On May 16th 2024 there was a highly-charged mood in the west Paris building that houses the offices of VIGINUM, the French agency charged with monitoring foreign digital interference in France. It was two days after red hands had been painted on the Holocaust memorial in Paris, and analysts had just found an article from a purported French media outlet named “Artichoc”. The recent anti-Semitic vandalism in Paris was mentioned in the article but its main focus was neither the victims nor the perpetrators. Instead, Artichoc expressed criticism of the French president's reaction to the vandalism. “Emmanuel Macron has merely pointed out the unacceptable nature of anti-Semitism. It seems the French president has no intention of addressing the issue of security in the country,” the article noted.
VIGINUM's analysts then traced links to this article that had been shared on social media. That is what this new French agency does: reporting to the prime minister, it was created in 2021 in the aftermath of the murder of schoolteacher Samuel Paty, when public authorities found themselves powerless against online campaigns denigrating France, and which accused the country simultaneously of both Islamophobia and of undermining secularism.
In 2024, VIGINUM, with the help of the Antibot4Navalny collective, identified that the Artichoc article in question had been subjected to “artificial amplification” on X through two networks of automated accounts or bots. The tweets from these accounts had limited visibility (6,036 mentions) as they were quickly moderated by X. But that is not the key point. Firstly, the action had been coordinated: posts from the first network of inauthentic accounts were amplified by those of the second network. More significantly, both networks were affiliated with the RRN infrastructure (Reliable Recent News), a Russian propaganda operation created one month after the invasion of Ukraine, and which frequently disseminates fake news articles mimicking Western media in every detail.
This recalls other recent events. In early November 2023, France's Ministry of Foreign Affairs condemned “Russian digital interference” after detecting a thousand bots posting on X that sought to fuel controversy over hundreds of blue Stars of David that had been spray-painted on the walls of buildings in Paris. These stars were painted by a Moldovan couple, commissioned by a compatriot known to have ties to Russia.
Photos of the Stars of David were subsequently circulated by bots from the Russian Doppelgänger network, which uses the RRN portal. In a July 2024 memo, the DGSI described RRN as a “vehicle for disseminating pro-Russian and anti-Ukrainian content, promoting an editorial line based around Russia’s strategic interests”.
In February, The Washington Post published an article based on Kremlin documents, obtained by a “European intelligence service”, which named Sergey Kiriyenko - Russian prime minister in the late 1990s and currently deputy chief of staff at the presidential administration - as the person responsible for “psychological information operations”. According to the report, he was the figure behind the Doppelgänger/RRN campaign which flooded Europe with fake articles impersonating legitimate Western media.
In a public report published in June 2023, VIGINUM detailed the involvement of accounts tied to Russian consulates, embassies and cultural centres that amplified RRN’s fake articles on social media.
A French media outlet with a Russian flavour
Despite everything, question marks remained over the online coverage of Operation 'Red Hands'. Unlike the case of the Stars of David, there was no extensive digital amplification by fake Russian accounts on social media over the red hands vandalism. Moreover, the photo that was used online was one published by French news agency AFP, not an image taken by the group of vandals, unlike in the Stars of David episode. Could this simply have been an act of “opportunism” by the Russian influence network, which had capitalised on an anti-Semitic act without instigating it? This was the question VIGINUM analysts were pondering on May 16th. They continued to dig deeper.
<img data-asset="
Enlargement : Illustration 1
" class="media-center" src="https://static.mediapart.fr/etmagine/default/files/2024/12/31/241231-img-operation-mains-rouges-33-les-bots-du-kremlin-pris-les-mains-dans-le-net.jpg" width="942" height="413" alt="" data-mediapart-media-id="3e04bb33-13d3-4c6b-9f31-0bfbfe4aef06" data-insert="options%5Blegend%5D=&options%5Bformat%5D=100&options%5Bfloat%5D=center&options%5Bhighlight%5D=0&options%5Bmax_width%5D=1500&options%5Buse_percent_width%5D=0&options%5Bwidth%5D=1500&options%5Bmax_height%5D=1002&options%5Buse_percent_height%5D=0&options%5Bheight%5D=1002" title="" />
Three months later, on September 4th 2024, one of these analysts presented the findings of their investigation to the DGSI. This showed that the attempted manipulation of Operation 'Red Hands' was orchestrated by a network of several thousand inauthentic accounts on X, and that the “pseudo-French media outlet” Artichoc was created by none other than RRN. The VIGINUM analyst explained that the media outlet’s domain name was hosted on a server that also housed other fictitious outlets linked to RRN. From the very first days of its creation in 2023, Artichoc’s articles had been promoted by bots on social media.
By a quirk of timing, on the same day, September 4th 2024, that the VIGINUM analyst presented their findings to the DGSI, the US Department of Justice issued a statement announcing sanctions against 32 fake websites “used in foreign malign influence campaigns”. These sites were connected to the Doppelgänger/RRN network and directed from the Kremlin by Sergei Kiriyenko. Among these 32 fake sites was Artichoc.
