Operation 'Red Hands' – how French authorities foiled Russian plot to destabilise the country

OnOn May 14th 2024 some 35 spray-painted red hand symbols were discovered on one of the exterior walls of the Mémorial de la Shoah, a museum in Paris commemorating the Holocaust. The graffiti was quickly condemned by politicians as an act of anti-Semitism.

But from the start there were suspicions that this vandalism was in fact part of a foreign-inspired destabilisation campaign.

Six months have now passed since those red hand prints were daubed on the Holocaust memorial. On November 20th 2024 an official from France's domestic intelligence agency, the DGSI, drafted a report identifying the mastermind behind an act which, according to the agency, sought to undermine the nation by destabilising public opinion. And for the DGSI, the identity of this mastermind was beyond doubt.

“The events observed on the night of May 14th 2024 in Paris were part of, both in their objectives and methods, the ongoing operations of Russian intelligence services in Europe,” the official wrote.

Until recently, the public authorities had been cautious about naming those responsible for the operation. How has it reached the point that they are now able to point the finger at Putin’s spies?

Alexandre is a 28-year-old security guard. On the night of May 13th he was doing his rounds as usual around the Mémorial de la Shoah in the 4th arrondissement of central Paris. At 3.58am he turned into Allée des Justes street. Two “hooded” men were in the process of defacing the Wall of the Righteous, a building listed as a historical monument. They fled after spotting Alexandre.

When officers from the central Paris police station arrived at the scene, they discovered 35 red handprints painted over the plaques bearing the names of the people who had saved Jews during the Nazi occupation of France in World War 2.

Two weeks earlier, students from Sciences Po university in Paris had displayed red handprints during pro-Palestinian demonstrations. This symbol had provoked sharp criticism, evoking as it does the lynching by an angry crowd of two Israeli military reservists in Ramallah in October 2000 at the start of the Second Intifada.

Since the bloody events of October 7th 2023 France has been deeply divided over the Israeli-Palestinian conflict, and the use of those same red handprints on the Holocaust Memorial was potentially explosive in nature. But this time the controversy did not take hold. In record time various state agencies determined that this act, which bore all the hallmarks of anti-Semitism, was in fact foreign interference and designed to stoke internal tensions within France. And Mediapart can reveal how an act of vandalism in a Parisian alleyway leads directly to the Kremlin.

Stars, hands and coffins

In their haste, the vandals left a stencil in front of the Wall of the Righteous that they had used to paint the red handprints. The police’s forensic unit was called and its experts arrived shortly before 5am. Unfortunately for the investigation, the stencil was waterlogged. It had rained continuously throughout that May night.

Then at dawn two officers from central Paris police station were invited by Alexandre’s superior into the technical room of the Memorial to view CCTV film of the scene.

The footage shows a “hooded” figure dressed in dark clothing placing a stencil against the wall, raising a spray can and covering the Wall of the Righteous in red paint, while an accomplice watches. A third man, dressed similarly, can be seen filming the scene with a mobile phone. The quality of the images did not allow for further identification, particularly of the three individuals' faces.

Later that morning, the same officers were alerted by colleagues to the discovery of 66 more red hand graffiti on the front of buildings in a second street, some 45 in a neighbouring street, and a further 35 in yet road. The red handprints appeared on schools and on quaysides; hundreds of them in all, across at least 28 locations in the 4th and 5th arrondissements of Paris.

Faced with what a senior police officer described as a “veritable raid lasting several hours, planned and organised to ensure maximum visibility for this evidently anti-Semitic act”, the Paris public prosecutor assigned police in the capital to investigative.

Although the cost of removing the stencilled graffiti amounted to “only” 2,000 euros - payment for the clean-up was immediately provided by the Paris city council - the symbolism of the act was far too powerful to ignore. Officers sifted through hundreds of hours of police CCTV footage, as had been done during the investigations following the January and November 2015 terror attacks in the capital.

