On 13 December 2025, Ukrinform, citing Austrian outlet Profil, reported that Russian operatives have been impersonating Ukrainian neo-nationalists to spread anti-Russian graffiti across Vienna. The operation aimed to undermine Austrian public trust in Ukraine and reduce support for Kyiv within the European Union.
Coordinated operations led by ex-Wirecard executive
Investigations by Austria’s State Security and Intelligence Directorate (DSN) revealed that former Wirecard CEO Jan Marsalek directed a network of agents to execute these actions in public spaces. Marsalek, working alongside Bulgarian associate Orlin Rusev, orchestrated the placement of stickers and graffiti bearing right-wing and neo-Nazi symbols linked to Ukraine’s Azov unit. The campaign involved a mix of extremist imagery with Ukrainian national colours and slogans, designed to create the illusion of Ukrainian activity.
Digital amplification of offline operations
In addition to physical graffiti, Marsalek’s group established websites such as WeAreAzov.eu, NousSommesAzov.fr, and WirSindAzov.de to simulate European Azov chapters. Internal communications indicate that the project was coordinated with Russia’s FSB and intended to provoke strong reactions in Austria and Germany regarding alleged neo-Nazi activism.
Historical parallels and strategic objectives
Austrian disinformation expert Dietmar Pichler highlighted that the approach mirrors Cold War tactics, when Russians painted swastikas across West Germany to disrupt Franco-German rapprochement. The updated strategy integrates digital platforms as force multipliers, seeking to influence Western public opinion, diminish support for Ukraine, and potentially shift EU energy policy in favour of Moscow.
Broader context of Russian influence operations
In recent years, Russia has revitalised its espionage networks and special units targeting Western states, creating the Department of Special Tasks within its military intelligence in 2023 to conduct assassinations, sabotage, and deployment of explosives. These measures form part of a broader “shadow war” combining intelligence operations, sabotage, and information attacks. Western countries, especially EU and NATO members, recognise these acts as threats to political stability, economic processes, and public trust.
Countering disinformation and hybrid threats
Information operations remain a central tool in Russia’s confrontation with Western democracies. Moscow exploits traditional media, anonymous Telegram channels, bot networks, and politically sympathetic actors to propagate disinformation. The objectives include undermining confidence in governments, demoralising societies, disrupting diplomatic initiatives, and reducing international support for Ukraine. EU and NATO members are emphasising counter-intelligence, infrastructure protection, and strategic communication to mitigate these hybrid threats.
