PARIS — Vladimir Putin’s shadow loomed large inside Paris’ bright, light-wood-lined modern courthouse on the second day of the trial of four Bulgarian men accused of conspiring to tag red handprints on the Paris Holocaust memorial in a suspected Russian hybrid war operation.

The proceedings, which last until Friday, have pulled back the curtain on what appears to be a modus operandi for Putin’s spooks, even if the Russian leader was not mentioned by name.

“We are not fooled, we know where this comes from” the prosecutor leading the case said — even if the four suspects were not, as she explained, “the best Russian spies on Earth.”

Confidential background notes from the Direction Générale de la Sécurité Intérieure, France’s domestic intelligence agency, partly cited in court and seen by POLITICO, alleged that two of the suspects “received instructions in Russian from unknown individuals via the encrypted messaging app Telegram.”

The fact that the group came all the way from Bulgaria for the tagging “confirms intelligence according to which they are part of a broader operation to destabilize public opinion,” the confidential notes read. And the French government’s disinformation experts have traced amplification of the read hands news reports by thousands of fake accounts linked to Russia.

According to background intelligence notes read out in court, the red hands stunt follows the blueprint of typical hybrid war operations, where individuals are hired and paid to “accomplish a mission at the behest of an intelligence service” even if these so-called “proxies” do not know who is ultimately pulling the strings.

“The hiring of these proxies takes place within a specific hierarchy, with an intelligence officer at the top, with an intermediary usually based in a satellite country, himself in touch with Russian speaking individuals hired via social media and Telegram for paid missions,” according to the readout.

Russian proxies are also suspected in nine other similar cases currently being investigated by French judges that seemed designed to exploit and deepen societal fissures within the country.

Division of labor

The note seen by POLITICO accused Nikolay Ivanov, 42, and Mircho Angelov, 27, of being “main organizers” and receiving marching orders via Telegram, with Ivanov seen as the likely ringleader, “with higher hierarchical rank.”

Angelov, who remains at large, has been presented by the rest of the group as the operation’s main organizer on the ground, handing over instructions as to where to paint red hands during a two-night raid which culminated in the defacing of the Shoah Memorial in the French capital’s old Jewish neighborhood.

Ivanov, a slim man who in court wore a sweatshirt, wasn’t in Paris for the raid but admitted to paying hotel nights and bus tickets for the group — he said he did it as a service to Angelov.

Ivanov was born in the eastern Ukrainian Donbas region before the fall of the Soviet Union, spent several years in Russia and was a member of a pro-Russian paramilitary group, according to background research cited in court. He had in the past “regular contacts with a pro-Russian activist arrested by Ukrainian services in 2014 and a former high-ranking member of a Russian intelligence service,” the judge said in court.

Ivanov denied being pro-Russian and said he had no detailed knowledge of the red hands operation when he booked travel on behalf of the group.

“I’m a pacifist,” he said.

Paid work

The other two suspects, Georgi Filipov, 36, and Kiril Milushev, 28, were casual acquaintances of Angelov, whom they said offered them money in exchange for their participation in an operation “for peace.”

Milushev said he initially accepted the offer to travel to Paris for recreational purposes and was only enrolled to film the operation once on the ground.

Filipov, who like Angelov bears large neo-Nazi tattoos on his chest, admitted to tagging the Holocaust memorial with Angelov and dropping coffins near the Eiffel Tower in a subsequent operation, but said he only accepted for financial reasons as he was strapped for cash and needed to pay child support — he received €1,000 for the tagging operation.

Shortly after the Paris trip, three members of the group traveled to Germany and Switzerland, where they are suspected of having participated in other hybrid war operations, knowingly or not.

In France, the men are only formally accused for their role in defacing the monument and suspected antisemitic motives. All three men accepted responsibility for the first charge but denied the latter.

France only recently beefed up its legal arsenal against foreign interference and created ad hoc, tougher penalties for violence “committed at the behest of a foreign power.”

Those laws were adopted last year after the government began officially pointing to Russia as the orchestrator of a series of high-profile stunts designed to sow chaos in France.

The prosecutor nonetheless called for the judges to take into account the hostile intent and organized character of the operation when asking them to hand four-year prison sentences to Ivanov and Angelov, and two-year sentences to Filipov and Milushev.