Operation 'Red Hands' in France: neo-Nazi agents provocateurs in the Kremlin's pay

TheThe plane bringing Georgi Filipov back to France landed at Roissy-Charles-de-Gaulle Airport at around 5pm on October 18th 2024. He was accompanied by three officers from the French prison service, who had travelled to Sofia to collect him after he was arrested by local police.

The 35-year-old Bulgarian was the subject of a European arrest warrant issued earlier in the summer. He is suspected of being a member of the group responsible for painting red handprints on the Holocaust memorial in Paris in May. One alleged accomplice was extradited to France two months earlier, and another followed four days later.

The three men, all Bulgarian nationals, have been placed under investigation for the damage or defacement of property perpetrated on grounds of race, ethnicity, nationality or religion, as well as for conspiracy to commit those offences. These crimes carry penalties of up to ten years in prison and a fine of 100,000 euros. All three benefit from a presumption of innocence.

Georgi Filipov is also suspected of taking part in the operation that involved placing coffins at the foot of the Eiffel Tower. However, at the time of writing, he has not been placed under investigation in connection with that propaganda stunt.

Neo-Nazis for peace

The trio have admitted their involvement but placed the blame on a fourth individual still at large, Mircho Angelov, who is alleged to have painted the red handprints. When the investigating magistrate asked one of the three, Kiril Milushev, why he filmed his compatriots doing the graffiti, he swore, hand on heart: “I don’t know. We'd been drinking, I didn’t think it was serious, I thought it was a joke.”

The third man, Nikolay Ivanov, who had financed the operation from a distance, claimed he believed he was funding his friend Mircho as part of a “peace action”. Regarding Angelov, he stated: “He was very emotional; he told me it was because of the genocide in Palestine [...] he wanted to show his opposition.” Georgi Filipov echoed this sentiment, saying: “It was to stop the war between Israel and Palestine.”

These explanations have failed to convince the investigating judge. Police officers who reviewed the surveillance footage from the hotel used as the group’s hideout noted tattoos that suggested a strong affinity for Nazi ideology. Mircho Angelov – the man who is still at large - was seen wandering the hotel corridors in shorts, displayed the numbers “14” and “88” tattooed on his calves.

These tattoos are common among neo-Nazis worldwide. The number “14” refers to the 14 words: “We must secure the existence of our people and a future for white children.” This is a phrase coined by American white supremacist writer David Lane. The number “88” represents the eighth letter of the alphabet (“h”) repeated twice, forming the coded message “Heil Hitler”.

Via Mircho Angelov’s Facebook account, police learnt of other tattoos he has. Among his posts, they found a totenkopf - the emblem of a Waffen-SS division tasked with guarding Nazi concentration and extermination camps - and a black sun, a symbol popular among neo-Nazi movements, and which has mystical and esoteric undertones. The black sun featured prominently on the cover of the manifesto by Brenton Tarrant, the Australian terrorist responsible for the Christchurch mosque shootings in New Zealand in which he murdered 51 people.

On his own Facebook page, Georgi Filipov makes no attempt to hide his ideology either. He can be seen proudly performing a Nazi salute in a park and laughing while wearing a tee-shirt emblazoned with a portrait of Adolf Hitler and the phrase “He was right”. Upon his forced return to France and placement in detention, his lawyer, Martin Vettes, requested that the investigating magistrate place Filipov in isolation “in view of the tattoos” that cover his body.

In the opinion of the DGSI, these Bulgarian neo-Nazis were not painting red handprints on the Holocaust memorial in the name of world peace but were instead acting as agents provocateurs. In the realm of espionage, an agent provocateur is one deployed to infiltrate a specific environment and cause disruption. More precisely, they are considered “proxies” - individuals tasked by intermediaries to carry out missions on behalf of an intelligence service without exposing that service.

In a report dated July 16th 2024, the French counterintelligence agency noted that “Russian intelligence services have always relied on this method of operation, which has, however, intensified” in recent months. This was due to the weakening of their capabilities since the beginning of the war in Ukraine.

