InformNapalm volunteer intelligence community, in cooperation with hacktivists from 256 Cyber Assault Division and the Ukrainian Militant analytical group, exclusively publishes the findings of a new CYBINT investigation into Russian intelligence efforts to influence protest movements in France.

Email correspondence obtained by the investigators and linked to Russian military intelligence (GRU) officer Stanislav Nemich reveals a campaign of covert interference — from amplifying protest demands and drawing new participants into demonstrations to obstructing compromise between protesters and the authorities.

The investigation shows how Russian intelligence services seek to exploit genuine social divisions to increase tensions and destabilize France.

Radicalization and France’s street protest infrastructure

French society has lived with persistent social tensions. Images of mass protests in the education sector, clashes with police, damaged buildings, burned vehicles and looted shops have become a recurring feature of news coverage.

Left-wing and far-left groups have often been among the main driving forces behind these and earlier protests, including the Révolution Permanente movement and La France insoumise (LFI), together with its media platform L’insoumission. Trade unions, university students and secondary-school students also mobilize around these movements.

Recent street protests, however, show signs of a more troubling trend. Demonstrations are becoming more radical, while demands centered on social rights or better educational conditions quickly give way to hardline anti-government slogans. The actions of some groups during clashes with police also appear highly organized and coordinated.

According to French Interior Minister Laurent Nuñez and reports by the Police Prefecture, peaceful marches involving school and university students and trade unions were deliberately infiltrated by coordinated groups of masked provocateurs — casseurs — and black-clad radicals prepared for violent confrontation with police.

During just two nationwide days of action, on October 17 and 24, law-enforcement agencies detained around 3,400 people. On one of those days alone, more than 100 people were arrested carrying bladed weapons or objects prepared in advance for use in attacks.

Well-prepared groups of provocateurs followed a clear pattern. They deliberately smashed shop windows and vehicles, looted and set fire to civilian property, and provoked police into forceful responses involving crowd-control measures such as stun grenades and water cannons.

On October 17 alone, around 1,000 police officers and gendarmes were injured. To contain the unrest, the government deployed more than 70,000 security personnel, along with armored vehicles, helicopters and drones.

At the same time, Russian disinformation networks rapidly amplified the resulting chaos. Staged or decontextualized footage of clashes was circulated through thousands of bot accounts. The aim was to create a distorted impression among European audiences that France was entering a “civil war,” while pushing the protesters’ original social demands out of the information space.

These developments raise questions about the extent to which external actors interested in destabilization may be influencing the level of violence and the evolution of protest movements.

Russia has long sought to exploit such tensions. Understanding its disruptive methodsboth on the ground and online is therefore relevant not only to France but to other Western democracies as well.

The Kremlin uses several most straightforward and tested tools to exploit social tensions and cause political unrest.

Street-level operations

These methods can include hiring opportunistic individuals or criminal elements for relatively small sums to stage false-flag provocations; carrying out deliberately radical acts such as provocative disobedience, flag burnings, vandalism of landmarks or politically significant symbols; and using graffiti or similar acts to inflame religious or ethnic tensions.

Another method is to plant agents or intermediaries inside radical street groups in order to influence organizers or individual participants from within — including by provoking police into a forceful response and helping turn peaceful demonstrations into riots.

Information operations

Russian influence methods can include creating anonymous protest groups on popular messaging platforms or infiltrating closed groups while posing as like-minded activists.

Other tactics include mass circulation of instructions on confronting or harming police, advice on countering tear gas, as well as campaigns aimed at discrediting senior officials or state institutions while disguising external direction as the “spontaneous outrage” of dissatisfied citizens.

The objective is not necessarily to invent new problems, but to exacerbate existing domestic conflicts in France as much as possible and erode trust in state institutions.

Radicalization and physical confrontation can then be framed as legitimate responses to supposedly unlawful or illegitimate actions by the authorities or law enforcement, while the instigators portray them as contrary to the interests of society.

