To the pig farmer in Normandy in northern France, something about the transaction seemed off. The two men had an unusual order: 10 pigs’ heads, which they loaded straight into the trunk of their car without any concern for refrigeration.
“They were two foreigners, they didn’t speak French. They spoke English badly,” the farmer told French television shortly after the incident on September 8th. “I noticed their car was Serbian. The transaction was so unusual, I took a photo of it.”
The following morning, worshippers heading in for dawn prayers at the Javel mosque in Paris were horrified to discover a bloody pig’s head dumped on the doorstep.
At least nine pigs heads were discovered outside mosques around Paris that morning – a deeply offensive and provocative act, as Islam deems the animals impure. It made the French news.
RM Block
In Normandy, the farmer saw the headlines, and called the police.
That was how French investigators were able to quickly zero in on suspects for the hate crime and label it a deliberate attempt to stir ethnic tensions in France, orchestrated by Russian intelligence.
Provocative stunts targeting Jewish and Muslim communities are among a range of incidents – ranging from the bizarre to the potentially lethal – that police investigations have tracked back to Russia.
They span graffiti campaigns in Paris; the burning of a Warsaw shopping centre and a warehouse in London; exploding parcels in Leipzig and Birmingham; the sabotage of railway lines in Germany; cyberattacks and doctored viral videos across Europe; to the recent disruption of airports with drones in Norway, Denmark and Munich.
As their frequency has multiplied in recent years, European police, governments, and intelligence services have begun openly sharing the evidence they find to suggest the incidents are part of a Russian “hybrid war”: an attempt to foster instability and division in European societies, while burdening and distracting governments that are supportive of Ukraine.
The aim is “to disrupt the unity of Western states and sow discord among the citizens of European countries,” reads a report on the issue by the Czech intelligence service.
“The psychological effect of their actions is particularly crucial. This is the weakening of the cohesion of western society, the instillation of fear and uncertainty, the undermining of trust in one’s own state that it can protect its citizens, and the aforementioned pressure to limit support for Ukraine.”
Anti-Semitic stunts
In the case of the pigs’ heads, the plot unravelled quickly. The photo taken by the suspicious farmer offered a registration plate. CCTV around Paris confirmed the same car visited the mosques. A mobile phone used by a passenger was detected crossing out of France into Belgium shortly afterwards.
It took Serbian police less than three weeks to make their arrests, swooping up 11 people in late September on suspicion of carrying out the pigs’ heads incident as well as the defacement of France’s Holocaust Museum, throwing green paint on synagogues, and an incident at the Brandenburg Gate in Berlin.
“Acting on the instructions of a foreign intelligence service,” the ringleader had recruited and instructed the group to “incite hatred, discrimination and violence” in Germany and France, the Serbian interior ministry said in a statement.
It was part of a pattern. Four Bulgarians are shortly due to face trial in France for painting red handprints on the Paris Holocaust memorial in 2024, before they immediately left on a coach to Belgium. A group of Moldovan men are to go on trial in February for being paid €100 to stencil images of coffins with the text “French soldiers in Ukraine” close to prominent news outlets in Paris.
Images of the coffin graffiti were quickly shared online by a network of 43 Facebook accounts and 85 pages identified by parent company Meta as a confected effort to “undermine Ukraine” by “amplifying real-world stunts in France, Germany and Poland”.
A Moldovan couple admitted to having been paid to stencil about 150 blue stars of David on property around Paris a few weeks after the October 7th attack on Israel in 2023, something that caused a political outcry in France as it was initially presumed to be anti-Semitic.
According to a Le Monde investigation, the couple were accompanied by a photographer whose job was to immediately upload photos of the graffiti online. A network of 1,095 bots on social media site X then posted more than 2,500 messages about the stars of David, according to the French foreign ministry.
The ministry issued a statement condemning the involvement of a “Russian network” known as Recent Reliable News or Doppelganger for “the artificial spreading and initial distribution on social media of photos of graffiti representing Stars of David”.
“This new Russian digital interference operation against France testifies to the persistence of an opportunist and irresponsible strategy aimed at exploiting international crises in order to spread confusion and create tensions in the public debate in France and Europe,” the ministry said.
The best spy you have ever seen
“Hello friend,” read the message from an account named Privet Bot over messaging app Telegram.
“We need people that you have across Europe and the UK. We need those who are our kindred spirit,” Privet Bot wrote. “Do you have any friends among hooligans or acquaintances in the IRA?”
The recipient of the messages was Dylan Earl, then aged 20, a baby-faced small-time drug dealer from Leicestershire.
The message had come not long after he contacted a pro-Russian Telegram account about the possibility of going to fight for Russia in Ukraine, saying he needed “a fresh start”. “Do I need to speak Russian though?” he had asked.
Earl would end up being convicted of organising the arson of a warehouse in London used by two Ukrainian companies to send supplies to their embattled country, in a fire that destroyed equipment for the Starlink satellites used for communications by the Ukrainian army.
The police search of his phone – a trawl of 5,702 messages and 51,528 images, according to detectives – revealed Telegram chat logs that were subsequently released as part of court documents.
Two accounts Earl was chatting with, Privet Bot and Lucky Strike, were run by “the Wagner Group, a private military organisation that acts on behalf of the Russian state”, according to a statement by the British police.
Earl ended up recruiting a chain of young men with offers of payment. Three of them burned down the warehouse under his instruction, one livestreaming to Earl over FaceTime as two others poured petrol along its doorway and set it alight.
Earl then began recruiting people to burn down the premises of an exiled Russian businessman in Mayfair, who, Earl told a friend, might be kidnapped.
“I can be the best spy you have ever seen,” Earl promised Privet Bot.
The following day, counter-terrorism police arrested him in a car park of B&Q.