Western countries have carried out a coordinated wave of expulsions of Russian spies operating under diplomatic cover - 452 worldwide, including 41 in France alone. In parallel, 1,950 individuals or entities involved in compromising actions against Ukraine have faced travel bans and had their assets frozen. Finally, 200 visa applications submitted by Russian diplomats - who were in fact known members of intelligence services - intended for postings within the European Union have been denied.

As a result, to circumvent these obstructive measures, Russian intelligence services have, according to the DGSI, “increasingly relied on proxy networks to support and continue their clandestine activities in Europe”. And, whatever they may claim, Georgi Filipov and his associates fit the profile.

On November 7th last year, the DGSI received “intelligence” as a result of “international cooperation” - meaning it came from one or more foreign intelligence services - regarding individuals involved in Operation 'Red Hands'. Specifically, this included information on the Bulgarian financier Nikolay Ivanov. Currently without a job, this man in his 40s is said at one period to have spent many years in the Russian Federation and is described as holding “resolutely pro-Russian” views.

He is in contact with Mania Vasilievna Koleda - a Russian woman arrested in 2014 by the Ukrainian security services on suspicion of espionage - as well as Igor Zorin, an Afghanistan veteran and former senior officer in the GRU, Russia’s military intelligence agency. When questioned by the investigating judge, Ivanov described himself simply as a Bulgarian politician responsible for green spaces in the city of Blagoevgrad in south-west Bulgaria.

As for Georgi Filipov, he claims to be a photographer while also working in construction. He says he lives on the outskirts of Sofia, yet his Facebook account states he resides in Helsinki in Finland. He has also lived in Germany and the Netherlands but is unable to provide a clear timeline of where he has lived or even name a single employer.

At one point allegedly a croupier, Kiril Milushev reportedly lives with his mother and spends his time keeping fit and rapping. However, when asked to clarify, his responses have been even less coherent than Filipov’s. “I have a drinking problem; I don’t remember the details clearly,” he said. He then added: “I’m not going to tell you about things that happened long ago because I’m on too much medication - how do you expect me to know?”. He also told the investigating judge: “I’m impressionable; I’m a shy person!”

The foreign intelligence service providing information to the DGSI appears to have had much more detailed information on the men. According to the details shared, it was Mircho Angelov who introduced Nikolay Ivanov to his friend Kiril Milushev in April 2024. Nikolay Ivanov had a job to offer them. The task involved placing 1,000 stickers calling for an end to the war in Ukraine in various public spaces across Paris. The operation went off without a hitch. A second mission followed in mid-May. This time, Milushev was instructed to photograph the red hands that Georgi Filipov and Mircho Angelov would paint on the Holocaust memorial.

No sooner had they returned to Bulgaria than Angelov and Milushev set off again, this time to Germany, where they desecrated and filmed the defacement of the tombstone of the controversial Ukrainian politician Stepan Bandera in Munich. Bandera is viewed both as a hero fighting for Ukrainian independence against the Soviet Union and as a collaborator with Nazi Germany.

In mid-June, Milushev was dispatched to Zurich in Switzerland to place stickers near specific hotels. For unknown reasons, the operation went wrong, and Nikolay Ivanov had to join him to ensure the task was completed within the set timeframe. At that moment, a peace conference on Ukraine involving around 90 nations was taking place near Zurich. Meanwhile, Mircho Angelov, aware that he was being sought, was reportedly exfiltrated to the safety of a Serbian city.

'Not entirely legal work'

Georgi Filipov was not involved in these later events. At the beginning of June he was again spotted in Paris, overseeing a team depositing coffins bearing the inscription 'French soldier in Ukraine' at the foot of the Eiffel Tower.

The driver of the van transporting the coffins was promptly apprehended. After initially claiming he had come to France to buy furniture, Lazar Lakov, another Bulgarian, later confessed. He revealed that he had been recruited a few weeks earlier in Sofia by Georgi Filipov, who offered him “not entirely legal work, in a grey area”. For his role, he was paid the equivalent of 1,000 euros via bank transfers sent by none other than Nikolay Ivanov, the treasurer of Operation 'Red Hands'. Both Georgi Filipov and Kiril Milushev also mentioned receiving 1,000 euros each for their involvement in the operations.

