InformNapalm volunteer intelligence community, in cooperation with the Ukrainian Militant analytical group, exclusively publishes the findings of a CYBINT investigation into datasets obtained by hacktivists from the 256 Cyber Assault Division. The materials provided for analysis include documents, personal and official correspondence, photographs, and other files linked to the activities of personnel associated with Russia’s Foreign Intelligence Service (SVR). Analysis of the data helped establish links between individuals connected to Russian foreign intelligence and preparations for mass events in Budapest in support of the Paks II nuclear power plant project, which is being implemented with the participation of Russia’s state-owned Rosatom corporation.

An email about an “active measure” in Budapest

On September 16, 2026, Russian Colonel Timur Syrtlanov [Rus.: Тимур Маратович Сыртланов] sent an email to Irina Parman [Rus.: Ирина Дмитриевна Парман], a lieutenant colonel linked to Military Unit 33949. The subject line read “active measure”:

“The ‘active measure’ in Budapest has been postponed. Can you do the profiling for tomorrow?”

Original Russian: “Активку в Будапеште перенесли. Сможешь профайлинг сделать на завтра?”

Email dated September 16, 2026, from Timur Syrtlanov concerning the postponement of an “active measure” in Budapest and asking Irina Parman to conduct profiling. Source: leaked materials.

In Soviet and Russian intelligence terminology, “active measures” are influence operations aimed at shaping political processes and public opinion, including through information campaigns, agents, and public events. The word “активка” used in the email is professional shorthand for such an operation.

Notably, Military Unit 33949 has appeared in open sources for years as an outfit associated with Russia’s SVR. In 2010, Novaya Gazeta established that the head of the SVR Veterans Council used the address of Military Unit 33949 for correspondence, while former intelligence officer Anatoly Korendyasev [Rus.: Анатолий Корендясев] declared salary income from the same military unit.

In autumn 2026, the same military unit also appeared in another CYBINT investigation: Polus-24 and Military Unit 33949: documents obtained by cyber specialists lead to the Russian strategic nuclear forces.

After identifying the email, analysts began looking for reports about preparations for pro-Russian events in Budapest. The search led to Facebook advertisements, a Telegram group used by the rally organizers, and campaign files whose metadata contained information matching data used by Irina Parman.

How the pro-Paks II rally was organized

On September 16, 2026, a Facebook account under the name Zoltan Biro posted advertisements in groups for Russian-speaking residents of Hungary and Europe. The author invited “proactive members of Budapest’s Russian-speaking community” to join a project focused on the development of Hungary’s energy sector and infrastructure.

The event was initially planned for September 20. Public posts did not mention Rosatom or the Paks II nuclear power plant.

Recruitment of Russian-speaking Budapest residents for participation in an energy-related project.

Using a separate account, investigators contacted the organizer and received an invitation to a Telegram group called “DRUZHBA NARODOV” (“Friendship of Peoples”), which had 106 members at the time.

Inside the group, the purpose of the event was stated directly: support for the Russian-Hungarian Paks II nuclear power plant project. Organizers planned to hold a rally on Lajos Kossuth Square near the Hungarian Parliament at approximately noon on September 20.

Participants were given materials for producing banners and leaflets and were asked to print them themselves. In one message, organizers mentioned additional compensation, saying that the amount and payment procedure would be provided separately. The materials reviewed by InformNapalm contain no documentary confirmation that such payments were actually made.

Messages concerning support for Paks II, banner preparations, the planned rally location, and possible compensation for participants.

The organizers later announced that the event had been moved from September 20 to September 26, citing a delay in obtaining permission from local authorities.

Syrtlanov had already told Parman on September 16 that the “active measure” in Budapest had been postponed. The overlap in location, timing, and changing plans suggests that he may have been aware of the organization of this event. At the same time, the email does not establish Syrtlanov’s specific role or authority.

Metadata led to Irina Parman

Investigators obtained an archive of campaign files distributed among members of the Telegram group. One banner carried the Hungarian slogan “Az atom a természet barátja!” — “Nuclear energy is a friend of nature!”

The PDF properties listed the author as “Irina Larina” [Rus.: Ирина Ларина]. A preserved screenshot of the metadata also shows the file creation and modification dates: September 16 and September 18, 2026, respectively. Those timestamps fall within the period of Syrtlanov and Parman’s correspondence and the rally preparations.

Campaign material in support of nuclear energy. The file properties list “Irina Larina” as the author.

Analysis of Parman’s personal archive established that she used her maiden name, Larina, on the Russian social network Moi Mir.

The match between the name in the metadata and Parman’s profile, together with the file dates and the correspondence about the “active measure,” provides an additional link between the rally preparations and individuals in the leaked material associated with the SVR.

An SVR lieutenant colonel and a Russian military commentator

According to service documents, Irina Dmitrievna Parman ” [Rus.: Ирина Дмитриевна Парман] holds the rank of lieutenant colonel and is linked to Military Unit 33949. Her specialization is profiling: the analysis of a person’s behavior, reactions, and psychological characteristics to assess motives and identify concealed information.

