Leaked Documents Reveal Russian ‘Cognitive Strikes’ Against the West — Including Islamophobic ‘Pig Head’ Attacks in Paris

In September 2025, nine mosques and cultural centers in and around Paris were targeted with a grotesque Islamophobic stunt: Bloody severed pig heads, each marked with the word “Macron” in blue ink, were left outside their front doors.

A few months later, three men from Serbia were convicted of the crime in their home country. They had been directed, the verdicts read, by “structures of the intelligence service of the Russian Federation” in an effort to incite unrest and intolerance.

Now, a cache of leaked documents obtained by reporters from Delfi Estonia and shared with OCCRP and other media partners pulls back the curtain on that provocation. The files showcase the meticulous internal planning that went into the operation, shed new light on who was behind it, and unveil a swathe of other pro-Kremlin influence efforts across Europe and beyond.

The documents point to the Social Design Agency (SDA), a Russian PR firm already sanctioned by the U.S., the U.K. and the EU for previous influence campaigns — and to the Russian Presidential Administration, whose officials are seen overseeing the firm’s work.

The several dozen files include internal reports about planned and completed missions as well as screenshots of private conversations from a workplace collaboration tool used by both SDA staffers and administration officials.

They detail numerous operations — described internally as “cognitive strikes” against the West — that included other vandalism attacks in France and Germany, efforts to advance pro-Russian messages through Western opinion leaders, and election interference campaigns. Among the latter is a plan to influence the upcoming parliamentary election in Armenia through a media outlet aimed at Russian-speaking voters, with the goal of arresting the country’s geopolitical turn towards the West.

A document titled “Report on Operation Pig’s Head” details the internal planning that went into the Paris mosque attacks, including photos of the prepared pig heads before they were distributed, that have never appeared in public.

According to the document, a group of six operatives arrived in Paris on September 7, conducted "reconnaissance" on September 8, delivered the pig heads on the following night, and then "successfully left the country.”

The file concludes with a lengthy list of news articles in French, English, and Russian that covered the attack. “The operation received wide coverage in world media outlets,” it boasts.

One leaked message sets out one of the goals of this kind of information warfare: helping Russia “maintain the image of a superpower” on the world stage. “The more Russia participates in active influence campaigns all over the world, the stronger the image of a global Russian power,” it reads.

Because many of the leaked files lack a clear author, it is not always evident whether a specific document, and the operations it describes, originated with the SDA, the presidential administration, or elsewhere. The Russian presidential administration and the SDA did not respond to requests for comment.

This is not the first time the SDA has been accused of carrying out influence operations in concert with the Russian state. The firm was sanctioned by Western countries on that basis, and in 2024 reporters from Delfi Estonia, Süddeutsche Zeitung, and other European outlets obtained a previous set of leaked files that revealed the firm’s efforts to reduce Western support for Ukraine and boost far-right parties in European Parliament elections. The same year, the U.S. Department of Justice released an affidavit in which an FBI agent testified that the company was under the Russian presidential administration’s “direction and control.”

This latest leak, parts of which were first reported by the Armenian outlet Fact Investigation Platform, showcases the SDA’s operations throughout 2025 and contains plans slated for this year. It also provides further evidence of senior presidential administration figures directing the operations, wielding budgetary power, and even keeping track of the whereabouts of the SDA’s head.

James Pamment, an expert in hostile foreign interference who directs the Psychological Defence Research Institute at Sweden’s Lund University, said the documents indicate “a pattern of reckless escalation.”

“They are trying to create conflicts between groups [in society],” said Pamment, who has extensively researched the SDA. “We’re well aware of how easy it is to inflame existing tension in Europe at the moment, particularly around issues like migration or religious tensions. It is dangerous.”

An analyst from Hybrid CoE, an organization of security experts based in Helsinki that helps EU and NATO governments counter “hybrid threats,” said the danger of SDA’s work lies in its possible long-term consequences.

“It may take years before the effects become fully visible, and by the time they do, it could already be too late to respond effectively,” said the analyst, who requested anonymity per the organization’s policy. “This is why it is so important to counter these operations right now and prevent them from spreading any further.”

False Flags in Europe

In the leaked chats, participants use pseudonyms that consist mainly of generic English names, such as “Alex Abbot” and “Sam Spencer,” though a few more fanciful aliases, like “Bruce Lee” and “Immanuel Kant,” also appear.