Russian intelligence strategy: from media clones to information overload

According to the European External Action Service (EEAS), France has become the second most frequently targeted country in Europe for Russian disinformation operations, after Ukraine.

In 2025, France’s agency for protection against foreign digital interference, VIGINUM, officially linked a series of large-scale operations targeting French media and state institutions to Russian military intelligence (GRU) activity in its report.

The objective was to deepen social divisions, discredit elections — particularly centrist candidates — and foster chaos and public disillusionment.

Major Russian influence networks targeting France

According to analysts, Military Unit 54777 serves as a central hub for psychological operations and strategic disinformation within the GRU and is responsible, among other areas, for operations targeting France.

In the information domain, the unit specializes in building covert propaganda networks abroad through front organizations, nominally independent analytical centers and media outlets.

Investigations have linked Military Unit 54777 to oversight of structures including the Inforos media agency, the Foundation for Support and Protection of the Rights of Compatriots Abroad — commonly known as Pravfond — and the GOLOS information network, which was later reformatted as the Europe Speaks project.

These projects are overseen through former and serving intelligence officers, including Alexander Starunsky.

The network regularly distributes manipulative French-language material designed to deepen social divisions, discredit European institutions and attack France’s foreign-policy course.

GRU operation analysis: Russian intelligence working to influence protests in France

Email correspondence obtained by Ukrainian hacktivists shows how Russian intelligence works to steer elements of the French protest movement. It involves a career officer of Russian military intelligence — Lieutenant Colonel Stanislav Nemich, who uses the alias Nikolai Nemov in official documents and operational correspondence.

Nemich has spent his military career within Russia’s Main Directorate of the General Staff (GRU) and associated structures, both inside Russia and abroad.

Among other postings, he served at a Russian intelligence facility in Dushanbe (Military Unit 48216) and at the Russian Embassy in Nicaragua.

Since Soviet times, Russian intelligence activity in Nicaragua, and across Latin America more broadly,, has relied heavily on interaction with left-wing political movements.

Although Nemich is based in Novosibirsk, far from the Moscow headquarters of Military Unit 54777, his case illustrates the distributed nature of Russia’s propaganda and influence apparatus targeting Western countries. This structure allows remote “information hubs” to operate while reducing the risk of exposure.

His career also reflects an evolution characteristic of modern Russian intelligence services: from conventional intelligence collection to hybrid operations in the European information environment.

The correspondence indicates that Nemich works through purpose-created mailboxes hosted on domains controlled by Russian intelligence services and uses a network of front accounts, anonymous moderators and individuals infiltrated into protest movements.

As part of this CYBINT investigation, InformNapalm volunteers gained access to part of Nemich’s correspondence with one agent. The exchanges offer a rare inside view of how this system operates in the context of the current protests in France.

The emails reveal a recurring workflow: Nemich receives tasks from higher command, prepares ready-made talking points and instructions for agents operating in both on the ground and online, and tracks how selected narratives spread through French protest communities and media.

Set against later events, the instructions suggest that the agent’s account served a channel for radicalization, redirecting genuine public anger toward increasingly confrontational positions.

From handler to protest communities: ready-made instructions and narrative

The handler sends the agent short, ready-made recommendations intended to be introduced discreetly into French protest communities.

The agent’s replies merely acknowledge receipt without discussing either the substance of the instructions or how the tasks will be carried out.

Nemich’s résumé contains no indication that he speaks French, suggesting that he likely relied on translation assistance.

Example 1

A revealing example of how Russian coordinators sought to influence protesters’ demands appears in an email dated October 11, 2026.

In it, Lieutenant Colonel Nemich — using the name “Nemov” — gives his agent a clear instruction: amplify among young people the demand to abolish Parcoursup, France’s national higher-education admissions platform, and seek to have the demand publicly endorsed by left-wing leaders, including Jean-Luc Mélenchon.