After the coffins had been collected from a Bulgarian funeral services company, Lazar Lakov and Georgi Filipov drove their van across Romania, Hungary, Austria and Germany. Throughout the journey, Filipov remained in contact with their “employers”. When they ran out of money, Nikolay Ivanov transferred them several hundred euros. Upon arriving in Paris, they purchased plaster to weigh down the coffins, and an accomplice handed them five tricolour flags. Then, in torrential rain, they did a recce of the area on foot.

It was while they were doing this that a police van passed by, with an officer inside holding a phone. “I assumed that this policeman had photographed us and that we had been spotted,” Lazar Lakov later explained. “Our bosses asked us to prove the presence of the police by taking photographs.”

Georgi Filipov argued over the phone with their boss - Mircho Angelov - who shouted that they absolutely had to see the project through. “He told us that if we didn’t do it, our heads would roll as well as those of our loved ones,” Lakov confirmed. Their bosses promised that, in the event of arrest, they would “cover all expenses”.

Tracing 'The Navigator'

In a July 2024 briefing note, the DGSI set out the destabilisation operations orchestrated by Russia and their highly hierarchical organisation. “At the top is a Russian intelligence officer based in Russia. This employer, in turn, uses an intermediary, typically located in former Soviet satellite states or countries from the former Eastern Bloc,” it stated.

Regarding the wave of vandalism operations that had struck France and Europe, the DGSI stated in a November report that the primary organisers were Bulgarians Nikolay Ivanov and Mircho Angelov. Treasurer Ivanov was believed to “occupy a higher hierarchical level” than Angelov. Both men were accountable to their real employers. They received instructions in Russian via the encrypted messaging app Telegram, notably from an individual who remains unidentified but who is listed in a conversation under the pseudonym “The Navigator”.

“The intermediary then remotely and digitally contacts often vulnerable Russian-speaking individuals, proxies in the making. [This intermediary] coordinates the organisation of these campaigns. They activate each cell or individual independently,” the report stated. In this case it was Mircho Angelov who was the “coordinator”, according to one of the proxies. “I’m 100% sure of it. From what I’ve seen and heard, he oversees several such missions in other countries,” this proxy told French police during questioning.

And when the pressure in the target countries became too intense - “They knew that the French police were after them and that their phones were being monitored because the police managed to locate the hotel where they were staying” the same footsoldier revealed about the 'Red Hands' operation - they gave Georgi Filipov the role of recruiter for the 'Coffins' operation.

A Telegram channel is created for each mission. The agents provocateurs receive highly specific instructions on the targets for their acts of vandalism. “They're able to tell us which shop to go to for supplies or even where to park,” recounted the same proxy. Once the mission has been completed, the messages and the Telegram account are deleted.

“This compartmentalised organisation ensures a certain level of operational security and makes the connection between Russia and the operatives particularly difficult to establish,” the DGSI noted with regret in one of its notes. However, this did not prevent French domestic intelligence from concluding in the same document that “based on the evidence collected so far” the 'Red Hands' operation was a “destabilisation campaign against France orchestrated by Russian intelligence services, an action that formed part of a broader strategy aimed at spreading misinformation, and also at dividing French public opinion and stoking internal tensions”.

Beyond the operational methods, what reveals the hand of Vladimir Putin’s Russia is the second phase of the operation, which serves its real purpose. The acts of vandalism alone are not enough. The impact has to be increased by manipulating public opinion and spreading disinformation. This is why every operation includes the taking of photographs and videos, which are later disseminated within articles highlighting these stunts on fake news sites. The problem here is that this aspect of the operation can be traced.

---------------------------------------------------------------------------------

• The original French version of this article can be found here. The first part of this investigation can be found here in English. The third part is here. 

English version by Michael Streeter