Russian Intelligence Is Behind the Radicalization of Protests in France: An InformNapalm Investigation

24 Channel is publishing the most interesting findings from a major joint investigation by the InformNapalm community, the 256 Cyber Assault Division hacktivists, and the Ukrainian Militant analytical group, which analyzes intercepted correspondence from a Russian military intelligence officer (Main Directorate of the General Staff, formerly the GRU), which confirms that Moscow spies are actively contributing to the radicalization of protests in France and provoking riots, exploiting real social tensions to heighten tensions and destabilize the situation in France on the eve of the country’s crucial presidential election.

Radical protests have swept France

Contemporary French society is living in a state of “constant social tension.” Footage of mass protests in the education sector, clashes with police, vandalized buildings, burned-out cars, and looted stores has become a regular feature of news broadcasts.

The main driving forces behind these and previous protests are usually left-wing and radical left-wing groups, in particular the Révolution Permanente movement and Jean-Luc Mélenchon's party “Unbowed France” (La France insoumise, LFI) with its media platform L’insoumission. Trade unions, students, and high school students rally around them.

However, recent developments in French street protests have revealed dangerous shifts. The protests are rapidly becoming more radical; demands for the protection of social rights or improved educational conditions are quickly giving way to harsh anti-government slogans, and the actions of certain groups during clashes with the police appear well-organized and coordinated.

The protests in France have domestic causes but have been exploited by external forces / Photo – Getty Images

According to French Interior Minister Laurent Nunes and police prefecture reports, peaceful marches by schoolchildren, students, and labor unions were deliberately infiltrated by coordinated groups of masked provocateurs (casseurs) and radicals dressed in black, intent on violent confrontation and clashes with the police. During just two nationwide demonstrations (17 and 24 October), law enforcement detained approximately 3,400 people.

In just one day, more than 100 people were arrested while in possession of bladed weapons and pre-prepared items intended for attack. Well-trained groups of provocateurs acted according to a clear plan. They deliberately smashed storefronts and cars, looted and set fire to civilian properties, and provoked the police into a harsh response involving the use of special equipment: flash-bang grenades, water cannons, and the like. On October 17 alone, approximately 1,000 police officers and gendarmes were injured.

To contain the unrest, the government was forced to deploy more than 70,000 law enforcement officers, armored vehicles, helicopters, and drones, and also took measures to exert greater control over social media.

Beneficiaries of the Chaos

Russian disinformation networks instantly seized upon the street chaos in France. Staged or out-of-context videos of clashes were spread by thousands of bot accounts. The goal was to create a distorted picture for a European audience of “the beginning of a civil war in France” and to completely overshadow the protesters’ original social demands.

All of this compels journalists and experts to analyze the extent to which external forces interested in destabilizing the situation influence the level of violence and the evolution of the protests.

Russia has long been precisely such a force, and studying its destructive methods in both the physical and digital spheres is important for both France and other Western democracies. Among the simplest and most common tools the Kremlin uses to exert influence in such a socio-political situation are the following:

Public street demonstrations

Hiring random individuals or criminals for small sums of money to carry out provocations “under a false flag”; radical actions (demonstrative defiance, burning flags, vandalizing landmarks or important symbols, graffiti intended to incite religious or interethnic hostility, etc.); infiltration of radical street groups by agents to influence the actions of organizers or individual participants from within, in particular to provoke a harsh response from the police and turn peaceful protests into riots.

Information Sphere

Creating anonymous protest groups on popular messaging apps or infiltrating closed groups under the guise of like-minded individuals; mass dissemination of instructions on how to confront or harm police and neutralize tear gas; operations to discredit key figures in the government or its institutions, where instructions from outside are disguised as “spontaneous outbursts by the discontented.”

The main objective of such actions is not to create new problems, but to exacerbate existing internal conflicts in France as much as possible and undermine trust in state institutions. Radicalization or physical actions are explained and legitimized as a response to illegal or supposedly illegitimate actions by the government or law enforcement agencies, which, as the instigators of the unrest emphasize, run counter to the interests of society.