The footage shows an initial individual at 3.52am climbing the pedestrian ramp from route Georges-Pompidou to the Quai de l’Hôtel-de-Ville, heading towards the Allée des Justes. He was followed two minutes later by two accomplices. As the first individual moves through various camera angles, officers noticed that he was carrying a black backpack and wearing glasses, which he adjusted on his nose. The footage shows him stepping into a building recess and disappearing from view. He remains still, keeping watch.

They tracked the other two men through the empty streets. One of them had his face covered by a surgical mask and wore red gloves, and the left leg of his trousers were torn. He approached the Wall of the Righteous holding a transparent stencil in his left hand. Then Alexandre, the security guard, caught them by surprise and briefly pursued the man with red gloves and his accomplice, who had previously been obscured by trees. As they fled, the lookout emerged from his hiding spot and filmed the Wall of the Righteous, now covered in red handprints, with his phone.

Once they had shaken off Alexandre, the other two men went along Rue de Rivoli, Rue Vieille-du-Temple, and Rue des Rosiers before crossing Place des Vosges. Along the way, they discarded their jackets. One of them even removed his trousers, revealing leggings and running shorts underneath. The jogger and his accomplice waited at a bus shelter at Bastille, where a white saloon car with a sun roof picked them up. Investigators from the security unit then tracked the vehicle through surveillance footage as it travelled to the 20th arrondissement, dropping the two men off outside an hotel.

A few minutes later, the two men, having changed clothes again, emerged from the hotel carrying suitcases and left in another private hire car. The vehicle disappeared from surveillance footage near the Bercy bus station in the city centre.

A senior officer from the police unit carrying out the investigating later noted in his report that these tactics “resembled the escape method used in similar recent graffiti cases involving individuals from Eastern European countries”.

On the evening of May 15th, three detectives visited the hotel in the 20th arrondissement. When shown enlarged copies of the surveillance photos the receptionist identified the men who had vandalised the Wall of the Righteous. They had spoken English and stayed in a room from May 11th to May 14th, leaving at dawn. One of them had provided an identity card under the name Mircho Angelov, and the booking had been made from Bulgaria by someone named Nicolay Ivanov.

The hotel was equipped with around thirty cameras, and the footage was stored on a server. Viewing the footage revealed the tattoos adorning the suspects’ necks, forearms, and legs. On two occasions, including May 14th, one of them returned from a night out with red stains on his hands.

Alongside these local enquiries, a judicial demand for information was sent to the FlixBus company, which confirmed that a person named Mircho Angelov travelled to Brussels on a coach departing at 6.35 am on May 14th. He was accompanied by men named as Kiril Milushev and Georgi Filipov. From Belgium, the three men flew to Bulgaria later that evening. As with the hotel booking, the plane tickets were reserved using the same email address attributed to Nikolay Ivanov. Approached through official international channels, the Bulgarian authorities confirmed all the suspects’ identities five days after the incident.

The initial investigation was now concluded. A full judicial inquiry was then launched by the Paris prosecutor’s office, which asked the Paris police crime squad and the DGSI to continue the probe. On June 5th, a meeting was held in the office of an investigating judge, with teams from both services present. The priority was now to arrest the perpetrators of the vandalism and, crucially, to identify the mastermind behind the operation.

The situation was urgent. On June 1st, just days after sharp criticism from the Kremlin over the deployment of French military instructors in Ukraine, individuals had stepped out of a white van and deposited five coffins filled with plaster at the foot of the Eiffel Tower. The coffins were draped in French flags, bearing the inscription “French soldier in Ukraine”.

The Paris police unit that had undertaken the first Holocaust Memorial probe was handed the initial investigation into this incident too. Surveillance footage from the Eiffel Tower and the police prefecture was scrutinised. On the recordings, officers observed a man getting out of the van and watching the operation from the Pont de l’Alma. The individual was quickly identified.

It was Georgi Filipov.

------------------------------------------------------------------------------

• The original French version of this story can be found here. This article is part of a series into the investigation surrounding the Russian destabilisation operation. The second article, in French, can be found here. The third part is here. 

English version by Michael Streeter