shells created … [with] the database already containing over 200,000 pages.”
-
An “opinion leader database” designed to monitor nearly 10,000 so-called opinion leader accounts on social media. Screenshots of a similar tool can be seen in the leak.
-
An “Opinion tracker” intended to monitor the 100 “most prominent French opposition opinion leaders.”
-
A website called “Russian Wave,” planned for publication in French, German, and Russian.
-
A project called “AI News,” aimed at France, which seeks to create three “projects” across six social networks producing hundreds of videos.
The leaked documents also outline a plan called “Mitteleuropa” that proposes to establish close political and economic relations between “a number of states and territories (primarily Austria, Hungary, and Slovakia) that were previously part of the Austro-Hungarian Empire,” with the long-term goal of creating “a single, strong, independent player.”
According to the document, the purpose of the project is to “dismantle the Visegrad Group (Poland, Czech Republic, Hungary, Slovakia)” and replace it with the “Vienna Agreement” (Austria, Hungary, Slovakia).” The plan also describes intentions to influence last month’s elections in Hungary and Slovenia.
Security Breaches
The leaked chats also reveal just how influential Sofia was within the organization, showing she had authority to demand answers from the SDA’s head, Ilya Gambashidze. After the previous leak of SDA files in 2024, which had included notes taken during meetings with Russian presidential administration employees, she demanded an explanation of the lapse.
“Questions for Ilya: for what purpose were notes taken on all the closed-door meetings regarding the international project?” she asked.
In June 2025, a user operating under the pseudonym “Peter Parker” discussed detailed security updates with Sofia, including physically disconnecting webcams and microphones on office laptops and plans to switch to Russian-made VPN services.
“Peter Parker” also provided Sofia with status updates on Gambashidze’s movements and activities, suggesting he was under surveillance: “I have seen Ilya less in the office over the last few weeks,” he wrote. “No unauthorized persons have been spotted on the premises.”
Earlier this month, the United Kingdom announced new sanctions against the SDA that targeted “49 individuals working for [the company], including writers, translators and video makers responsible for deceptive Kremlin propaganda.”
With additional reporting by Ilya Ber, Kevin Hall, Ilya Lozovsky, Florian Reynaud, and Holger Roonemaa.
