Intercepted emails published by InformNapalm allegedly show GRU officer Lt. Col. Stanislav Nemich directing an agent network to radicalize and steer October 2026 protests in France—shaping demands, spreading narratives about "systemic police terror against children," blocking compromise with the government, and possibly exploiting pro-Russian figures around Jean-Luc Mélenchon.

Cyber & Information WarfareInformation OperationsPropaganda & disinformation campaigns

Aggressor

Summary

Thread by French researcher David Colon summarizing a CYBINT-based InformNapalm investigation alleging that Russian military intelligence (GRU) officer Lt. Col. Stanislav Nemich (also rendered Nemitch, using the pseudonym "Nikolaï Nemov") covertly sought to radicalize and steer protests in France in October 2026. According to intercepted email correspondence obtained by InformNapalm with hacktivist group 256 Cyber Assault Division and analysis group Ukrainian Militant, Nemich operated via email accounts on domains controlled by Russian intelligence to direct an unidentified agent in France and a wider network of infiltrated actors and anonymous moderators. InformNapalm assesses that Russian intelligence attempted to exploit real societal cleavages in France by amplifying protester grievances, recruiting additional participants, promoting convergence of demands across social groups, and blocking compromise between protesters and authorities. Concrete examples cited include: (1) a directive dated 11 October 2026 instructing the agent to promote the abolition of the Parcoursup university admissions platform among youth and ensure that this demand is echoed by left-wing figures, particularly Jean-Luc Mélenchon (who had already raised it that afternoon in Clermont-Ferrand); (2) after the first street clashes between protesters and police on 13 October, an order to add a radical demand for criminal prosecutions of law enforcement officers, accompanied by a coordinated narrative about "systemic police terror against children" pushed through media and social channels linked to protest movements, with the goal of discrediting police, preventing compromise, and provoking further violent confrontations; (3) on the same day, instructions to intensify protests by uniting various social groups through a "convergence of demands"; and (4) on 15 October 2026, when the French government sought to defuse tensions via a proposed videoconference with protest leaders to discuss concessions, a directive from Russian intelligence to use infiltrated agents to impose a rigid, maximalist stance, thereby derailing dialogue and ensuring renewed unrest. InformNapalm further hypothesizes, based on this correspondence, that Russian intelligence may be exploiting pro-Russian individuals in Jean-Luc Mélenchon's inner circle, potentially steering them or "using them unwittingly" without their awareness of Moscow's true objectives. Colon endorses InformNapalm's conclusion that modern democracies must move beyond appeals to "critical thinking" and instead systematically and proactively expose foreign influence networks.

Classification

Confidence: High

The thread provides specific names, roles, dates, operational methods, and direct quotes from InformNapalm about Russian GRU-directed influence efforts targeting French protests. The activity is clearly hostile and covert, fitting the Hybrid Signal definition (primary focus on the aggressor's operation rather than on defensive measures). Evidence credibility is moderate because underlying emails are not directly visible and rely on InformNapalm and associated hacktivist sources, but the patte...