The Strategy of Russian Intelligence Services: From Media Clones to Information Exhaustion

According to the European External Action Service (EEAS), France has become the second most frequent target of Russian disinformation attacks in Europe, second only to Ukraine.

In 2025, the French agency for protection against digital interference, VIGINUM, officially linked a series of large-scale attacks on French media and government agencies to the activities of Russian military intelligence (GRU) in its report. The goal was to divide society, discredit elections – particularly those involving centrist candidates – and sow chaos and despair.

Main Networks of Russian Influence in France / Infographic – 24 Channel

According to analysts, Military Unit 54777 serves as the main hub for psychological operations and strategic disinformation within the GRU and is specifically responsible for France.

In the information sphere, the unit specializes in deploying covert propaganda networks abroad by establishing front civil society organizations, think tanks, and media outlets.

Investigations indicate that Military Unit 54777 controls the activities of entities such as the media agency “Inforos,” the Foundation for the Support and Protection of Compatriots’ Rights (“Pravfond”), as well as the GOLOS information network, which was later rebranded as the Europe Speaks project.

These projects are overseen by former and current intelligence officers, including Oleksandr Starunsky. This network regularly disseminates manipulative content in French aimed at deepening social divisions, discrediting European institutions, and criticizing France’s foreign policy.

Analysis of the GRU Operation: Impact on Protests in France

One piece of evidence of attempts by Russian intelligence services to take control of the French protest movement is the email correspondence exposed by Ukrainian hacktivists of a career officer in Russian military intelligence – Lieutenant Colonel Stanislav Nemich, who uses the pseudonym “Nikolai Nemov” in official documents and operational correspondence.

Documents of Russian spy Stanislav Nemich (source: InformNapalm):

He spent his entire military career within the Main Directorate of the General Staff of the Russian Armed Forces and its affiliated structures, both within Russia and abroad. In particular, he served at a Russian intelligence facility in Dushanbe (military unit 48216) as well as at the Russian Embassy in Nicaragua. As is well known, the activities of Russian intelligence services in Nicaragua and, more broadly, in Latin America, have traditionally (since the days of the USSR) been largely tied to cooperation with left-wing political movements.

"Interesting" scans from a Russian spy’s email account hacked by cyberattackers (InformNapalm)

Although Nemich is stationed in Novosibirsk, far from the Moscow headquarters of Military Unit 54777, he is a prime example of the Russian Federation’s extensive system of propaganda operations against Western countries, which allows for the creation of a remote “information hub” and minimizes the risk of exposure. His career illustrates an evolution typical of modern Russian intelligence services: from traditional data collection to waging hybrid warfare in the European digital space.

Working through specially created email accounts on domains controlled by Russian intelligence agencies, Lieutenant Colonel Nemich builds a network of fake accounts, anonymous moderators, and individuals infiltrated into protests.

As part of a CYBINT investigation, InformNapalm volunteers gained access to some of Nemich’s correspondence with one of his agents. These messages provide insight into how the operation works specifically in the context of the current French protests.

Lieutenant Colonel Nemich’s typical plan of action was as follows: receiving a mission from higher command, developing ready-made talking points and instructions for subordinate agents operating in both the physical and information spheres, and monitoring the dissemination of relevant narratives among French protest groups and in the media.

Communication between Nemich and a French agent we have not identified takes place via a mailbox. A comparison of the instructions with the correspondence and subsequent events confirms that the agent’s account acted as a catalyst for radicalization, channeling people’s legitimate anger into a course of intense confrontation.

Direct Instructions and the Dissemination of Desired Narratives

The handler sends the agent brief, pre-written recommendations, which the agent is to discreetly plant within French protest communities. In his replies, the agent merely confirms receipt without commenting on the content or methods of carrying out the tasks. Nemich’s profile contains no information about his knowledge of French, so he likely used a translator.

