On the afternoon of Might 11, 2024, two males arrived at a modest resort in Paris. Considered one of them, figuring out himself as Mircho Angelov, offered a Bulgarian ID card on the reception desk, although the reserving had been made days earlier from Bulgaria by one other man named Nikolay Ivanov. Over the subsequent 24 hours, Angelov and Georgi Filipov toured the French capital, earlier than being joined the subsequent day by a 3rd man, Kiril Milushev. The three males spent the day of Might 13 in cafés throughout the Marais district. However that exact same evening, their exercise took a extra covert flip: At 3:52 a.m., Angelov and Filipov approached the Wall of the Righteous exterior the Shoah Memorial and started spraying crimson handprints. At 3:56 a.m., a safety guard intervened, prompting the pair to flee. Milushev entered the Allée des Justes, filmed the stencils — about 35 in complete — and left. Hours later, photographs of the defaced Memorial went viral, amplified by native officers, French media, and a community of inauthentic accounts associated to the Doppelgänger Russian data ecosystem. The inflammatory debate would final for weeks.
Held in Paris from October 29 to 31, 2025, the “crimson palms” trial is the primary judicial continuing in France towards an alleged community of operatives associated to Russian intelligence companies. Following the method of colleagues who attended the main espionage trial in the UK earlier in 2025, I sat within the courtroom throughout the complete proceedings. The “crimson palms” incident exemplifies the adaptive logic of Russian covert motion. It reveals that conventional intelligence frameworks function alongside extra decentralized buildings. The operational recklessness of the perpetrators additionally displays a recurring function of Russian tradecraft: the deliberate recruitment of people from environments the place materials insecurity, private instability, and ideological extremism intersect, permitting handlers to externalize danger and decrease the probabilities of direct attribution. The case additional reveals an rising sample by which the identical recruits take part in a number of operations, difficult the broadly held assumption of single-use operatives.
The “crimson palms” case is a part of Russia’s broader wartime technique in Europe. It demonstrates how Russian intelligence companies combine conventional covert practices with up to date strategies of political subversion to sow confusion and undermine cohesion in democratic societies. These operations have surged for the reason that starting of the Russo-Ukrainian Warfare.
A Conventional Intelligence Community
Conventional Russian intelligence strategies sit on the coronary heart of the “crimson palms” operation. The community construction revealed by the trial is characterised by a quite common operational hierarchy. On the high sits a person appearing as principal agent, answerable for total coordination and logistical supervision of the operation. Investigative findings point out that the principal agent maintained sustained communication in Russian together with his case officer by way of Telegram, in a relationship seemingly carried out to the profit of the Predominant Intelligence Directorate, Russia’s army intelligence service also referred to as the GRU. On this case, Ivanov seems to have acted because the principal agent, overseeing the group of the operation, managing funds, and arranging transport in addition to exfiltration logistics.
On the middleman degree, a second particular person was recruited immediately by the principal agent. This individual ensured the execution of the mission on the bottom whereas sustaining common contact with the principal agent. Within the “crimson palms” operation, that function was crammed by Angelov, who had been recruited by Ivanov himself, and in flip recruited the operatives. Angelov didn’t seem at trial, as he has not but been apprehended. He’s the topic of an worldwide arrest warrant.
On the decrease finish of this construction, operatives executed directions transmitted by the middleman tier. Milushev and Filipov seem to have acted because the operatives, however with differing ranges of duty. Milushev, who arrived in Paris the day after the primary evening of tagging, didn’t immediately take part within the stenciling on the Shoah Memorial. As an alternative, he maintained shut contact with the principal agent throughout the operation. Proof mentioned throughout the trial suggests he was answerable for appearing as a lookout, overseeing the realm, and subsequently recording the stencils as proof of mission completion to report again to the principal agent and for later diffusion on social media.
The operational construction of the “crimson palms” community is of specific curiosity to up to date Russian intelligence practices. For starters, it had a really conventional construction. The community resembles established and well-documented patterns noticed in Russian intelligence operations: a case officer based mostly in Russia, an agent recruited from inside the populations of former Soviet republics, and the enlistment of operatives from the agent’s instant private circle, tasked with finishing up particular assignments overseas.
However this construction additionally differs markedly from extra advanced and decentralized networks used for espionage and sabotage operations in Europe in the previous couple of years, most notably the one prosecuted in the UK in March 2025. As documented by Daniela Richterova, the construction in that case extra intently resembled an outsourced, multilayered mannequin, by which a “contract supervisor” — Jan Marsalek — delegated the event of operational plans to a delegated “nation supervisor,” who in flip entrusted additional duties to an in depth affiliate.