The screenshots are shown from the perspective of a user who uses the alias “Kristin Kiler” — an apparent reference to Christine Keeler, the infamous English showgirl whose affairs with both a U.K. minister and a Soviet naval attache helped bring down the British government in the 1960s.

“Kiler” is referred to by colleagues as “Sofia,” and according to a spreadsheet found in the leak, the pseudonym belongs to Sofia Zakharova, a senior official in the Russian presidential administration. Zakharova was sanctioned by the EU in 2024 for her work with the SDA, with the sanctions notice describing her as a communications department chief who worked “directly with [SDA head] Ilya Gambashidze.”

In the leaked chats, Sofia appears to oversee funding-related matters and on one occasion appears to defer to an even more senior official. “We’re waiting for the go-ahead from SVK,” she writes in one conversation. These initials correspond to the full name of Sergei Kiriyenko, the administration’s first deputy chief of staff. Zakharova did not respond to a request for comment.

Most of the leaked chats show Sofia and her colleagues exchanging project reports and planning documents. One of these files lays out the broad parameters of an influence campaign aimed at Western countries that is intended to assist the Russian government’s foreign policy.

“We plan to achieve this goal primarily by deepening internal contradictions between [Western] ruling elites, stimulating protest activity among opposition forces, escalating anti-government protests, and ‘stirring up’ the amorphous portion of the electorate in NATO countries and their satellites,” the document reads, which according to its metadata was created in May 2023.

The text proposes “delivering consecutive cognitive strikes” against Western audiences “on the internet platforms they control” in an unconventional  manner, including by “abandoning overtly pro-Russian messages.”

“We consider the organization of mass protest actions in NATO countries to be an important supporting measure,” it reads. “We have the necessary capabilities to involve a special contingent permanently residing abroad for such events.”

According to the court verdicts handed down to the Serbs convicted of involvement in Paris pig head incidents, the group also targeted the Jewish community. The men had poured green paint on Paris’ Holocaust Museum and several synagogues and left plastic skeletons at the Brandenburg Gate in Berlin, a short distance from the Holocaust memorial. The goal of the operation, the court concluded, was to “incite religious and national intolerance” between Jews and Muslims and “destabilize the situation" in Germany and France.

The leaked files reference the synagogue operation and lay out its ultimate goal. In one conversation with Sofia, a user using the pseudonym “Edward Bernays” — an apparent ironic nod to an Austrian-American pioneer in manipulative propaganda — provides an overview of the project, titled “Green Synagogues.”

“The event made the front pages of the global media,” Bernays writes. “The aim of the action [is] to discredit the French authorities, who have been unable to stop the wave of Islamic anti-Semitism in Paris. A blow to Macron's image, who allowed himself to criticize Israel.”

Another conversation between Bernays and Sofia references an operation in Germany last year, when hundreds of cars had their exhaust pipes filled with expanding foam and were defaced with stickers that read “Be greener!” in an apparent attempt to implicate the Green Party.

“Deutsche Welle is writing about us,” he wrote to Sofia alongside a link to a story describing the vandalism.

The leaked files also contain plans for similar missions that either never materialized or were not publicly reported. One document outlines a plan to desecrate a Paris monument to General Charles de Gaulle in the name of “Ukrainian nationalists.”

Anticipating a “high likelihood” that the perpetrators would be arrested, the document lists “special requirements” for them, including that they themselves be misled about the nature of the operation.

They must not be involved in any previous attacks and must “be certain that they are operating in the interests of Ukraine and fulfilling an order by the Olena Zelenska Foundation,” the instructions say, referencing a charity founded by Ukraine’s first lady.

A separate plan for the same month describes an operation to launch 30 sex dolls into the Seine River carrying the message “Fuck migrants!”

Armenia in Focus

А presentation found in the leak suggests that the SDA is behind a media group active in the former Soviet countries called SNG Media. The goal of the group, the document reads, is to “compensate for the lost ties between residents of the countries of the post-Soviet space after the dissolution of the USSR, acknowledged as one of the largest geopolitical catastrophes in the world.”

Officially, the group of 12 outlets appears to be operated by a separate Russian company called SNG Media. It did not respond to a request for comment.