A striking example of how Russian coordinators attempt to influence the protesters’ demands is a letter dated October 11, 2026. In it, Lieutenant Colonel Nemich (“Nemov”) gives his agent a clear instruction – to stir up support among young people for the abolition of Parcoursup (the French national university admissions platform) and to ensure that this slogan is taken up by left-wing leaders, particularly Jean-Luc Mélenchon.

Scan of the letter:

The letter, written in French, states:

Focus your demands, first and foremost, on the abolition of Parcoursup. We expect Jean-Luc Mélenchon to officially endorse this point in his speech. This is very important. You can count on all possible support.

An analysis of the timeline and monitoring of French media show that on the very same day the letter was sent – October 11, 2026 – during a public speech in Clermont-Ferrand, Jean-Luc Mélenchon did indeed make the abolition of Parcoursup one of the central points of his speech to the youth electorate. This daytime speech preceded the evening letter, so it is more a matter of a coincidence between the curator’s demand and the politician’s already stated public position.

That same day, this demand emerged as the main programmatic focus on the official platform of the L’insoumission movement, and over the next few days, it was actively picked up by education media (Le Café pédagogique) and protest groups on social media, turning the abolition of the system into one of the main official demands of the student strikes.

List of sources and monitoring materials for October 12, 2026:

• Jean-Luc Mélenchon’s speech in Clermont-Ferrand on the actu.fr portal
• Official post on the L’insoumission platform regarding the youth program and the speech
• Analytical article “Parcoursup: an archaism from the Macron years” on Le Café pédagogique
• Discussion on the Ohmymag Facebook page about the debate surrounding Parcoursup and high school students’ anger

Another episode from the leaked correspondence of Lieutenant Colonel “Nemov” is an order issued immediately after the first violent street clashes between protesters and security forces. The Russian handler reacted immediately to the first reports of teenage casualties, ordering the agent to add a new, radical demand to the protest agenda: holding law enforcement officers criminally liable.

Scan of the letter:

The Russian’s instruction letter states:

In light of the clashes, a new key demand must be added. The justice system must punish police officers who used unjustified force against high school students or caused serious bodily harm to these teenagers. Formulate a demand calling for the punishment of police officers.

Upon receiving this directive, the infiltrated agent network began actively spreading claims about “systematic police terror against children” across key protest media channels and social media platforms.

In this case, Russian intelligence operatives once again employed a tactic to amplify natural public outrage. Footage of the use of special equipment against young people triggers an automatic emotional reaction among the French. The Russian strategy aimed to transform this spontaneous anger into a systematic demand for police punishment, in order to definitively block any compromise between the government and the protesters, discredit the law enforcement system, and provoke new, even more violent clashes.

Monitoring list indicating the active dissemination of these talking points:

• BFMTV live broadcast on the mobilization and blockades of high schools
• An article by Le Reporter Indépendant on violence against high school students
• Analysis of the situation by Mesinfos (Salon-de-Provence)
• Video statement by La France Insoumise Bron regarding police actions
• Video footage from Journal Fakir on youth mobilization
• Brut Officiel report on the protests
• Dailymotion report on clashes
• Instagram video footage of the protests

The next significant passage from the intercepted correspondence is a directive to scale up the protests by uniting various social groups – the so-called “convergence of struggles” (convergence des luttes). The coordinator set the task of moving beyond purely student/school-based discontent and involving powerful labor unions and veterans of the “Yellow Vests” movement in the street protests.

Scan of the letter:

The exposed directive states:

You must expand the protest movement and involve other forces to converge demands. For future blockades, more actively involve trade unions, particularly the CGT, as well as “Yellow Vests” activists.

Of particular interest to the investigation is the response from the agent who sent a reply to this directive. It contains the Spanish-language slogan ¡Siempre más allá! (“Always further”). We have been unable to confirm it as the official motto of any specific organization – the name is primarily associated with an academic work on the Sandinista movement, an ultra-leftist movement that historically had close ties to Soviet and later Russian intelligence in Latin America.

