Cognitive Strikes as part of Russian Active Measures

Recently leaked internal files attributed to Russia’s Social Design Agency (SDA) have exposed a set of coordinated influence operations targeting European societies. The SDA, a Russian firm already sanctioned by the US, UK and EU for spreading “deceptive Kremlin propaganda,” operates as a contractor of the Russian Presidential Administration. The leaked documents, obtained by investigative journalists, include internal reports, planning documents and private communications between SDA staff and presidential administration officials.

What makes these documents significant is not just the specific operations they expose. It is the strategic logic Russia uses to carry out those operations. The files refer to a series of activities as “cognitive strikes” against Western audiences. The operations covered in the documents range from coordinated physical provocations targeting Muslim and Jewish communities to election interference efforts and large-scale projects designed to shape public opinion across Europe. Crucially, these documents reveal how Russia conceptualises its influence operations itself, and how far that conception has moved from conventional notions of propaganda or disinformation.

Old Strategy, New Instruments

To understand why this matters, it’s important to understand these operations as part of a longer trajectory.

Aktivnye Meropriyatiya is the Russian term for Active Measures, through which the Soviet Union pursued its foreign policy objectives without resorting to direct military confrontation. These included disinformation, covert influence, support for proxy actors, and carefully orchestrated provocations designed to shape the political environment of adversaries. Active measures did not disappear with the collapse of the USSR. The institutional knowledge behind them was inherited by Russian state structures and adapted to new tools and realities. 

Today, the discussions on Russian influence operations have shifted toward broader concepts like Hybrid Threats, that reflects an important change in understanding. What has changed is not the underlying strategic logic but the ambition and spectrum of the methods. 

Russia’s full-scale invasion of Ukraine has further reinforced the importance of these non-kinetic instruments. As the war became longer and more costly than anticipated, the cognitive front has become a more central instrument of Russian strategy to expand its sphere of influence and destabilise democratic institutions where needed. Their target extends well beyond Ukraine. Increasingly, it is the cognitive infrastructure of democratic societies themselves.

The question this raises is not whether a foreign adversary tries to convince an audience of a particular narrative. The more relevant question is what happens when an adversary stops trying to persuade and instead tries to engineer the social conditions in which persuasion, trust and democratic judgment become harder to sustain. 

Engineering Social Environment

The SDA documents illustrate this logic in concrete terms. Rather than persuading audiences to embrace a specific worldview, these operations seek to weaken the conditions that allow informed judgment in the first place. They manufacture events, as well as exploit existing societal divisions that would generate their own emotional reactions, media coverage and political consequences.

One of the operations described in the leaked reports is called Pig’s Head. In September 2025, severed pig heads marked with the word “Macron” were placed outside mosques and Islamic cultural centres around Paris. French authorities later linked the operation to Serbian nationals acting under the direction of Russian intelligence structures. According to the leaked internal report, the operation involved reconnaissance, logistical planning, coordinated execution, and monitoring of international media coverage afterwards. 

The second operation, internally referred to as Green Synagogues, involved vandalism targeting the Holocaust Museum and several synagogues in Paris, alongside related provocations in Berlin. One stated objective was to discredit French authorities by portraying them as incapable of preventing religious tensions.

The choice to target both Muslim and Jewish religious sites within the same operational period is not incidental. It reflects a deliberate strategy to activate multiple grievance communities simultaneously, increasing the likelihood of friction between them and forcing domestic political actors into a defensive position regardless of how they respond. Different audiences would interpret the same event differently, but all interpretations contributed to greater distrust, stronger emotional reactions and deeper social fragmentation. 

The success metric of these operations therefore does not depend on the content of any single narrative. It depends on the intensity of the public reaction it generates, sustained media attention and polarised debate.

This is not an isolated pattern. Previous disclosures in 2024 revealed efforts by the same agency to undermine Western support for Ukraine and promote far-right political actors during the European Parliament elections. Together, these leaks suggest continuity rather than innovation. The methods evolve. The strategic logic remains remarkably consistent.

A different operational layer

A separate but conceptually related case emerged in the United Kingdom. British authorities have linked the arson attacks targeting property associated with Prime Minister Keir Starmer to individuals allegedly directed through Telegram by Russian-linked handlers. These individuals appear to have had little or no understanding of the operation’s origin, while fabricated online accounts circulated false narratives about the motive for the attacks. 

Operationally, this differs from the SDA operations in its design. What connects it to the broader pattern is the underlying objective. Instead of relying on ideological supporters, hostile actors can increasingly recruit unwitting intermediaries through digital platforms, enabling them to conduct sabotage while maintaining plausible deniability. 

The goal of such operations is to exploit division and destabilize democratic institutions, not to advance a coherent ideological position. Gradually, the physical incident becomes one component of a larger operation combining real-world action, digital amplification and psychological exploitation.

The Leak as a Weapon

One dimension of the leaks of SDA internal documents deserves particular attention. Wide circulation of the SDA documents in Western media may not straightforwardly damage Russian interests. This may unintentionally reinforce perceptions of Russian reach and omnipresence. Such perceptions can themselves become psychologically consequential by fostering a sense that adversaries are pervasive and difficult to deter. Whether this effect benefits Russian interests intentionally or simply emerges as a by-product cannot be established on the basis of the available evidence. Nevertheless, it illustrates a complexity of cognitive operations, where even exposure may shape public perceptions in unintended ways that partially serve the exposed actor’s interests.

Recognising the Terrain

These cases demonstrate that contemporary active measures increasingly rely on engineering social environments rather than simply spreading false narratives. Countering disinformation alone is no longer sufficient when hostile actors increasingly manufacture real-world events specifically designed to trigger predictable social and political responses. 

Building resilience requires a broader approach. Enhancing public awareness is one part of this, particularly the capacity of citizens and institutions to recognise how isolated incidents can be deliberately shaped into broader societal crises. Equally important is closer cross-sector coordination. These operations deliberately move between domains, from religious institutions to electoral processes to individual political figures, in ways that fragmented response structures struggle to track. Most critically, the capacity to identify and attribute hybrid operations early, before their intended cognitive effects fully take hold, remains the most underdeveloped element of the current response. 

Today’s cognitive strikes are not fought solely on battlefields or in cyberspace. They are fought in the cognitive domain, a space where perception, trust and social cohesion have become strategic targets. 

_________________________________________

By Mariam Japaridze - Fellow of Hybrid Threats and Resilience Program at the Strategic Security Initiative (SSI)

Photo: OpenAI