A joint investigation by Delfi Estonia, the Dossier Center, Shomrim, Le Monde, and OCCRP, based on a new leak from the Social Engineering Agency, reveals not only another series of Russian disinformation campaigns but also the operational framework behind their creation. The documents reveal task assignments, source masking, contractor selection, distribution methods, effectiveness metrics, and a reporting chain that, according to the journalists’ findings, leads to structures linked to the Russian president’s administration.
To understand this story, one thing must be emphasized: we are talking specifically about the investigation by Delfi Estonia, the Dossier Center, Shomrim, Le Monde, and OCCRP. Czarne Niebo publishes an editorial summary and analysis of their findings. The most important aspect of the new leak is neither the pig’s head near the mosque nor the separate video about Zelensky’s alleged apartment, but the fact that they turn out to be elements of the same production system: a private contractor, acting in the Kremlin’s interest, designs influence operations just as a marketing agency designs an advertising campaign. Except that it doesn’t sell goods, but rather mistrust, divisions, and political disorientation.
In short:
- A new leak from the Social Engineering Agency shows that Ilya Gambashidze’s organization operated against Ukraine, EU countries, Armenia, and Western audiences, and the documents name Sergey Kiriyenko, Alexander Kharichev, and Sofia Zakharova as participants in the campaign management and coordination system.
- The fake news about “the Zelenskyy family’s apartment in the Burj Khalifa” was described within the Social Design Agency itself as a separate media case: with an analysis of the dissemination, reach, and reactions of Western audiences, and the conclusion that the correction lost out to the viral spread of the false information.
- The operations included not only online posts but also offline provocations: pig heads placed near mosques in Paris, green paint on Jewish community sites, and stickers regarding the Armenian genocide. Those carrying out these actions were instructed to operate covertly, use cash payments, and maintain mandatory photographic documentation.
- The documents confirm a fundamental focus on camouflage: many resources were intended to appear pro-Ukrainian, pro-Western, or local, so that a direct pro-Russian trace would not expose the client.
- The leak shows that the well-known Doppelgänger segment was merely part of a broader system, encompassing media clones, pseudo-expert projects, plans for “legitimate” think tanks, Wikipedia-style knowledge bases, and extensive content distribution networks.
What exactly did the new leak reveal
While a previous investigation from 2024 showed that the Social Design Agency (APS) is linked to the administration of the President of the Russian Federation and is, in fact, a fake news factory, the current leak goes a step further: it reveals the very mechanics of how it operates. You can see how stories are invented, how they are packaged to suit a specific country, how they are planted on the right platforms, how street actions are coordinated with them, and how the results are then captured in reports. This is no longer a story of chaotic propaganda production. It is a controlled process in which every stage has a person in charge, a deadline, and a performance metric.
In these materials, the Social Design Agency appears as a private political-technological subcontractor, embedded within the state apparatus of hybrid influence. Ilya Gambashidze is the operator and public face of this structure. Sergey Kiriyenko, identified in the documents as SWK, appears as a figure of political oversight and coordination. Alexander Kharichev appears as the official who assigns tasks and defines thematic lines. Sofia Zakharova appears to be a key participant in the operational cycle: not as an ideologue, but as the organizer of implementation, adjustments, and steering the campaign toward the desired result. On the technological front, in leaks and expert assessments, Nikolai Tupikin reappears alongside this system—in a new leak, he is listed as Gambashidze’s deputy and the person responsible for information security; the broader infrastructural framework surrounding him is linked to the Structura National Technologies group.
This is also important because, within the internal logic of the Social Design Agency project itself, it is not limited solely to Doppelgänger. Media clones, mirror websites, the Recent Reliable News network—initially operating under the name Reliable Russian News—and similar schemes are just one layer. Alongside them exist comment-generating bots, fake documents, pseudo-expert platforms, fabricated videos, street provocations, paid distribution, and attempts to infiltrate search results. In other words, this is not about a single brand of Kremlin disinformation, but rather a suite of services carried out on political commission.
Fake news as a product for Ukraine and Armenia
The story—which was reported in 2025 by Moskovsky Komsomolets and most pro-Kremlin media—about an apartment in the Burj Khalifa allegedly purchased by Volodymyr Zelenskyy’s family is significant not because it was sensational. It is significant as a model of production standards.
The post had all the hallmarks of a high-quality lie: the exact date of the transaction, the price, a reference to a reputable Middle Eastern TV channel, expensive Armani interiors, and a finished video styled to look like Al Arabiya. Then the familiar logic of social media platforms kicked in: verified accounts on X picked up the video, pro-Kremlin media got an excuse to amplify the message, and audiences were presented with an emotionally convenient conclusion—the West is funding not resistance to aggression, but the luxurious lifestyle of the Ukrainian elite.
The internal report from the Social Design Agency is interesting because it describes not only the creation of fake news but also its dissemination and evaluation of the results: as the authors of the case study noted, Western users were outraged by “Zelenskyy’s corruption,” and the correction received 210 times fewer views than the lie itself.