The presence of this specific phrase in the correspondence may indicate a possible connection between the infiltrated agent and activities within pro-communist and anti-Western networks in Latin America, where he was likely recruited or enlisted to cooperate.

As subsequent events showed, the handler’s expanded instructions corresponded to the situation on the streets. Within just a few days, leading French media outlets and the labor unions themselves began speaking in unison about joining forces for a nationwide day of action on October 17, 2026.

Sources and monitoring materials:

• Unité CGT’s Facebook post regarding the October 17 mobilization
• Mesinfos article on the alliance between the “Yellow Vests,” high school students, and the CGT in Marseille
• RTL’s analytical report on the convergence of the struggle and calls for unity
• A call from “Yellow Vests” leaders on the Contre-Attaque portal
• TF1 Info post on the CGT’s participation in the October 17 protests

Another telling example of this destructive influence is an instruction dated October 15, 2026, discovered in the correspondence of a Russian handler. Just as the French government was attempting to de-escalate tensions and had proposed a videoconference with protest leaders to discuss concessions, Russian intelligence issued a clear directive to derail any dialogue.

Scan of the letter:

The letter states:

The minister has scheduled a video conference with you and the high school student associations in order to weaken the movement by announcing minor concessions. Do not let yourselves be fooled. The movement’s leaders must remain firm: all demands must be met, without any concessions or additional conditions.

As monitoring of French media has shown, representatives of the student movements have taken a sharply uncompromising stance, rejecting attempts at compromise by government officials (particularly following consultations with government representatives), demanding the immediate and full fulfillment of the entire list of ultimatums without any conditions for negotiation.

For the external curator, a successful compromise or the fulfillment of even some of the social demands is unacceptable, as this would halt the wave of protests. Therefore, through infiltrated agents, a maximalist position with no alternative (“no concessions”) is imposed, which is guaranteed to perpetuate the conflict and lead to new unrest and clashes.

Of course, the presence of these and similar directives for the network of agents in the Russian intelligence officer’s correspondence does not mean that Mélenchon himself or his inner circle are directly receiving instructions from Russia. It is likely a more sophisticated manipulation scenario – the use of individuals from the politician’s inner circle, typically sympathizers of the Russian Federation, to nudge them in a certain direction and “use them without their knowledge.”

A telling example is Sophia Chikirou – an LFI lawmaker, the party’s vice president, and a close associate of Mélenchon – who is specifically responsible for public communications and may help craft protest messages.

Ms. Chikirou at an “Immortal Regiment” rally / Video screenshot

As reported by the French publication *Le Canard enchaîné*, Chikirou participated in the Paris “Immortal Regiment” march in May 2025. The lawmaker herself publicly denied this, asserting that she was at a separate event organized by the “Movement for Peace”; however, the video we link to below refutes this denial. She is also credited with making public statements opposing Ukraine’s accession to NATO and the EU, which are viewed as a pro-Russian stance.

Europe Is in Danger

Hostile intelligence services skillfully play on society’s most sensitive nerves, turning citizens’ sincere aspirations to protect their social rights or improve educational conditions into a controlled tool of destabilization.

When the political ambitions or internal blindness of individual actors align with the interests of an external enemy, and an ordinary protester or active online commentator turns out to be part of a covert GRU coordination network, the line between domestic protest and foreign subversion becomes almost imperceptible.

Countering such challenges through appeals to critical thinking has long been insufficient. Modern democracies must move toward the systematic and preemptive exposure of foreign influence networks. Such a strategy requires:

• Strengthening intelligence capabilities for the early detection and interdiction of covert operations while they are still in the planning stage.
• Close partnership with leading think tanks and independent investigators for rapid analysis and verification of disinformation networks.
• International cooperation with partners who have unique experience in this field – in particular, with Ukraine.

How Russia’s GRU is trying to radicalize protests in France – watch the video: