It all begins on the night of October 26th to 27th, 2023 in the 10th arrondissement of Paris, at the intersection of Rue de Belzunce and Rue de Rocroy. It's just after 2 a.m. The sidewalks are deserted. A resident goes out into the fresh air to smoke a cigarette. At the foot of his building, he asked a passerby to light a fire: “He told me in French that he didn't have one, so I had to come back and get my lighter.” He then observes strange behavior from his window: “I see one Woman and a man dressed in black, hoods on their heads, standing back as if they were on guard. I see a stencil with a Star of David. When I saw that the woman had spray-painted several stars, I called the police. When the two people were arrested, the neighbor observed another scene: “A third person took photos of the trailers while she was on the lookout. It was clear to me that she was in cahoots with the couple, and I immediately recognized the man I was asking about.” a light. The latter will flee without worry.
When the couple was taken into police custody, it was discovered that they had Moldovan nationality. He had recently arrived at Beauvais Airport from Chisinau, the capital of Moldova. Because they are in an irregular situation, the prefecture takes them to a detention center and orders their expulsion. The ten or so marked stars are deleted very quickly. The intervention then remains unnoticed.
But three nights later, a second team painted the same Stars of David, this time unmolested. Around 250 tags can be found in three districts of Paris (14th, 15th and 18th) as well as in several suburban towns (Saint-Ouen and Saint-Denis in Seine-Saint-Denis; Issy-les-Moulineaux, Fontenay-aux-Roses and Vanves in Hauts-de-Seine). The emotions there are immense. Social networks use it, as does the media. Most comments equate these drawings with the outbreak of anti-Semitic attacks in France and around the world. Israel's ground offensive in the Gaza Strip has just begun, less than a month after the Hamas attacks.
Photo taken by a witness of the first operation in the 10th arrondissement of Paris on the night of October 26th to 27th, 2023. (RADIO FRANCE INVESTIGATION UNIT)
However, several elements do not fit together. “Compared to other anti-Semitic acts, this is an atypical operation,” admitted Paris police prefect Laurent Nuñez on BFMTV a few days later. The company actually seems to be too well organized. And the Paris prosecutor's office will find that there are close links between the first and second tagging teams. In the surveillance camera videos recorded on the second night, a man and a woman can be seen accompanied by a third person. “We assume that this third person was the same person who accompanied the first couple,” explains the spokesman for the public prosecutor’s office. In other words: the photographer. According to a source familiar with the case, confirming information from Libération, the second team managed to escape to Brussels on a Flixbus. She had also arrived at Beauvais Airport in France from Moldova. And just like the first team, she had stayed in a hotel in the 9th arrondissement of Paris.
A pro-Russian sponsor
Thanks to the statement of the imprisoned couple, the investigation is progressing very quickly. He names a sponsor: Anatoli Prizenko, a 50-year-old Russian-speaking Moldovan, married with two children, who lives near Chisinau, the capital of Moldova. The man contacted by Radio France's investigative unit through his social networks admits to having ordered the operation, but gives us a surprising justification. “It was an act of support for the Jews, because the stars were blue, like the colors of the national flag of Israel,” he wrote to us. The uproar in the press was caused by the statements of your mayors, the Prime Minister, Ministers and Prosecutor. It is their misinterpretation that has caused so much outrage.”
Surprisingly, Anatoly Prienko even goes so far as to claim authorship of the march against anti-Semitism that brought thousands of people together on the streets of Paris on November 12th. “Thanks to this operation, French society was able to have a dialogue,” he claims, affirming that he acted at the request of an organization called “Shields of David,” which he portrays as a group of anonymous Jews from Europe. However, we have found no trace of his existence and no one has been able to confirm his words.
However, Anatoli Prizenko's analysis of social networks pointed us to a different hypothesis. The man who presents himself as an entrepreneur extolling the virtues of a cosmetics brand (Oriflame, a Swiss-Swedish company) has a very strong opinion in favor of Russia. A position confirmed by Moldovan journalist Victor Moșneag from the newspaper Ziarul de Gardă: “We found out that he had advocated for Moldova to join the customs union with Russia and Belarus,” he specifies. Victor Moșneag also evokes a more sulphurous side to the character. Anatoly Prizenko was in prison. He was suspected of being the representative of a Russian company (MMM Global) in Moldova that defrauded thousands of savers using a snowball pyramid. He was eventually released but not convicted.
