The Red Hands of the Kremlin
Why did a group of Bulgarians with far-right connections travel to Paris to vandalize a Holocaust memorial?
It was still dark when two men dressed in dark clothes approached the memorial Mur des Justes, a monument listing more than 3,900 names of people who, during the Second World War, helped save French Jews from the Nazi killing machine.
In the shadows of a nearby building stood a third man, filming the act of vandalism. Red hands were painted on the wall beneath the name plaques. Then the three men fled, with a security guard in pursuit.
It was in the middle of May 2024.
The red hand is a symbol that has sometimes been used in protests against the war in Gaza. It is also a symbol with problematic connotations. For some, it brings to mind al-Farhud, the murderous anti-Jewish pogrom in Baghdad in June 1941. In the lead-up to the violence, red hand symbols had been painted on Jewish homes. For others, it recalls a well-known photograph of a Palestinian who, during the Second Intifada in October 2000, displayed his blood-stained hands to a cheering crowd in Ramallah; he had taken part in the brutal lynching of two Israelis.
Only two weeks before the vandalism at the Mur des Justes, the use of red hands as a symbol at a pro-Palestinian demonstration at Sciences Po had provoked strong reactions. Vandals opting for the same symbol therefore hardly seemed accidental, and the Jewish student union in France soon described the vandalism as “support for massacres of Jews.” The French president condemned it as “stinking antisemitism.” Paris mayor Anne Hidalgo stated that nothing could excuse the vandalism, which dishonoured the memory both of Holocaust victims and of those who saved Jews despite the risk to their own lives.
And this is, in a sense, a story about antisemitism; one example among many antisemitic incidents in France in recent years, sometimes linked to or motivated by the horrific war in Gaza. But it is also another story: a story about an attempt to fan the embers of hatred.
It quickly turned out that red hands had also been painted in a number of other places in Paris. Altogether there were hundreds of them. Someone wanted to make sure this action received attention.
The very scale of the vandalism also meant that French police had large amounts of surveillance footage to review. They were able to follow two of the perpetrators back to a hotel in the French capital´s 20th arrondissement. They could see how the same two men left the hotel again only a few minutes later, having changed clothes.
When police visited the hotel, staff helped identify the men, who had stayed there for several days. One of them had presented an ID card with the name Mircho Angelov. The hotel room had been paid for by another Bulgarian, called Nikolai Ivanov. Further investigation showed that Angelov had left Paris the morning after the vandalism against the Holocaust memorial, taking a bus to Brussels. Two more compatriots travelled with him: Georgi Filipov and Kiril Milushev.
Angelov remains at large, but Filipov, Milushev, and Ivanov were eventually arrested in Bulgaria. The latter had not taken part in the action itself but had contributed financially.
During questioning, he claimed he had believed he was financing a “peace action” organised by Angelov: “He was very emotional; he told me that it was because of the genocide in Palestine […] that he wanted to show resistance,” Ivanov said. Filipov had a similar message: “It was to stop the war between Israel and Palestine.”
A lengthy article by Matthieu Suc in the French outlet Mediapart in January 2025 reveals why that explanation is difficult to believe. On surveillance images from the hotel in the 20th arrondissement, Angelov could be seen walking around the corridors wearing shorts. On the backs of his calves two numbers were clearly visible: “14” and “88.”
These numbers are well-known codes in neo-Nazi circles: H is the eighth letter of the alphabet, and 88 stands for HH or “Heil Hitler.” Fourteen is a reference to the so-called “Fourteen Words,” a slogan created by the American far-right extremist and terrorist David Lane: “We must secure the existence of our people and a future for white children.”
French police found more on social media. There they discovered that Angelov — who otherwise presents himself as a supporter of the misogynistic influencer Andrew Tate — also has a tattoo of a Totenkopf, the Nazi SS skull symbol. Another tattoo depicts a “Black Sun,” a more obscure symbol that in recent years has appeared, among other places, in connection with terrorist attacks carried out by far-right accelerationists.
And it does not stop there.
Mediapart has published a series of articles on what they have called Operation Red Hands. The article series is worth reading in its entirety, and is available in English here:
Operation Red Hands: How French authorities foiled Russian plot to destabilise the country
Operation ‘Red Hands’ in France: neo-Nazi agents provocateurs in the Kremlin’s pay
Operation ‘Red Hands’: how French analysts unearthed the involvement of Kremlin bots
The Bulgarian online newspaper Boulevard Bulgaria reports that Angelov, a former kickboxer and mountaineer from Blagoevgrad in the country’s southwest has had links to the far-right group National Resistance (Национална съпротива). In videos on social media, Angelov appears together with another local far-right extremist, Nikolai Jovev.
