A new investigation by Austrian journalists has uncovered one of Russia’s disinformation operations in Vienna, where Russian agents posed as “Ukrainian neo-Nazis” in order to discredit Kyiv in the eyes of Europe. This example of an operation aimed at manipulating public opinion in Austria was highlighted by the Center for Countering Disinformation.

In March 2025, Austria’s Directorate of State Security and Intelligence (DSN) announced that it had uncovered a large-scale Russian disinformation campaign. The objective was clear: “to manipulate public and political opinion to the detriment of Ukraine and in favor of Russia”. This was not merely online trolling but involved real-world actions on the streets of Vienna, where Russian agents painted buildings with neo-Nazi graffiti and posted provocative stickers. All of this was carried out under the guise of “Ukrainian radicals” in order to create the impression that Ukraine is a threat to European society and is filled with Nazi elements.

The investigation, conducted by journalists from several media outlets, including Profil, Süddeutsche Zeitung, NDR, and WDR, is based on exclusive chats and investigative files. These documents reveal in detail for the first time how Russia coordinates such operations in Europe, recruiting local operatives and moving disinformation from the virtual world onto real city streets.

Key figures: From an Austrian businessman to a Bulgarian spy ring

The central figure in the campaign was Jan Marsalek – an Austrian, former chief operating officer of Wirecard, who fled to Russia after the company’s collapse in 2020. Marsalek, considered one of Europe’s most wanted spies, had reportedly been spying for Russia since his time at Wirecard. He directed the operation, coordinating activities through chat messages. For example, on 24 March 2022, he wrote: “I’m thinking about how to add fuel to the fire and place these stickers in some locations across Europe”. His goal was to stir up anti-Ukrainian sentiment, particularly in Germany, in order to preserve dependence on Russian gas.

The operation was carried out by Orlin Roussev, a Bulgarian national and leader of a criminal group working for Marsalek. Roussev and his associates engaged in espionage activities: they surveilled journalists such as Christo Grozev and Anna Thalhammer, posed as Interpol agents, hacked websites, and passed the phone numbers of Austrian officials to the Federal Security Service (FSB). The group was arrested in London in February 2023 and, in May 2025, its members were sentenced to lengthy prison terms.

Methods of disinformation: from graffiti to fake websites

Russian agents did not limit themselves to the virtual space – they operated directly on the streets:

These activities targeted key countries: France, Germany, Italy, and Austria, with a particular focus on Vienna. The campaign was a classic false-flag operation: Russia created the illusion of a “Ukrainian threat” in order to divert attention from its own aggression. Such operations demonstrate how the Kremlin seeks to cultivate hostility toward the victim of its own aggression – Ukraine.

This type of disinformation serves two purposes: to divide societies and weaken political opponents. It exploits existing social and political cleavages in order to destabilize democracies. Fake stories about “Ukrainian Nazis” are intended to reduce support for Kyiv while preserving Russian influence in Europe.