Screenshot of a (translated) Facebook post by the Moldovan police about Alexandre Cocii. (RADIO FRANCE INVESTIGATION UNIT)
The Russian leadership is also bolstered by the profile of the first-team man who was arrested in Paris. His name is Alexandre Cocii. He is also a Russian-speaking Moldovan. Aliona Ciurca, journalist at Radio Europa Liberă (member media of Radio Free Europe, funded by the US Congress), was able to speak with him: “He confirmed that he had gone to Paris and admitted that he knew Anatoli Prizenko,” tells us – elle. We also found photos of him on the Internet taken during the pro-Russian demonstrations in Chisinau in October 2022.”
Fake pro-Russian accounts
The Russian route is also preferred in France today, but for different reasons. On November 9, the Quai d'Orsay denounced Russia's digital interference by relying on the technical expertise of Viginum, the agency responsible for monitoring foreign interference on the Internet. In fact, it identified 1,095 fake accounts as of October 27, at a time when they had not been seen anywhere else. So everything indicates that the hosts of these fake accounts were aware of the tagging operation or were even involved in it.
However, Viginum believes this action is part of a much larger digital information manipulation campaign that it calls RRN. The three letters were chosen based on RRN.world [Viginum recommande d’adopter toutes les précautions d’usage en cas d’accès à cette adresse]. This site is widely promoted by the fake accounts that published the Stars of David and presents itself as a medium whose content is clearly oriented, according to Marc-Antoine Brillant, the director of Viginum. “They criticize the West’s support for Ukraine,” he explains. “They accuse Ukraine of war crimes or illustrate Russia's war aims by accusing the Ukrainian regime of neo-Nazis.” This website was first registered in Russia in March 2022 under the name Reliable Russian News before becoming Reliable Recent News the following summer was renamed. He publishes in many languages and has his own Facebook, X or Telegram accounts.
Screenshot of the link to the “War on Fakes” website published by the Russian Embassy in Paris on March 6, 2022 on Facebook. (CELLULE INVESTIGATION DE RADIO FRANCE)
The agency linked RRN to another website called War on Fakes. This presents itself as a medium for information verification, but also primarily promotes Russia and is hostile towards Ukraine and the West. War on Fakes was recorded on March 1, 2022 by Timofey Vasiliev, a Russian citizen who worked for ANO Dialog, a company accused of conducting online propaganda operations on behalf of the Russian government, according to an investigation by the Russian-language media company based in Latvia emerges from Meduza.
Anti-French propaganda
But that's not all. In its report published in June 2023, Viginum identified 353 RRN-affiliated websites whose addresses were promoted by the same fake social media accounts. Among them we find websites that present themselves as reliable sources of information: “True Maps”, which lists the children killed in Donbass, and “Tribunal Ukraine”, which denounces the crimes allegedly committed by the Ukrainian army. Other websites have French-sounding names. This is the case with “La France Indépendante”, “La Virgule”, “Allons-y” or “Notre Pays”. All represent the same pro-Russian and anti-Ukrainian line. And by finding out who was behind it, Viginum identified a Russian company, IP Team, whose name had already appeared in an investigation by Marianne published in June 2022. French YouTubers were then asked to spread Russian propaganda.
According to Viginum, these websites use automatic translation software, but also have real French-speaking editors, some of whom work in the heart of the European Union. National Rally MEP Thierry Mariani confirmed information from Le Monde and told us how he reacted to an interview published on RRN in May 2023. “It was after a meeting in the European Parliament,” recalls the former minister, who does not hide his closeness to Russia. “The questioner was about thirty years old and spoke French well. He presented his media as Russian media,” explains Thierry Mariani.