Documents concerning Irina Parman’s military rank, place of service, and teaching specialization.

The leaked materials also contain training documents from the SVR Academy that identify Parman as an instructor with the 7th Department of the Training Center. Her course concerns psychological methods used in operational and service activities.

Timur Maratovich Syrtlanov

The other participant in the correspondence, Timur Maratovich Syrtlanov ” [Rus.:Тимур Маратович Сыртланов], is a Russian colonel, a member of the presidium of the Officers of Russia organization, and a military commentator. Russian media describe him as a veteran of military service. In 2024, he appeared in publications as deputy commander of BARS-Kursk for military-political affairs.

Syrtlanov’s commentary is regularly published by Moskovsky Komsomolets, Argumenty i Fakty, and other Russian outlets. He comments on Russia’s war against Ukraine, Ukrainian intelligence services, and Russian military policy.

The leaked materials include a document concerning Syrtlanov’s clearance for access to state secrets, bearing the stamp of the same SVR Military Unit 33949. The document confirms the connection stated in the record, but it does not establish his current service status as of September 2026.

According to materials from Parman’s personal archive, she and Syrtlanov have been in a relationship since at least 2017.

The leak preserves correspondence between the two in which they discuss work-related matters and exchange documents through private email accounts.

InformNapalm also has access to other personal and official photographs and documents concerning Timur Syrtlanov. Their analysis will be the subject of future investigations.

The political context surrounding Paks II

In summary, preparations for the pro-Russian rally took place amid deteriorating relations between Russia and Hungary after the government of Péter Magyar came to power.

On September 8, 2026, Budapest announced the expulsion of ten Russian diplomats for activities incompatible with their diplomatic status. Foreign Minister Anita Orbán described the decision as a measure to protect the country’s security and sovereignty. The Hungarian authorities did not publicly disclose specific allegations against the expelled individuals.

The Paks II nuclear power plant expansion, involving Rosatom in the construction of two new reactor units, remained one of the most contentious issues in bilateral relations.

On August 26, Hungarian police opened an investigation into financial transactions surrounding Paks II. According to Telex, the case concerns an HUF 80 billion capital increase in the project company in December 2025. The outlet also noted that in September 2025, the Court of Justice of the European Union annulled the European Commission’s decision approving state aid for the project.

On October 12, Russia’s SVR issued a statement accusing the European Commission leadership and Ursula von der Leyen of organizing an information campaign against Rosatom and attempting to push the Hungarian government to abandon nuclear-energy cooperation with Russia. The SVR provided no independent evidence to substantiate those allegations.

Ultimately, the rally originally scheduled for September 20 and later moved to September 26 did not take place. According to messages from participants in the Telegram group, organizers cancelled it roughly half an hour before it was due to begin. The reasons for that decision remain unknown.

However, the preserved digital traces of the rally preparations, together with service documents concerning Irina Parman and Timur Syrtlanov, indicate a connection between these activities in Budapest and individuals linked to Russia’s Foreign Intelligence Service.

Russian intelligence activity in EU countries has long extended beyond information campaigns and small public rallies. In recent years, European law-enforcement agencies have also documented arson, sabotage, and other operations attributed to Russian intelligence services. Against that background, the cancellation of the Budapest event is not evidence that the structures associated with it ceased their activities. It cannot be ruled out that other influence operations were given priority and may come to light in due course.

Additional conclusions to the article

Developments over the past several months provide grounds for the following hypothesis.

In May 2026, SVR officer Artur Sushkov was expelled from Hungary after his activities had been monitored by Hungarian counterintelligence in cooperation with the intelligence service of a NATO member state. According to VSquare, Hungarian counterintelligence had been seeking his expulsion since February, but the political decision was made only after the change of government.

On September 8, Budapest announced the expulsion of another ten Russian diplomats for activities incompatible with their diplomatic status.

Then, on September 16, an internal exchange between individuals linked to the SVR included a message stating that an “active measure” in Budapest had been postponed.

Could Hungarian counterintelligence have known about preparations for the operation before it was carried out?

Two scenarios appear plausible: independent surveillance of Russian intelligence networks by the Hungarian security services, or the receipt of relevant intelligence through partner channels.

The Sushkov case confirms that this kind of international counterintelligence cooperation had already taken place in Hungary. We also do not know whether the cancellation of the rally was connected to any counterintelligence action.

Nevertheless, the sequence of events suggests that, following the change of government in Hungary, Russia’s SVR may have lost some of the operational freedom it had previously enjoyed.

If so, the cancelled “active measure” in support of Rosatom may be only one visible episode in a broader set of developments that have yet to become public.

This publication was prepared especially for readers of InformNapalm volunteer intelligence community. Distribution and reprint with reference to the source is welcome! (Creative Commons — Attribution 4.0 International — CC BY 4.0). Subscribe to InformNapalm social media pages.

InformNapalm does not receive any financial support from any country’s government or large donors. Only community volunteers and our readers help us to maintain the site. You can also become one of the community volunteers or support InformNapalm with your donations.