The fake news story about a villa in Marseille allegedly purchased by Nikol Pashinyan was constructed according to the same pattern, only adapted to the Armenian audience and the local political moment. Here, too, a familiar motif emerges: foreign aid allegedly does not reach a country mired in crisis, but instead goes toward the leader’s personal luxury. This story did not go as viral as the Burj Khalifa case, but it spread across parts of the Armenian media and forced the prime minister to issue a clarification. This is the practical value of such operations for the Kremlin: it is not always necessary to achieve full reach. Sometimes it is enough to force the target to explain themselves and the public to doubt.
Both stories demonstrate how the Social Engineering Agency’s adaptive mechanism works. The country changes, the figure changes, the set of details changes, but the framework remains the same: an elite property abroad, an allusion to the embezzlement of aid, a seemingly credible source, rapid delivery of content to social media and newsrooms, and then—measuring the reaction. That’s not how an editorial office works, not even the most dishonest one. This is how a structure operates that thinks in terms of cognitive operations.
Provocations meant to look local
The new leak is particularly clear where the online world intersects with the offline world. The report on the pig’s head operation near the mosques in Paris does not give the impression of a spontaneous act. It includes reconnaissance, logistics, purchases through intermediaries, the operation’s time window, a set of checkpoints, photos, maps, and a list of media outlets that subsequently covered the incident.
According to the investigation’s findings, the operation was carried out on the night of September 9, 2025, and the documentation itself records not only the plan but also its execution. When security intervened at one of the locations, that was also noted in the report. We are not dealing here with a spontaneous act of vandalism, but with a bureaucratically formalized provocation.
Even more importantly, this case is not an isolated one. Court documents regarding Serbian contractors referenced in the investigation point to a series of similar actions: green paint on Jewish community buildings, stickers regarding the Armenian genocide near the Turkish and Azerbaijani embassies, as well as other incidents across Europe.
According to data from the leak, at least two such cases are directly linked to APS: the green paint operation, which internal correspondence indicated was intended to damage Macron’s image, and the sticker incident, in which contractors were given detailed instructions on security procedures, communication channels, material transport, and the requirement to submit at least six hundred photos of “acceptable quality.” At the same time, the operatives were led to believe they were working either for an Armenian opposition party or for other clients unrelated to Russia.
Some of these plans remained solely on paper, which is also significant. The “Zapływ” project involved floating sex dolls down the Seine bearing the slogan “FUCK MIGRANTS!” to make it look like the work of French right-wing radicals. The “General” plan called for the desecration of the Charles de Gaulle monument “in the name of Ukrainian nationalists.” The documents specifically stipulated that participants “must be convinced that they are acting in the interest of Ukraine and carrying out an order from the ‘Olena Zelenska Foundation.’” This sentence is perhaps more valuable than many high-profile exposés. It shows that the influence factory is designing not only the event itself, but also a false narrative about its origins.
Why was the Russian trace disguised as pro-Ukrainian
The most direct, and at the same time the most telling, part of the leak is the admission that an openly pro-Russian form of communication often only ruins the operation.
One of the documents concerning the Ukrainian direction states explicitly: a direct pro-Russian channel and pro-Russian narratives “threaten to immediately compromise the assets,” and abandoning pro-Ukrainian thematic lines “will expose the client and lead to the collapse of the entire strategic concept of the project.” This is not a tactic used in a single instance. It is a method.
This is the logic behind all operations of the Social Engineering Agency. If action must be taken against Ukraine, the content is disguised as internal Ukrainian criticism, not as the statement of a “Russian patriot.” If the goal is to destabilize France, topics such as migration, interfaith tensions, or the Middle East crisis are exploited to make the event appear local. If the target is Armenia, a local political conflict surrounding Pashinyan is brought into play. If the task is to undermine support for Ukraine in Europe, the resources must appear European and sometimes appeal to a realist, pacifist, or conservative stance, without identifying themselves as a tool of Moscow.
That is why pro-Ukrainian Telegram channels, local front organizations, pseudo-expert publications, and fake civic initiatives are not, for the Social Design Agency, an add-on to its main work, but its normal form.
It is precisely here that it becomes particularly clear why describing this structure with the word “propaganda” is no longer sufficient. Classic propaganda speaks on its own behalf and imposes its point of view. The Social Design Agency operates differently. It builds an environment in which the thesis needed by the Kremlin is voiced by someone else, as if it had emerged from within the target society and coincided with its own fears. In this sense, fake news is merely a shell. The main product is the controlled distortion of political reality.
From media mirrors to pseudo-institutes and Wikipedia clones
The new leak is also interesting because it shows the evolution of the Social Engineering Agency from a fake news factory to a long-term infrastructure. The documents reveal plans to establish a “completely legal” research organization in Israel with an English-language website, followed by versions in German, French, and Spanish. Its founders were to be Israeli citizens holding academic degrees, and the platform itself was to serve as an “authoritative source of information and analysis” for European journalists and analysts. In other words, the goal was no longer a one-off dissemination of false information, but rather to gain trust.