They demonstrate fighting techniques and mock homosexuals, migrants, and the COVID-19 vaccine.
Georgi Filipov also made no attempt at hiding his ideology on social media. In one picture he can be seen giving a Nazi salute in a park, wearing a T-shirt with a picture of Adolf Hitler and the text “He was right.” He too had tattoos with clearly far-right symbolism.
Why did the three men really travel to Paris? What was the motive for the antisemitic vandalism? Before we zoom in on the man who bought the plane tickets, Ivanov, it may be worth saying a little more about Angelov.
His name has not only surfaced in France but also in Moldova, where authorities have linked him to coordinated sabotage against several ATMs in the capital, Chișinău. An investigation conducted by the Moldovan outlet CU SENS in cooperation with the Balkan Investigative Reporting Network and Boulevard Bulgaria also connects Angelov to a paramilitary training camp in Republika Srpska (part of Bosnia-Herzegovina), where he is said to have served as an instructor for a group of Moldovans trained in the use of weapons and in operating drones carrying explosives.
Angelov and Milushev have also been linked to vandalism in Munich directed at the gravestone of the highly controversial Ukrainian nationalist leader Stepan Bandera (1909–1959), who is regarded by some as a hero who fought for Ukrainian independence from the Soviet Union, but who also cooperated with Nazi Germany during parts of WWII.
The plot thickens, as they say. And this is where Ivanov becomes an interesting figure. He was born in Donbas in eastern Ukraine during the Soviet era, has Russian roots, and has himself lived in Russia. According to Boulevard Bulgaria, he also has a past in VMRO, a Bulgarian far-right party that takes its name from a revolutionary Bulgarian nationalist group in the old Ottoman Empire and which is known for anti-Islamic and anti-Roma attitudes.
Later he was involved in a more marginal ultranationalist group, Reborn Bulgaria – Bulgarian National Unity (Възродена България – Българско Народно Единение).
Ivanov also played a role in a “Bulgarian people’s militia” named after the national hero Vasil Levski, in reality a group heavily marked by ultranationalism and by a deeply conspiratorial worldview, including ideas reminiscent of American sovereign citizens and German Reichsbürger. This “people’s militia” attracted attention in 2016 when a former leading figure in the German anti-Islam movement Pegida, Tatjana Festerling, patrolled with them along the Turkish-Bulgarian border.
They attracted attention again in 2019 when Bellingcat highlighted their connections both to far-right activists in other countries and to links with Russia.
And it is precisely links to Russia French authorities see as central. Mediapart reports:
Regarding the wave of vandalism that had struck France and Europe, the French intelligence service DGSI stated in a report in November that the key organisers were Nikolai Ivanov and Mirtsjo Angelov. The treasurer Ivanov was considered to “hold a higher position in the hierarchy” than Angelov. Both were responsible to the real sponsors. They received instructions in Russian via the encrypted messaging app Telegram, particularly from a person who remains unidentified but who in one conversation appears under the pseudonym “The Navigator.”
The DGSI concluded that the entire episode was part of an attempt to destabilise France, that Russian intelligence was behind it, and that it also forms part of a broader strategy involving both disinformation and attempts to exploit existing fault lines in French society.
At the end of October 2025, Filipov, Milushev, and Ivanov stood trial in Paris. Angelov was also charged, although he remains at large. “We are not fooled; we know where this comes from,” said the prosecutor in the case, Camille Poch, although she dryly added that they were not “the world’s best Russian spies.”
In court it emerged that Ivanov had previously been in regular contact with what was described as “a former high-ranking member of the Russian intelligence services.” As Politico reports, the DGSI also described the affair as an example of how individuals are hired and paid to “carry out a mission on behalf of an intelligence service,” while remaining unaware of who ultimately stands behind it:
The hiring of these proxies takes place within a specific hierarchy, with an intelligence officer at the top, with an intermediary usually based in a satellite country, himself in touch with Russian speaking individuals hired via social media and Telegram for paid missions.
In court both Filipov and Milushev admitted taking part in the vandalism. Ivanov admitted buying plane tickets and arranging the hotel. At the same time, all tried to downplay their own roles. Milushev — who filmed the vandalism — more or less claimed he had been tricked into the whole thing while drunk.
Filipov said he had taken part for payment because he needed money to pay child support. Toward the end of the trial he broke down in tears while telling the court that his son had seen him described as a Russian spy on Bulgarian television: “He said he was ashamed of me. I am ashamed too.” He explained his neo-Nazi tattoos as the result of youthful mistakes after, following a childhood marked by violence, he had joined a Bulgarian nationalist group in the 1990s.
Ivanov, for his part, denied holding pro-Russian views and claimed to be a “humanist” and “pacifist” who had merely helped friends.
