The quiet streets of Prague, usually bustling with tourists and the hum of daily life, became the unlikely setting for a shadowy operation that reveals the evolving nature of modern espionage. A team of Russian operatives, posing as innocuous documentary filmmakers, attempted to embed themselves in the fabric of European society. Their mission was not to capture breathtaking scenery or local culture, but to gather intelligence and sow discord under the guise of artistic expression. This wasn’t a scene from a Cold War thriller; it was a meticulously planned covert operation by the notorious Russian propaganda network Rybar, a group sanctioned by the European Union and the UK for its destabilizing activities. The encounter was exposed by Czech investigative journalists from Seznam Zprávy, who confronted the crew, causing them to flee, a moment that highlighted the audacity and the inherent fragility of such missions when they meet an unexpected and informed resistance.
The operation in Prague serves as a stark reminder that despite years of sanctions and diplomatic condemnations, Moscow’s operatives continue to move with surprising freedom within the very borders of the nations they seek to influence. The propagandists, holding residence permits for EU countries, particularly Germany, exploited the open-border policy of the Schengen Area to travel and execute their plans. Their cover was a documentary series on Europe’s sociopolitical situation, a seemingly benign subject that provided the perfect pretext for soliciting interviews with local experts, politicians, and influencers. This maneuvering demonstrates a sophisticated understanding of soft power and intelligence gathering, blending the lines between journalism, political analysis, and active measures. The fact that these individuals could slip through the cracks, holding legal status in one EU state while conducting clandestine work in another, underscores a significant gap in the collective security and intelligence-sharing apparatus of the West. It is a bureaucratic and strategic blind spot that adversarial actors are all too willing to exploit, and the Rybar case is a textbook example of this failing.
At the heart of this operation lies the figure of Mykhailo Zvinchuk, the founder of Rybar, a man who has become a key architect of Russian digital propaganda and influence. While the name may not be a household word in the West, his network has become a powerful digital weapon in Russia’s arsenal, particularly concerning the war in Ukraine. Zvinchuk’s reach is so significant that the US State Department has placed a $10 million bounty on his head and eight others tied to the project. The sanctions imposed by the EU and the UK further illustrate his importance; the EU sanctions justification explicitly links Rybar to a working group established directly by Vladimir Putin in December 2022 to coordinate Russia’s mobilization and war efforts. This moves Rybar beyond the realm of mere online commentators and classifies them as a pseudo-official state organ, a direct operational arm of the Kremlin’s war machine. The prize on Zvinchuk’s head is not just for spreading narratives, but for his role in coordinating destabilization efforts in foreign elections and contributing directly to the destabilization of Ukraine, marking him as a strategic asset rather than a mere propagandist.
The production details of the Prague operation traced back to a Moscow-based producer named Boris Dvorkin, a key figure in assembling the behind-the-scenes machinery of the propaganda effort. Dvorkin is connected to a stream of funding emanating from the History of the Fatherland Foundation, a state-backed organization established by Putin’s decree and currently headed by Sergei Naryshkin, the chief of Russia’s Foreign Intelligence Service (SVR). This connection is the smoking gun that ties the seemingly independent propaganda project directly to the highest echelons of Russian state intelligence. The financial trail suggests that this is not a rogue operation but a deeply institutionalized effort, funded and directed by the state. The foundation’s role is to frame historical narratives that support the Kremlin’s worldview, and its funding of a project that produces ostensibly “documentary” content in Europe is a blatant attempt to weaponize history and current affairs for strategic gain. This connection to the SVR adds a dangerous layer of legitimacy and capability to the operation, implying that these film crews are not just content creators but potentially intelligence collectors, gathering material on European psychological vulnerabilities and political divisions for future exploitation.
While the Prague incident was thwarted, the intelligence gathered by Czech investigators suggests that this was merely one piece of a much larger puzzle. Similar filming operations were allegedly planned or already carried out across a swath of European nations, including Czechia, Slovakia, Austria, Hungary, Serbia, and France. This isn’t an isolated incident but a coordinated, multi-pronged campaign to map the European political landscape. The choice of countries is telling; it includes states with different perspectives on the war in Ukraine, from staunchly pro-Ukrainian nations to those with more ambivalent or even pro-Russian sentiment. By operating in both, Rybar aims to amplify existing fractures, exploit regional grievances, and build a network of sympathetic voices. The strategy involves creating a bank of content that can be sliced, diced, and repurposed to serve specific narratives for different audiences. A quote from a fringe politician in one country could be used to fuel nationalist sentiment in another; an interview about economic hardship could be spun into a broader story about the failure of Western leadership. This is high-level psychological warfare, conducted not on a traditional battlefield, but in the public squares and media outlets of Europe, and it has been running largely under the radar of mainstream law enforcement.
The Rybar case demonstrates that the West’s response to Russian covert action remains dangerously insufficient, trapped in a cycle of belated sanctions and reactive condemnations. The UK’s decision to sanction Rybar in December 2025, followed by the addition of ten more staff members in July 2026, and the ongoing sanctions from the EU, show a persistent willingness to name and shame, yet they have failed to meaningfully stop the operations. These actions are often reactive, taken after the damage has been done, and they lack the aggressive enforcement mechanisms on the ground that would actually neutralize such threats. It is a cat-and-mouse game, where the West issues a proclamation, and the Russian intelligence apparatus simply changes its tactics, finds new enablers, or sends new personnel. The ability of Rybar operatives to hold EU residence permits and travel freely for years indicates that sanctions are not being translated into practical action by national law enforcement and intelligence agencies. The problem is systemic; a lack of cohesive, cross-border police action and a failure to prioritize these low-level operatives as critical threats allows them to operate with relative impunity within the heart of Europe. Until the West shifts from a policy of symbolic condemnation to one of proactive, disruptive action—actively dismantling these networks, deporting operatives, and freezing their assets—the likes of Rybar will continue their work, chipping away at the foundations of European democracy, one hidden camera at a time.