Source URL

https://x.com/Colon_David/status/2120535640588558784?s=20

Open source

Provenance

Publisher: extension
Submitted: Nov 13, 2026, 07:37 UTC
Last updated: Nov 13, 2026, 11:37 UTC
Event time: Oct 11, 2026, 00:00 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "df880131-041f-4317-a887-caa3a4c0b479",
  "url": "https://x.com/Colon_David/status/2120535640588558784?s=20",
  "source": "extension",
  "status": "processed",
  "category": "Cyber & Information Warfare",
  "subcategory": "Information Operations",
  "incident_type": "Propaganda & disinformation campaigns",
  "country": "France",
  "source_reliability": "F",
  "info_credibility": "6",
  "tags": [
    "Russia",
    "GRU",
    "inform napalm",
    "256 Cyber Assault Division",
    "Ukrainian Militant",
    "France",
    "Jean-Luc Mélenchon",
    "Parcoursup",
    "Protests",
    "Foreign influence",
    "Information operations",
    "Narrative manipulation",
    "Radicalization",
    "Email interception",
    "CYBINT",
    "Police-protester clashes",
    "Systemic police terror narrative",
    "Convergence of demands",
    "Sabotage of dialogue",
    "Infiltrated agents",
    "Anonymous moderators"
  ],
  "nodes": [],
  "countries": [],
  "where_text": "Cyberspace",
  "headline": null,
  "description": "Thread by French researcher David Colon summarizing a CYBINT-based InformNapalm investigation alleging that Russian military intelligence (GRU) officer Lt. Col. Stanislav Nemich (also rendered Nemitch, using the pseudonym \"Nikolaï Nemov\") covertly sought to radicalize and steer protests in France in October 2026. According to intercepted email correspondence obtained by InformNapalm with hacktivist group 256 Cyber Assault Division and analysis group Ukrainian Militant, Nemich operated via email accounts on domains controlled by Russian intelligence to direct an unidentified agent in France and a wider network of infiltrated actors and anonymous moderators. InformNapalm assesses that Russian intelligence attempted to exploit real societal cleavages in France by amplifying protester grievances, recruiting additional participants, promoting convergence of demands across social groups, and blocking compromise between protesters and authorities. Concrete examples cited include: (1) a directive dated 11 October 2026 instructing the agent to promote the abolition of the Parcoursup university admissions platform among youth and ensure that this demand is echoed by left-wing figures, particularly Jean-Luc Mélenchon (who had already raised it that afternoon in Clermont-Ferrand); (2) after the first street clashes between protesters and police on 13 October, an order to add a radical demand for criminal prosecutions of law enforcement officers, accompanied by a coordinated narrative about \"systemic police terror against children\" pushed through media and social channels linked to protest movements, with the goal of discrediting police, preventing compromise, and provoking further violent confrontations; (3) on the same day, instructions to intensify protests by uniting various social groups through a \"convergence of demands\"; and (4) on 15 October 2026, when the French government sought to defuse tensions via a proposed videoconference with protest leaders to discuss concessions, a directive from Russian intelligence to use infiltrated agents to impose a rigid, maximalist stance, thereby derailing dialogue and ensuring renewed unrest. InformNapalm further hypothesizes, based on this correspondence, that Russian intelligence may be exploiting pro-Russian individuals in Jean-Luc Mélenchon's inner circle, potentially steering them or \"using them unwittingly\" without their awareness of Moscow's true objectives. Colon endorses InformNapalm's conclusion that modern democracies must move beyond appeals to \"critical thinking\" and instead systematically and proactively expose foreign influence networks.",
  "summary_short": "Intercepted emails published by InformNapalm allegedly show GRU officer Lt. Col. Stanislav Nemich directing an agent network to radicalize and steer October 2026 protests in France—shaping demands, spreading narratives about \"systemic police terror against children,\" blocking compromise with the government, and possibly exploiting pro-Russian figures around Jean-Luc Mélenchon.",
  "summary_extended": null,
  "actor_primary": null,
  "target_primary": null,
  "location_text": "France",
  "location_region": null,
  "location_coordinates_lat": 46.227638,
  "location_coordinates_lon": 2.213749,
  "location_precision": "Regional",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The thread provides specific names, roles, dates, operational methods, and direct quotes from InformNapalm about Russian GRU-directed influence efforts targeting French protests. The activity is clearly hostile and covert, fitting the Hybrid Signal definition (primary focus on the aggressor's operation rather than on defensive measures). Evidence credibility is moderate because underlying emails are not directly visible and rely on InformNapalm and associated hacktivist sources, but the patte...",
  "event_time_utc": "2026-10-11T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "pm24h",
  "created_at": "2026-11-13T07:37:00.076Z",
  "updated_at": "2026-11-13T11:37:15.310Z",
  "reliability_band": "pattern",
  "location_precision_band": "regional",
  "time_precision_band": "within_24h",
  "severity_band": "moderate",
  "attribution_basis": "single_source"
}

Public assessmentReliability: Pattern fitSeverity: ModerateSingle sourceTime: Same dayLocation: Regional

Source reliability

Info credibility

Event time

Oct 11, 2026, 00:00 UTC

Event time confidence

pm24h

Location

France

Country

France

Tags

Russia, GRU, inform napalm, 256 Cyber Assault Division, Ukrainian Militant, France, Jean-Luc Mélenchon, Parcoursup, Protests, Foreign influence, Information operations, Narrative manipulation, Radicalization, Email interception, CYBINT, Police-protester clashes, Systemic police terror narrative, Convergence of demands, Sabotage of dialogue, Infiltrated agents, Anonymous moderators

Loading signal...