The “crimson palms” case demonstrates subsequently that conventional frameworks proceed to be employed in parallel with these extra decentralized buildings. The coexistence of those completely different fashions underscores the operational adaptability of Russian intelligence companies, which seem able to tailoring community buildings to the precise aims, contexts, and danger thresholds of a given mission.
Covert Motion by Dummies
Whereas Russian affect operations in Europe have grown extra clandestine in type over the previous couple of years, the “crimson palms” case reveals a persistent thread of operational recklessness and improvisation attribute of latest Russian covert actions. All through the trial, the three defendants adopted a posture of exaggerated incompetence, portraying themselves as unaware members and shifting all duty onto the lacking determine of Angelov. Their conduct at occasions recalled the staged absurdity of the Predominant Intelligence Directorate brokers concerned within the Skripal poisoning, who famously claimed in a tv interview to be vacationers visiting Salisbury Cathedral. As famous by David Père, lawyer for the Shoah Memorial throughout the trial, the defendants:
current themselves because the “reluctant members” in antisemitism — a pleasant Nazi who wears an Adolf Hitler T-shirt to sleep, an alcoholic videographer, a very useful vacation camp host … and this group exaggerates the bumbling, comedian facet of their escapade.
The restricted professionalism of the operation was additional uncovered by the amount of proof investigators have been capable of gather within the instant aftermath of the incident and the pace with which the suspects have been recognized. All members of the community operated underneath their actual names, utilizing private cell phones to journey and talk with each other. Whereas encrypted messaging apps have been used, this had little affect on investigative progress: After figuring out the perpetrators on surveillance footage, authorities traced them to a resort the place they’d left copies of their identification paperwork and geolocated their telephones throughout the operation.
This reliance on clandestine strategies displays a realistic adaptation by Russian intelligence to decreased operational entry and heightened safety, following the widespread expulsions of Russian intelligence officers after the Skripal poisoning in 2018 and the 2022 invasion of Ukraine — in addition to rising difficulties in securing accreditation for brand spanking new operatives in lots of European international locations. However quite than investing in additional superior covert capabilities, Russian companies seem to depend on minimalist operational cowl designed primarily to obscure direct attribution. The emphasis shouldn’t be on skilled secrecy within the classical sense, however on sustaining (im)believable deniability. Removed from undermining the seriousness of the operation, this obvious amateurism displays a recurring function of Russian covert motion in Europe: low value, low self-discipline operations designed for fast affect, the place strategic intent is cloaked in deniability and theatrical incompetence.
Recurring Patterns in Recruitment
The profiles of these concerned within the “crimson palms” case intently align with beforehand noticed patterns of recruitment in Russian-linked affect networks in Europe. As in different documented instances, recruitment seems to be formed by a mix of monetary vulnerability, ideological affinity, and private connections. Ivanov, recognized because the coordinator of the operation, displays this convergence. Born in Luhansk, Ukraine, he has a army background within the Bulgarian military, spent a number of years dwelling in Russia, and was affiliated for practically a decade with a Bulgarian nationalist occasion, suggesting a measure of ideological alignment with the Russian authorities. Filipov, though claiming to have renounced his earlier beliefs, bears tattoos depicting swastikas and Third Reich iconography, and was dwelling on the financial margins in Bulgaria, working low-wage jobs. Angelov, likewise, displayed Nazi tattoos, suggesting the same ideological profile.
These components are in keeping with a broader development by which Russian intelligence recruits operatives from environments the place materials precarity, private instability, and ideological extremism intersect. Ideological alignment, particularly with far-right or ultra-nationalist views, can function each a motivating issue and a device for fostering cohesion and loyalty inside loosely organized networks.
On the identical time, as a result of these people come from the social and financial margins, they normally have neither public visibility nor state safety, making it simpler for many who recruit them to ship them overseas for covert duties. This mix makes such people significantly helpful for low-cost and deniable operations, enabling Russian companies to deploy them with minimal funding — Filipov was reportedly paid $1,200 and Milushev $600 — whereas externalizing operational danger and decreasing the probability of direct attribution to the sponsoring service.
Russian Operatives Are Not For “Single-Use”
Recurring patterns in recruitment are more and more accompanied by an observable shift within the operational use of those people. The trial of the “crimson palms” challenges the broadly held assumption that Russian operatives are recruited for remoted, “single-use” operations. Filipov is implicated within the “coffins” case of June 2024, which concerned inserting coffins draped in French flags and painted in crimson to represent French blood within the struggle in Ukraine. Milushev can be suspected of having participated in two different operations: the defacement of Stepan Bandera’s grave in Munich shortly after the Paris incident and the distribution of pro-peace stickers associated to Ukraine in a Swiss municipality.