Screenshot of a publication on X (ex-Twitter) by RN MEP Thierry Mariani, May 25, 2023. (X.COM)
RRN also interviewed former “yellow vests” Thierry-Paul Valette last December. The video was discovered by a collective of Russian citizens, bot blockers, which documents the activities of fake accounts on social networks. Thierry-Paul Valette says he was contacted by a certain Alexandre via a Russian number. The man wrote to him: “You are an influential politician with a personal and interesting view of French politics.” The interview is part of RRN's editorial line, which is always very critical of Emmanuel Macron and France. Reconquête's Auvergne-Rhône-Alpes regional advisor, Stéphane Blanchon, also recently gave an interview to RRN.
The journalist who contacted Thierry-Paul Valette did not want to answer us, but the analysis of his social networks revealed that he is 31 years old, married and a father. He states that he completed part of his studies in France but now lives in Moscow, where his employer is REN TV, a Russian television channel.
Usurped names of media and institutions
However, the activity of the “RRN system” is not limited to these locations. This network's fake accounts also posted links to other websites posing as major media outlets or public institutions. In France, many titles suffered: Le Parisien, Le Point, Le Figaro, Le Monde, La Croix, 20 Minutes and Libération. For example, in October 2023 we saw a false article from Libération about bed bugs, published at a time when there was strong controversy on the subject in France. He accused Ukrainian refugees of being responsible for the spread of these insects. And there are hundreds of examples like this. To mislead readers, counterfeiters use a technique called “typosquatting.” This involves imitating the address of the copied websites by changing some details, such as: For example, an added hyphen, two letters reversed, or a different domain name (e.g. .com, .ltd, .foo, or .online instead of .fr). . This practice has earned this network another name: Doppelganger, which can be translated as “twin” or “doppelgänger” in German.
The German Interior Ministry and the French Foreign Ministry were also victims. The fake website published a fake press release announcing the introduction of a tax in France to finance aid to Ukraine. The Quai d'Orsay obtained the deletion of this page by appealing to the World Intellectual Property Organization (WIPO) (link to a PDF document). The procedure then revealed that the sponsors had planned to copy the websites of the main French ministries. Their addresses were registered but could not be activated in time.
The Kremlin in the background
Who is behind this extensive network? A first answer came from Meta. In December 2022, the American corporation (owner of Facebook, Instagram and WhatsApp) appoints two Russian companies: Structurea and ASP (Social Design Agency in English). It turns out they spent $105,000 on targeted advertising to distribute their content. Structurea was officially founded in 2009 to sell IT tools. It has more than 500 “experts and specialists” in five Russian cities, including Moscow and St. Petersburg. His clients included the Russian Interior Ministry, the Moscow government and even the Federal Duma (the equivalent of the National Assembly), according to analysis of the now-deleted website.
Screenshot (translated) of Social Design Agency (or ASP in Russian) clients on the company's website, January 2024. (-)
For its part, ASP was founded in Moscow in 2017. It is a company that specializes in video editing, translation or website creation. On the website, which is still online, we can find a large proportion of Structurea's customers, including Russian government institutions. These two companies were added to the list of companies sanctioned by the European Union in July 2023, as was their director, a certain Ilya Gambachidze, former adviser to the Vice President of the Duma.
It also emerged that some of the content produced by the RRN network was promoted by the Russian diplomatic network abroad, including by the Russian embassy in France. She shared a link to the War On Fakes website on March 6, 2022, at the very beginning of the invasion of Ukraine. “This operation continues and produces disinformation every day,” notes Alexandre Alaphilippe, director of Disinfo.eu, an association that fights against the manipulation of information from Brussels. “She is stubborn and resilient.” An operation whose true extent is still difficult to estimate. In December 2023, a network of fake TikTok accounts was also dismantled. However, thousands of these profiles once again came from Russia. According to the BBC and think tank Atlantic Council's Digital Forensic Research Lab (DFRLab), which uncovered the incident, the videos they highlighted were seen by tens of millions of people.
Notify the Radio France investigative unit. To submit information anonymously and securely to Radio France's investigative unit, you can now click on alarmer.radiofrance.fr