The manipulation of information - the intentional and mass dissemination of false or biased news for hostile political purposes - is itself as old as time. It has also been a Russian speciality since the 20th century.
During the Cold War what were termed “active measures” ('aktivnye meropriyatiya') were conducted out by a KGB department called Service A. The most infamous of these earned the nickname of “swastika epidemic”. Between 1959 and 1960 the KGB orchestrated a covert campaign of anti-Semitic slogans and swastika graffiti in the Federal Republic of Germany and other Western countries. This took place alongside a genuine surge in global anti-Semitic acts following the desecration of Cologne’s synagogue at Christmas in 1959.
The goal of this information manipulation operation is to create the impression that France is a country plagued by deep-rooted anti-Semitism.
The purpose of this was to discredit the Federal Republic of Germany in the eyes of its Western allies by suggesting it was seeing a resurgence of Nazism, with the aim of delaying or preventing its rearmament. The campaign also included the fabrication of inflammatory racist pamphlets, supposedly from the extremist Jewish Defence League, calling for a “hunt of black bastards”, and distributing them to African-American activist movements. Additionally, fake letters containing racist insults and threats, allegedly from the Ku Klux Klan, were sent to Olympic committees in African and Asian countries just before the 1984 Los Angeles Olympics.
“To spread these active measures, the campaigns have always relied on networks of individuals not directly affiliated with Russian intelligence services, who are tasked with promoting narratives in line with the latter's interests,” notes the DGSI in a second report dated July 2024.
This scenario closely mirrors the Stars of David and Red Hands operations. “The key difference between contemporary Russian disinformation and that of the USSR lies less in its form than in its objectives,” France's domestic intelligence service adds. “It is no longer about exporting an alternative ideology but rather about causing weakness by promoting the absence of objective truth.”
In the case of the 'Red Hands' operation the “goal of this information manipulation operation was to create the impression that France is a country plagued by deep-rooted anti-Semitism and vulnerable to issues stemming from the Israeli-Palestinian conflict. More broadly, the aim was to provoke a political crisis and deepen divisions,” concludes the DGSI.
This time, however, the operation failed. The legitimate distress caused by the defacement of the Holocaust memorial quickly subsided. The swift revelation of the Bulgarian operatives’ involvement on the ground, along with RRN’s online role, meant the Artichoc article and bot tweets failed to go viral and fuel controversy.
“The precedent of the Stars of David – which was exposed by French authorities, who had accused Russia in a statement from the Ministry of Foreign Affairs in Paris - helped. It was fresh in everyone’s mind. The media made the connection. Moreover, quickly identifying the possibility of interference helped minimise any escalation,” says one of the individuals involved in thwarting this recent Russian interference.
Nevertheless, this did not stop the Kremlin from striking again 15 days after Operation 'Red Hands'. As recounted in the first episode of this series, on June 1st, following sharp criticism from the Kremlin over the deployment of French military instructors in Ukraine, individuals got out of a white van and placed five coffins filled with plaster at the foot of the Eiffel Tower. These coffins were draped in French flags and bore the words “French soldiers in Ukraine”. Those responsible were arrested and linked to the Red Hands team.
Four days later, VIGINUM detected several posts on Facebook and Instagram from a purported Ukrainian collective named “Mriya” (“the dream” in Ukrainian), claiming responsibility for the “Coffins” operation. They described it as an artistic action aimed at “drawing attention to the reckless statements of French leaders, who, instead of stopping the war, fuel it further by claiming to send their soldiers into a conflict zone”.
Mriya later claimed responsibility for graffiti carried out on June 19th 2024, this time by Moldovan nationals. These depicted a copy of a cartoon published by satirical magazine Charlie Hebdo in response to France’s announcement that it would supply Mirage 2000-5 fighter jets to Ukraine. The claims by Mriya, a supposed Ukrainian collective expressing concern over military aid to Ukraine, were amplified on Facebook “by actors linked to Russia,” according to a VIGINUM analyst interviewed by the DGSI.
Since the Stars of David incident, Russian interference in France has been swiftly exposed and been largely ineffective, such as the operation revealed by Mediapart aimed at promoting far-right politician Jordan Bardella’s campaign for the European elections in the spring and summer of 2024. However, the disruptive potential of these actions should not be underestimated, nor the risks they pose to national security.
“In seeking to exacerbate tensions between communities and fracture societies, information manipulation operations inherently carry the risk of inciting violent action by individuals who are susceptible to such propaganda,” the DGSI warned in July.
On February 3rd 2024, a man of Malian origin attacked several individuals with a knife at Lyon railway station in south-east France, seriously injuring one of them. Prior to the attack, he had posted dozens of videos on social media in which he made threatening remarks against France, its citizens, and Emmanuel Macron. His statements broadly echoed pro-Russian narratives targeting France.
------------------------------------------------------------------------------