Russia’s Rybar Network Ran Covert Filming Operations Across Europe, Investigation Reveals
A sweeping Czech investigation has exposed a covert Russian propaganda operation that sent disguised film crews across Europe to produce manipulated content aimed at undermining democratic institutions. According to a report by Ukraine’s Center for Countering Disinformation (CCD), the operation was orchestrated by Rybar, a well-known Russian influence network founded by Mykhailo Zvinchuk, who remains under sanctions from both the European Union and the United Kingdom. The investigation, conducted by the Czech news outlet Seznam Zprávy, found that individuals linked to Rybar traveled freely inside the Schengen Area, using residence permits and a false documentary-production cover story to approach politicians, experts, and public figures in multiple countries. The public pretext was a documentary series about Europe’s sociopolitical situation, but the real purpose was to gather material for propaganda narratives designed to discredit the West, undermine support for Ukraine, and amplify Kremlin talking points. The EU’s sanctions justification for Zvinchuk states that Rybar is part of a working group created by Vladimir Putin in December 2022 specifically to coordinate Russia’s mobilization efforts in connection with the war against Ukraine, placing the media operation squarely inside the machinery of the Russian state.
The Prague operation, the centerpiece of the investigation, revealed the brazen and sophisticated methods used by Rybar’s affiliates. The crew members entered the Czech Republic with residence permits issued by other European Union member states, particularly Germany, and moved about the Schengen Area without any apparent hindrance. They presented themselves as independent documentary filmmakers interested in exploring the social and political conditions in Europe. Under that cover, they sought interviews with local politicians, analysts, and civil society figures, hoping to record statements that could later be selectively edited, taken out of context, or paired with false commentary to create disinformation products. The operation fell apart when journalists from Seznam Zprávy confronted the alleged filmmakers at a scheduled meeting location. Instead of answering questions, the propagandists fled, leaving behind clues about the larger network. The Czech investigation identified Boris Dvorkin as the Moscow-based producer behind the operation. Dvorkin is linked to a project that received funding from the History of the Fatherland Foundation, a Russian state-backed organization established by a decree from Vladimir Putin and headed by Sergei Naryshkin, the chief of Russia’s Foreign Intelligence Service. That direct connection to the SVR underscores how layered and state-directed the operation truly was, and it demonstrates that the Kremlin is willing to embed its intelligence and influence objectives in ostensibly cultural or historical projects.
The scale of the campaign, according to the CCD, extends far beyond Prague. Similar filming operations were allegedly planned or already carried out in Czechia, Slovakia, Austria, Hungary, Serbia, France, and other countries. The use of multiple European countries suggests not random targeting but a coordinated regional strategy to identify vulnerabilities, collect material, and plant Russian narratives in societies with different political dynamics and levels of resilience. In Central and Eastern European countries, the goal may be to deepen political polarization and exploit historical grievances; in Western Europe, the emphasis may be on questioning the legitimacy of national governments, NATO, or the European Union. The fact that these operations have been discovered in several jurisdictions also raises the possibility that many more have gone undetected. Because the operatives held legitimate residence permits and used plausible commercial cover, they were able to operate in plain sight, meeting with decision-makers and influential commentators without raising alarm. The Czech investigation specifically noted the irony that the propagandists had arrived to record “documentaries” about Europe’s social and political state while at the same time embodying the very threat they claimed to examine. The CCD’s report stressed that this was not a one-off incident but part of a broader Kremlin pattern of subversive activity across the continent.
The sanctions that have been imposed on Rybar, Zvinchuk, and their associates have clearly not been sufficient to stop the network from working inside the European Union. The EU included Rybar in its sanctions regime because of the network’s role in Putin’s mobilization working group, but that legal designation did not automatically translate into operational enforcement. The United Kingdom sanctioned Rybar and Zvinchuk in December 2025, adding that the network had interfered in elections in Moldova and Armenia and, later, that ten additional Rybar staff members were sanctioned in July 2026 for their role in destabilizing Ukraine. In 2024, the U.S. State Department went further, offering a reward of up to ten million dollars for information on Zvinchuk and eight other individuals tied to the project. These are significant diplomatic actions, but the investigation in Prague demonstrates that sanctions lists do not always keep targeted individuals from leveraging the freedom of movement inside the Schengen zone. The network appears to have used a simple yet effective model: rely on lesser-known or nominally independent contractors, keep their names off the highest-level sanctions listings, provide them with legal residence status in a friendly or porous jurisdiction, and then dispatch them on propaganda assignments that leave no immediate forensic traces. Because European security services are often focused on cyber threats, sabotage, or assassination attempts, the comparatively low-risk method of filming and interviewing can evade attention until journalists or local counterintelligence catch a break.
This investigation lays bare the contradictions in European countermeasures against Russian covert activities. On paper, the EU has a robust framework for designating and punishing individuals and entities that threaten its security. In practice, the enforcement is inconsistent, and intelligence-sharing among member states is often limited. The residence permits used by the Rybar crew point to a specific loophole: an individual can receive a permit from one EU country, then travel freely through all others, often without any additional checks or notification requirements. That makes it difficult for a country like the Czech Republic to know who has entered its territory, what their past connections are, or whether they are operating at the behest of a foreign intelligence service. The report by the CCD highlights the need for a European-level solution, including better coordination among national authorities, more thorough vetting of residence-permit applications, and a more aggressive approach to investigating cultural and media projects with suspicious funding histories. The connection to the History of the Fatherland Foundation, a state entity headed by the head of the SVR, shows that the Kremlin sees history and culture as another frontline in its hybrid warfare. Funding from such institutions should be treated as a red flag, not only by intelligence services but also by academic institutions, think tanks, and media outlets that might be approached by similar groups.
The discovery of the Rybar filming operation should be a wake-up call for European democracies. It is no longer enough to secure physical borders, protect elections, or shore up cyber defenses. The Kremlin has shown that it can adapt to sanctions and mobilize civilian assets for espionage and disinformation under innocent covers. The filmmakers in Prague were not caught because of any electronic surveillance or proactive intelligence operation; they were caught because a team of Czech journalists confronted them after noticing suspicious behavior. That raises uncomfortable questions about all the other operations that did not attract journalistic attention. The CCD’s report calls on European governments to recognize the scale of this threat and to implement stronger enforcement of existing measures, but it also points to the need for greater public awareness. Citizens, politicians, and academics who are approached by unknown documentary crews, cultural organizations, or research groups should know that there are state-directed actors using these methods. In the long term, the European Union and its allies must decide whether sanctions are a genuine enforcement tool or just a symbolic statement. The Rybar case suggests that, until now, they have been closer to the latter. With the war in Ukraine continuing and Russian influence operations climbing across the continent, the stakes could not be higher. If the Kremlin can send pseudo-documentarians into the heart of Europe with impunity, then every television interview, every dinner conversation, and every public meeting becomes a potential battleground for information control. The investigation in Prague did not stop Rybar’s activities entirely, but it did expose a pattern that, if acted upon, can close the window that Russia has been exploiting for years. The task now is to translate that exposure into real protection for democratic discourse.