“In your demands, focus first and foremost on abolishing Parcoursup. We expect Jean-Luc Mélenchon to officially support this point in his speech. This is very important. You can count on all possible support.”

Analysis of the timeline and monitoring of French media show that on the same day the email was sent — October 11, 2026 — Jean-Luc Mélenchon did indeed make the abolition of Parcoursup one of the central themes of a public speech to young voters in Clermont-Ferrand. That daytime speech preceded the evening email, so this is more a coincidence between the handler’s demand and a position the politician had already stated publicly.

Also that day, the demand became the main programme item on the L’insoumission movement’s official platform. Over the following days, it was actively picked up by education media such as Le Café pédagogique and by protest-oriented social-media communities, turning abolition of Parcoursup into one of the main formal demands of the school strikes.

Monitoring sources and materials from October 12 include:

• Jean-Luc Mélenchon’s speech in Clermont-Ferrand, reported by actu.fr
• Official L’insoumission publication on the youth program and the speech
• “Parcoursup: un archaïsme des années Macron” in Le Café pédagogique
• Ohmymag Facebook discussion of the Parcoursup debate and anger among secondary-school students

Example 2

Another episode in Lieutenant Colonel “Nemov’s” exposed correspondence concerns an instruction issued immediately after the first violent street clashes between protesters and law-enforcement officers.

The Russian handler reacted quickly to reports of teenagers being injured and instructed the agent to add a new and more radical demand to the protest agenda: criminal accountability for law-enforcement officers.

“Given the events of the clashes, a new core demand must be added. The justice system must punish police officers who used unjustified force against secondary-school students or inflicted serious bodily harm on these teenagers. Formulate a demand calling for the punishment of the police officers.”

Following the directive, the infiltrated network began actively pushing claims of “systemic police terror against children” through protest-oriented media channels and social networks.

In this case, the Russian intelligence handlers again applied a familiar technique: amplifying genuine public outrage.

Images of crowd-control measures being used against young people naturally generate a strong emotional response. The Russian instruction sought to channel this spontaneous anger into a systematic demand for punishment of the police, with the aim of blocking compromise between the government and protesters, undermining confidence in law enforcement and increasing the likelihood of further confrontations.

Monitoring sources showing the active spread of these narratives include:

• BFMTV live coverage of mobilization and school blockades
• Le Reporter Indépendant post on violence against secondary-school students
• Mesinfos analysis from Salon-de-Provence
• La France Insoumise Bron video concerning police actions
• Journal Fakir video on youth mobilization
• Brut Officiel report from the protests
• Dailymotion footage of clashes
• Instagram video from the secondary-school protests

Example 3

Another important episode in the obtained correspondence shows the handler pushing to broaden the protest by bringing different social groups together — the so-called convergence des luttes, or “convergence of struggles.”

The handler instructed the agent to move beyond purely student and school-based grievances and draw powerful trade unions and veterans of the Yellow Vest movement into the street mobilization.

“You must expand the protest movement and bring in other forces to create a convergence of demands. For the next blockade actions, involve the trade unions more actively, particularly the CGT, as well as Yellow Vest activists.”

Of particular interest is the agent’s reply to this instruction. It contains the Spanish-language phrase “¡Siempre más allá!” — “Always further!”

We were unable to confirm the phrase as the official motto of any specific organization. It is best known as the title of an academic work concerning the Sandinista movement, a far-left movement that historically maintained close ties with Soviet and later Russian intelligence networks in Latin America.

The appearance of this particular phrase in the correspondence may indicate a possible connection between the infiltrated agent and pro-communist or anti-Western networks in Latin America, where the individual may have been recruited or drawn into cooperation.

Subsequent events show that the handler’s instruction coincided with developments on the streets. Within days, leading French media outlets and trade-union organizations were discussing the convergence of different protest groups ahead of the nationwide day of action on October 17.