The profiles of the “crimson palms” defendants is subsequently illustrative of what appears an rising sample of repeated use of the identical operatives throughout a number of actions. This development is supported by latest findings from the Worldwide Centre for Counter-Terrorism, which challenges the concept of lone, expendable brokers recruited on-line for one-off missions. In keeping with their report, roughly 62 % of Russian-linked recruits have been concerned in multiple operation.
These instances level to a method of repeatedly deploying low degree operatives throughout low value, symbolically charged actions in a number of European international locations. This rising sample suggests a coordinated method geared toward maximizing visibility and disruption via a sequence of discrete acts carried out inside a brief timeframe. This will likely additionally replicate what is understood within the intelligence discipline as “operational testing,” by which recruited belongings are given duties — typically involving minor unlawful or borderline authorized acts — to evaluate their reliability, check, and situation them earlier than they’re probably deployed in additional advanced operations. Additional arrests and prosecutions will probably be essential to find out whether or not this displays a broader operational mannequin or an advert hoc adaptation to useful resource constraints.
Wartime Goals of Subversion
The “crimson palms” case shouldn’t be an remoted incident however a part of a broader marketing campaign of subversive acts linked to Russian intelligence in France over the past two years. Not less than ten related operations seemingly associated to Russian intelligence operations have occurred in France. Essentially the most notable embrace the portray of Stars of David on numerous buildings in October 2023 — attributed by French intelligence to the FSB’s Fifth Service, the defacement of the identical Shoah Memorial with inexperienced paint in Might 2025, and the position of pig heads exterior mosques in September 2025. These operations purposefully exploit historic and non secular symbols which are extremely delicate in France to impress outrage, polarize society, and erode public belief.
This rising sample displays a strategic shift in Russian intelligence priorities for the reason that full-scale invasion of Ukraine in 2022. Russian covert buildings have moved from focusing on political opponents to conducting sabotage and affect operations to form the data setting in help of wartime aims. These networks are actually instrumental in manipulating public notion, shaping narratives, and making use of strain on key European states. France, particularly, has turn out to be a main goal attributable to its vocal stance towards Russian aggression and its management function in pushing for European strategic autonomy and constructing the so-called Coalition of the Prepared. France can be perceived as susceptible, politically unstable and riven by sharp political and ethnic divisions. The “crimson palms” operation contributes to a broader effort to weaken home cohesion in France and undermine its affect inside the Western response to the Russo-Ukrainian Warfare.
However what unites these seemingly disconnected incidents shouldn’t be solely their symbolic focusing on or clandestine execution, however their systematic amplification via Russian-linked disinformation networks. In every case, the bodily act shouldn’t be an finish in itself however step one in a broader affect mechanism. These actions have been all quickly adopted by their amplification throughout social media and their insertion into Russian-linked disinformation networks comparable to Doppelgänger. The photographs of the “crimson palms” went viral on-line just a few hours after the act of vandalism itself, with the Russian ecosystem of pretend X accounts and coordinated bot networks injecting manipulated content material into public debate.
These operations exhibit that Russian intelligence companies make use of conventional covert buildings along with trendy instruments of digital affect. Whereas the actions themselves are sometimes low-cost and operationally crude, they’re designed from the outset for on-line amplification. Utilizing bot networks, inauthentic media retailers, and AI-generated content material, these small-scale disruptions are quickly remodeled into far-reaching affect campaigns. This method displays the evolution of Russian intelligence ways by which acts of vandalism serve primarily as triggers for bigger data operations.
In the end, these interference actions replicate the rising strategic weight Moscow locations on subverting public opinion in Europe within the context of struggle. These acts of subversion aren’t peripheral however intently linked to Russia’s broader struggle aims, unfolding in parallel with espionage and sabotage efforts. Collectively, they replicate a coherent doctrine of offensive motion rooted within the longstanding traditions of Russian intelligence. The “crimson palms” case subsequently stands as each a testomony to Russia’s tactical adaptability underneath constraint and a reminder that even seemingly newbie operations can contribute to an built-in technique to destabilize democratic societies from inside.
Clément Renault, Ph.D., is a senior analysis fellow in Intelligence, Warfare, and Technique on the French Institute for Strategic Analysis, Adjunct Professor at Sciences Po Paris College of Worldwide Affairs, and visiting fellow on the King’s Heart for the Research of Intelligence on the Division of Warfare Research, King’s Faculty London.
Picture: Midjourney