It did not help. All three were sentenced to prison terms and banned from France for life. Angelov was convicted in absentia.
The story is not unique. Several other episodes resemble it. Late in September this year, 11 Serbian citizens were arrested in their home country. They are suspected of being behind several acts of vandalism against synagogues in Paris and also of leaving severed pig heads outside mosques in the city. They are also suspected of having carried out similar acts in Germany.
The Serbian news site Blic also writes about a twelfth suspect, identified in the media only as M.G. This M.G. — who remains at large — is said to have organised the group following instructions from a foreign intelligence service.
It was the pig heads that exposed the Serbs. They had wrapped them in cellophane with decorative ribbon, with the greeting “bon appetit.” On several of the heads the surname of the French president, Emmanuel Macron, had also been written in blue marker. News of the apparently anti-Muslim actions spread quickly, including to a farmer in Normandy. He became suspicious. Recently two foreigners — they spoke neither French nor good English — had visited him and bought ten pig heads, simply tossing them into the trunk.
He had also noticed they were driving a Serbian-registered car. “It was so strange that I took a picture,” he later said in a TV interview.
When he heard about the pig heads in Paris, he contacted the police. That is how investigators picked up the trail.
Other incidents also resemble this pattern:
Four Moldovan men are accused of carrying out a graffiti action in which images of coffins and the text “Soldat français en Ukraine” (“French soldier in Ukraine”) were painted in various places in Paris. One of them, Alexandr Grigorenco, a supporter of the pro-Russian ȘOR party — is suspected of being the organiser.
In an earlier incident, four actual coffins draped with the French flag and the same text were left near the Eiffel Tower; the Bulgarian driver who had transported the coffins there was quickly arrested and eventually admitted his role. He claimed he had been recruited by the previously mentioned Filipov and had received payment from Nikolai Ivanov. A German and a Ukrainian citizen also took part in that action, according to Le Monde.
A Moldovan couple admitted carrying out a graffiti action in which 150 blue Stars of David were painted in various places in Paris after the Hamas attack in Israel on 7 October 2023. They were followed by a photographer tasked with taking pictures of the graffiti, images that were quickly spread through bot networks on social media.
After trying to volunteer to fight on the Russian side in the war against Ukraine, a young British petty criminal and drug dealer — Dylan Earl — was instead used to recruit others to burn down a Ukrainian-owned warehouse in London. He is also said to have planned the kidnapping of a Russian businessman in exile. Six men were convicted in the case, which judge Bobbie Cheema-Grubb described as a “planned terror and sabotage campaign” serving Russian interests.
A Colombian citizen was in June sentenced to a lengthy prison term for arson targeting three buses in the Czech Republic; Czech authorities suspect Russian intelligence of being behind it.
In 2024, seven people were convicted in Estonia for vandalism against cars belonging to a minister and a journalist, as well as against two memorials. Estonian prosecutors pointed out that one of those convicted had recruited the others at the request of Russian authorities. Two additional suspects believed to have participated likely fled to Russia.
In a report by GLOBSEC and the International Centre for Counter-Terrorism from September 2025, no fewer than 110 similar incidents — both minor and more serious — in various European countries since 2022 are identified. The perpetrators are often relatively young men with criminal backgrounds. Many come from countries that were once part of the Soviet Union. Sometimes they are recruited through platforms such as Telegram. In other cases recruitment has occurred through personal acquaintances and friendships offline.
For many of them, money appears to be the primary motivation, although some are also ideologically motivated.
And as Triinu Olev-Aas of the Estonian prosecution service pointed out in a statement related to the last example mentioned in the list: not all of the perpetrators were aware of the actual objective of the crime.
Russia of course dismisses all these accusations as “Russophobia.” At the same time, incidents like these — antisemitic vandalism, pig heads outside mosques, arson — or simply the outrage they provoke are extensively used in Russian propaganda. As Mediapart points out, it resembles an old KGB method: aktivnye meropriyatiya — active measures.
They write:
The most infamous of these earned the nickname of “swastika epidemic”. Between 1959 and 1960 the KGB orchestrated a covert campaign of anti-Semitic slogans and swastika graffiti in the Federal Republic of Germany and other Western countries. This took place alongside a genuine surge in global anti-Semitic acts following the desecration of Cologne’s synagogue at Christmas in 1959.
Were the perpetrators behind the vandalism at the Mur des Justes motivated by antisemitism? They themselves deny it. Their links to Bulgarian far-right extremism could be said to tell another story.
But that may not be the most important one.
Notes on the Antiliberal is written by Norwegian journalist Øyvind Strømmen. It will include articles on the radical right, extremism, conspiracy theories and other challenges to liberal democracy. This article from November 2025 is available in the original Norwegian at oyvindstrommen.substack.com.