{ "id": "df880131-041f-4317-a887-caa3a4c0b479", "url": "https://x.com/Colon_David/status/2120535640588558784?s=20", "source": "extension", "status": "processed", "category": "Cyber & Information Warfare", "subcategory": "Information Operations", "incident_type": "Propaganda & disinformation campaigns", "country": "France", "source_reliability": "F", "info_credibility": "6", "tags": [ "Russia", "GRU", "inform napalm", "256 Cyber Assault Division", "Ukrainian Militant", "France", "Jean-Luc Mélenchon", "Parcoursup", "Protests", "Foreign influence", "Information operations", "Narrative manipulation", "Radicalization", "Email interception", "CYBINT", "Police-protester clashes", "Systemic police terror narrative", "Convergence of demands", "Sabotage of dialogue", "Infiltrated agents", "Anonymous moderators" ], "nodes": [], "countries": [], "where_text": "Cyberspace", "headline": null, "description": "Thread by French researcher David Colon summarizing a CYBINT-based InformNapalm investigation alleging that Russian military intelligence (GRU) officer Lt. Col. Stanislav Nemich (also rendered Nemitch, using the pseudonym \"Nikolaï Nemov\") covertly sought to radicalize and steer protests in France in October 2026. According to intercepted email correspondence obtained by InformNapalm with hacktivist group 256 Cyber Assault Division and analysis group Ukrainian Militant, Nemich operated via email accounts on domains controlled by Russian intelligence to direct an unidentified agent in France and a wider network of infiltrated actors and anonymous moderators. InformNapalm assesses that Russian intelligence attempted to exploit real societal cleavages in France by amplifying protester grievances, recruiting additional participants, promoting convergence of demands across social groups, and blocking compromise between protesters and authorities. Concrete examples cited include: (1) a directive dated 11 October 2026 instructing the agent to promote the abolition of the Parcoursup university admissions platform among youth and ensure that this demand is echoed by left-wing figures, particularly Jean-Luc Mélenchon (who had already raised it that afternoon in Clermont-Ferrand); (2) after the first street clashes between protesters and police on 13 October, an order to add a radical demand for criminal prosecutions of law enforcement officers, accompanied by a coordinated narrative about \"systemic police terror against children\" pushed through media and social channels linked to protest movements, with the goal of discrediting police, preventing compromise, and provoking further violent confrontations; (3) on the same day, instructions to intensify protests by uniting various social groups through a \"convergence of demands\"; and (4) on 15 October 2026, when the French government sought to defuse tensions via a proposed videoconference with protest leaders to discuss concessions, a directive from Russian intelligence to use infiltrated agents to impose a rigid, maximalist stance, thereby derailing dialogue and ensuring renewed unrest. InformNapalm further hypothesizes, based on this correspondence, that Russian intelligence may be exploiting pro-Russian individuals in Jean-Luc Mélenchon's inner circle, potentially steering them or \"using them unwittingly\" without their awareness of Moscow's true objectives. Colon endorses InformNapalm's conclusion that modern democracies must move beyond appeals to \"critical thinking\" and instead systematically and proactively expose foreign influence networks.", "summary_short": "Intercepted emails published by InformNapalm allegedly show GRU officer Lt. Col. Stanislav Nemich directing an agent network to radicalize and steer October 2026 protests in France—shaping demands, spreading narratives about \"systemic police terror against children,\" blocking compromise with the government, and possibly exploiting pro-Russian figures around Jean-Luc Mélenchon.", "summary_extended": null, "actor_primary": null, "target_primary": null, "location_text": "France", "location_region": null, "location_coordinates_lat": 46.227638, "location_coordinates_lon": 2.213749, "location_precision": "Regional", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The thread provides specific names, roles, dates, operational methods, and direct quotes from InformNapalm about Russian GRU-directed influence efforts targeting French protests. The activity is clearly hostile and covert, fitting the Hybrid Signal definition (primary focus on the aggressor's operation rather than on defensive measures). Evidence credibility is moderate because underlying emails are not directly visible and rely on InformNapalm and associated hacktivist sources, but the patte...", "event_time_utc": "2026-10-11T00:00:00.000Z", "end_time_utc": null, "event_time_confidence": "pm24h", "created_at": "2026-11-13T07:37:00.076Z", "updated_at": "2026-11-13T11:37:15.310Z", "reliability_band": "pattern", "location_precision_band": "regional", "time_precision_band": "within_24h", "severity_band": "moderate", "attribution_basis": "single_source" }