“This case is clear example of an organisation linked to the Russian state using ‘proxies’ – in this case British men – to carry out very serious criminal activity in this country on their behalf,” the head of Britain’s counter terrorism command, Dominic Murphy, said in a statement after Earl was convicted along with four others.
“The ringleaders ... willingly acted as hostile agents on behalf of the Russian state,” Murphy said. “Seemingly motivated by the promise of money, they were prepared to commit criminal acts on behalf of Russia.”
‘Disposable agents’
Cases across Europe show a similar modus operandi: small-time criminals or ordinary people in need of cash recruited for “gig economy” freelance work as Russian agents over social media.
In June this year, a Colombian citizen was sentenced to eight years in prison for starting a fire in a bus depot in Prague, recording the blaze and then leaving the scene. The court found he had been offered $3,000 (€2,600) to do so over Telegram.
Poland’s Internal Security Agency said the 27-year-old was also responsible for arson attacks on two construction supply depots in Poland.
“He was trained by a person connected to Russian intelligence services ... They taught him how to prepare incendiary materials, Molotov cocktails, and how to document these arson attacks,” a spokesman for the Polish agency told a press conference.
The trial of a Ukrainian man in Poland found he had acted under instruction from Russian intelligence services over Telegram when he bought flammable materials used to burn down Warsaw’s largest shopping centre, Marywilska 44, last year.
In July 2024, parcels sent through delivery services DHL and DPD ignited en route, starting fires in Leipzig airport and at a warehouse in Birmingham. Lithuanian prosecutors have charged 15 people in connection with the incident, which they said was organised by Russian citizens tied to Russian intelligence who recruited people over Telegram and paid them in cryptocurrency.
Last year, an Estonian court convicted nine people for vandalising the cars of prominent people and defacing historical monuments. The organiser had recruited the others “at the request and under the instruction” of Russian military intelligence, the prosecution service said in a statement.
“Not all of the participants knew the actual purpose of the criminal offence,” the statement said, calling on the public to notify “similar job offers” to the police.
[ Distance no protection from Russian aggression, Latvian politician warns IrelandOpens in new window ]
In May this year, Germany’s intelligence service warned of the use of “disposable agents” – people recruited over Telegram or other social media and asked to perform tasks in exchange for a fee. The initial jobs offered can seem innocuous, like transporting people or goods, or taking photographs of particular locations.
“These people are recruited from members of organised crime groups with ties to Russia and countries close to it, or on the Internet through advertisements offering easy money for unspecified work,” a report by the Czech intelligence service said in July.
“The ‘Telegram agent’ in question may not even be aware that he or she is working for Russia.”
Police crackdowns on such agents appear to be intensifying. This week, the Polish government announced that eight people had been arrested across the country for acts including reconnaissance of military facilities and critical infrastructure, and planned sabotage.
[ We should all be worried by deep fake technologyOpens in new window ]
“This is being ordered by Russian intelligence,” minister Tomasz Siemoniak told Polish television. He described those taking part as “one-time agents”.
“They take on various tasks for relatively small sums,” he said. “Perpetrators often don’t know the name of the person who commissioned them.”
Dr Chaos
Moscow routinely denies involvement with any such incidents, often saying such accusations are “Russophobic”.
“As a rule, all these suspicions are groundless and not backed up with any evidence,” Kremlin spokesman Dmitry Peskov said after being asked about a series of arson attacks on properties connected to British prime minister Keir Starmer this year.
“London tends to suspect Russia of all the bad things happening in Great Britain.”
The long chain of recruitment separating those paying for the attacks and the sometimes unwitting perpetrators can make attribution difficult. This is deliberate, according to those who study Russian warfare.
“By doing this, you avoid direct accusations. You say: no, no, it’s not us. Hybrid attacks are perfect for this,” Christo Atanasov Kostov, an adjunct professor at IE University currently conducting research into Russian-backed disinformation in eastern Europe.
The fear and uncertainty such attacks can produce, with people divided about whether or not Russia could be responsible, is also the point, analysts say.
“They are signalling clearly to governments that this is a Russian capability that the Kremlin is willing to use,” said Stefan Wolff, professor of international security at the University of Birmingham.
“But at the public level, there’s enough doubt that pro-Russian actors can say: look at our governments, they are incapable of protecting us properly, they are just needlessly blaming the Russians.”
Back home in Russia, news of arson, rioting or chaos at airports is used in propaganda as evidence of the dysfunction of western societies, according to Kostov.
Meanwhile, each incident gathers useful data for Russia. Drone or aircraft incursions test out what European systems can detect, and how quickly a response can be co-ordinated. Hate crimes probe societal sore points. Disinformation is a constant process of trial-and-error to figure out the best topics to foster division.
“They want to destabilise Europe, and also they want to decrease the support for Ukraine,” Kostov said.
“They hope that pro-Ukrainian parties will lose elections and that new governments will stop the support eventually for Ukraine. And as you see, they’re partly successful.”
The broader picture, analysts and intelligence agencies say, is that Russia is attempting to reclaim what it considers to be its legitimate “sphere of influence” and great power status. It sees moves by countries such as Ukraine and Moldova to join the European Union or ally with Nato as a threat.
The Valdai Discussion Club, a think tank with close ties to the Russian government that hosts a talk by president Vladimir Putin each year, recently released its annual report, called Dr. Chaos or: How to Stop Worrying and Love the Disorder.
The report writes that wars may now have a “changing purpose”, which is “maintaining a balance” with other powers – constant disorder, instead of outright victory.
“Russia, it’s a really big country, but if you look at the population and the size of the economy, I think they do realise that they cannot ‘win’ in a more traditional sense of winning,” said Wolff.
“So all they need to do is have this permanent state of uncertainty and volatility. For that, they have enough capability.”