Projects for self-populating knowledge bases for Germany and Armenia follow the same logic—in reality, Wikipedia clones designed to automatically download a corpus of materials, expand the indexed collection of pages, outrank the original in search results, and then allow for targeted editing of necessary biographies and events. The documents also describe practical applications: injecting desired narratives, promoting editorial content via banners, “most read” sections, embedded links, and even influencing users through search result previews. This is no longer a battle for a single news cycle, but an attempt to embed itself within the reference environment from which the user derives “neutral” knowledge.
Against this backdrop, the well-known cluster of operations such as Doppelgänger and networks of news site clones appears to be just one—albeit a notable—technology for content delivery. The leak also reveals other elements: circles of loyal opinion leaders, massive networks of accounts, monitoring of French opposition opinion leaders, AI formats for social media, licensed platforms masquerading as media outlets, and political projects modeled on Mitteleuropa, where, under the banner of an independent Central European actor, directions for the region’s restructuring favorable to the Kremlin were promoted.
This architecture is closer to shadow political consulting and covert influence campaigns than to the old notion of crude propaganda.
Where the documents are credible, and where caution is needed
The documents convincingly demonstrate several things. First, the Social Design Agency systematically produced and packaged disinformation for foreign audiences. Second, the Russian footprint within the operational chain itself was deliberately and methodically concealed. Third, the division responsible for cooperation with officials linked to the administration of the President of the Russian Federation is too prominent in the materials to be considered accidental. Fourth, offline provocations and online posts were not separated in this logic: they constituted different formats of the same campaign.
It is highly likely that the leak also shows that the Social Design Agency operated as a contractor within the competitive environment of the Kremlin’s hybrid war, where not only political tasks matter, but also the struggle for funding, contracts, and access to the budget. In this sense, Gambashidze and his organization resemble a political-technological agency that sells “solutions” to a client and then presents KPIs—Key Performance Indicators.
This explains both the language of the reports and the drive to take credit for outcomes that in reality may have depended on many external factors.
There are, however, limits to what can be considered proven. Not every operation described in the documents can be considered completed simply because it was outlined in the plan. Not every recorded result should be taken at face value, as the internal reporting of such structures almost inevitably leads to exaggerating their own effectiveness. Finally, and most importantly, the leak itself does not prove that the Social Engineering Agency was the sole, or even the primary, tool of Russia’s war of influence. It reveals an important segment of the system, but not the entire system. As was the case earlier with Prigozhin’s structures, there is a risk of mistaking a prominent fragment for the entire mechanism. The value of the investigation lies precisely in the fact that it helps avoid this.
Instead of a sensational conclusion
The most sober conclusion from the new leak is not that the Kremlin is creating fake news again. That was already known. The novelty lies elsewhere: the documents show exactly how the Russian influence operation is organized according to administrative and commercial logic. There is a client, a curator, a political technologist, an infrastructure specialist, an operator, a cover story, a media plan, a budget, metrics, and a report for superiors.
There is even the inevitable internal bureaucracy—with follow-up questions after hacks, aliases, presentations, and reports on successes and failures. The product of this machine is not only the lie itself, but also a designed environment conducive to false conclusions.
This is precisely why the story of pig heads at mosques, the fake apartment in Burj Khalifa, Pasinian’s fictional villa, stickers regarding the Armenian genocide, and Wikipedia clones should be read as a single narrative. All of this is not a collection of excesses, but a catalog of methods. A new leak from the Social Engineering Agency shows that Russia’s influence infrastructure can simultaneously function as a PR agency, a factory for political operations, a digital contractor, and a service for covert interference. The only difference is that its output is not advertising or mere propaganda, but systematically designed disinformation, destabilization, and testing of the resilience of democratic societies.
This text for Blacksky.info was prepared by Artur Żak based on a joint investigation by Delfi Estonia, the Dossier Center, Shomrim, Le Monde, and the OCCRP International Consortium of Investigative Journalists titled “A Pig’s Head from the President’s Administration: New Details on the Activities of the Most Scandalous Fake News Factory.”
- https://dossier.center/pighead
- https://dossier.center/fake-fabric
- https://ekspress.delfi.ee/artikkel/120585817/ekspressi-paljastus-vandaalitsemisi-euroopa-linnades-organiseerisid-putini-kasilased
- https://www.shomrim.news/eng/leaked-kremlin-files-reveal-russian-plot-to-spread-chaos-across-europe-and-israel
- https://www.lemonde.fr/pixels/article/2026/05/24/tetes-de-cochon-synagogues-vertes-dans-les-coulisses-des-operations-de-desinformation-russes-visant-la-france_6693205_4408996.html
- https://www.occrp.org/en/investigation/leaked-documents-reveal-russian-cognitive-strikes-against-the-west-including-islamophobic-pig-head-attacks-in-paris