This timing does not by itself establish that the Russian instruction caused that mobilization. It does, however, show that the handler was working to reinforce a trend already emerging within the protest environment.

Monitoring sources include:

• Unité CGT Facebook publication on the October 17 mobilization
• Mesinfos report on Yellow Vests, secondary-school students and the CGT in Marseille
• RTL analysis of convergence des luttes and calls to unite
• Yellow Vest leaders’ appeal published by Contre-Attaque
• TF1 Info report on CGT participation in the October 17 protests

Example 4

Another revealing episode is an instruction dated October 15, 2026, found in the Russian handler’s correspondence.

As the French government moved to defuse tensions by proposing a a videoconference with protest leaders to discuss concessions, the Russian intelligence officer issued a clear directive to block any compromise.

“The minister has scheduled a videoconference with you and the secondary-school student associations in order to weaken the movement by announcing minor concessions. Do not let yourselves be deceived. The movement’s leaders must remain firm: all demands must be met, without any concessions or additional conditions.”

Monitoring of French media shows that representatives of the school protest movements subsequently took a hard line. , They rejected the government’s compromise offers, even  after consultations with government representatives, and insisted on immediate and full implementation of their demands with no room for negotiation.

The timing alone does not establish that the Russian directive caused this position. What the correspondence does show is that the handler explicitly sought to prevent compromise and sustain maximalist demands.

The logic behind  the directive is that a successful compromise or partial satisfaction of the protesters’ social demands would risk weakening the protest wave. The network was therefore told to promote an uncompromising position — effectively, “no concessions” — designed to prolong the conflict and increase the risk of renewed unrest and clashes.

The presence of these and similar directives in the correspondence of a Russian intelligence officer does not mean that Mélenchon himself or members of his immediate circle are directly receiving instructions from Russia.

A more plausible scenario is indirect manipulation: working through people in the politician’s wider political orbit, potentially including individuals sympathetic to Russia, and using them, knowingly or unknowingly, to amplify selected messages.

Sophia Chikirou at an “Immortal Regiment” march. Source: YouTube.

One relevant example is Sophia Chikirou, an LFI member of parliament, party vice-president and close Mélenchon ally who is involved in public communications and may influence protest messaging.

According to the French newspaper Le Canard enchaîné, Chikirou participated in an “Immortal Regiment” march in Paris in May 2025.

Chikirou publicly denied this, saying that she had attended a separate event organized by the Mouvement de la Paix. However, the video linked above appears to contradict her denial.

She has also been associated with public positions opposing Ukraine’s accession to NATO and the European Union — positions critics characterize as pro-Russian.

Challenges ahead

Hostile intelligence services are adept at exploiting society’s deepest fault lines. Genuine efforts by citizens to defend social rights or improve educational conditions can be manipulated and turned into tools of destabilization.

The danger increases when domestic political ambitions or blind spots overlap with the interests of a hostile foreign power.

In such circumstances, an ordinary protester or active online commentator can become part of a covert GRU -run network without necessarily understanding the role they are playing. The boundary between domestic protest and external interference can then become extremely difficult to distinguish.

Calls for critical thinking alone are no longer sufficient to counter such threats.

Modern democracies need to shift toward systematically exposing foreign influence networks before they can act. Such a strategy requires:

• stronger counterintelligence capabilities to identify and disrupt covert influence operations at the planning stage;
• close cooperation with leading analytical centers and independent investigators to rapidly analyze and verify disinformation networks;
• international cooperation with partners that have unique practical experience in this field — particularly Ukraine.

Read also: Sabotage warfare: Russia exports chaos to Europe, but its own home front is becoming increasingly vulnerable

This article was prepared by Louis Martin specifically for readers of InformNapalm volunteer intelligence community website.

Sharing and republication with an active link to the source are welcome. (Creative Commons — Attribution 4.0 International — CC BY 4.0).

Follow the official channels of InformNapalm.