An email containing files full of documents about the propaganda operations carried out by the Kremlin in European countries arrived a few weeks ago at the FIP (Fact Investigation Platform) editorial office in Armenia.
Most likely, the documents were sent by employees of the Russian secret services, disguised through a hacking operation of communication within the Social Design Agency, which in reality is a unit coordinating hybrid attacks directly subordinate to Sergey Kirienko, the deputy head of the presidential administration.
“Social Design Agency is a Russian IT company closely linked to the political power in Russia. Since 2022, it has been involved in a Moscow-led digital disinformation campaign, named RRN (Recent Reliable News), which aims to manipulate information and spread disinformation in support of Russia’s aggression against Ukraine,” as stated in the report published on Open Sanctions, a database listing individuals and entities subject to international sanctions.
“Social Design Agency has been identified as a key player in the campaign, responsible for creating false websites posing as legitimate government and media organizations in Europe (mainly Germany, France, Italy, Ukraine, and the United Kingdom) and for promoting the pro-Russian RRN campaign on social networks. Therefore, Social Design Agency actively supports actions that undermine and threaten the territorial integrity, sovereignty, and independence of Ukraine,” the report further states.
Kristin Killer, Ghița's Chief
The documents received at the FIP editorial office include reports, action plans, campaigns, as well as emails and messages between agency workers, as well as with Sergey Kirienko, Putin's subordinate, and Sofia Avraamovna Zaharova, who uses the pseudonym Kristin Killer, also an important figure within the presidential administration, as detailed in an investigative article published by FIP on May 16, 2026.
More important than the Kremlin's working method regarding actions against European states is the fact that the documents reveal the names of influence agents, activists, as Kremlin calls them, used by Vladimir Putin's associates to target hybrid warfare objectives.
“Many of these actions were carried out under false flags. For example, some operations directed against Armenia were conducted to create the impression that they were coordinated from Turkey, while operations against France were carried out under the false flag of Ukraine… among others. These operations involved various individuals from different parts of the world, including a retired American general, a former member of the German Bundestag, a Romanian oligarch…,” as revealed in the investigation published by FIP.
The Romanian oligarch's name is Sebastian Ghiță, the owner of RTV (Romania TV), holding multiple companies with huge contracts with the state in sensitive areas such as national security, finance, health, and education.
- Sebastian could disclose the attempts of Maia Sandu's administration to buy advertising spaces against her presidential opponent on his platforms, including on Romania TV. The disclosed amount should be 150,000 euros, and he should state that he rejected the offer.
- Also, to mention that Maia Sandu tried to buy the loyalty of Romania TV during the presidential elections in Romania. And that she told Sebastian that she represents the interests of "a group of influential people in Europe," warning that despite all efforts to support Călin Georgescu, the decision on who will lead the country "has already been made." Source: FIP/Armenia Documents
The first to write about this subject was Valeriu Pașa from Moldova, who works for WatchDog.md, a non-profit organization actively contributing to building public resilience to disinformation and manipulative narratives.
A Miracle Happened
On the evening of December 19, 2016, Sebastian Ghiță attends a party. It is not an ordinary one but a reception organized by the SRI, hosted by Eduard Hellvig, the agency's director, and Florian Coldea, the deputy.
The reception was held to mark the end of the parliamentary mandates of the deputies and senators from the intelligence oversight committees.
At that time, Sebastian Ghiță, who entered Parliament on the PSD lists, was a member of the SRI Committee.
He managed to leave the country, although he was under prosecutors' surveillance, and after a while of being declared missing, it was revealed that he had settled in Serbia.
In August 2004, Sebastian Ghiță officially becomes an SRI collaborator, signing a document agreeing to undergo a "vetting" procedure, a thorough check of his and his family's past from the security perspective required for enrollment in the agency.
“I consent to all the data I provide to be verified, fully aware of the legal consequences and of any false or knowingly omitted statements,” as stated in the document signed by the Romanian multimillionaire.
Shortly after recruitment, Sebastian Ghiță's fate miraculously changes, becoming a favored contractor for the digitalization of Romanian state operations, granting him access to sensitive documents, including databases with personal information of millions of Romanians.
Sebastian Ghiță was investigated by prosecutors for influence peddling related to the implementation processes of IT programs in the healthcare field - the infamous health card, which still doesn't function properly today. He was never convicted.
Marina Tauber, RTV's Friend
After fleeing the country, many indications emerged that SRI cut ties with Sebastian Ghiță, who was recruited by the Kremlin's intelligence services, offering him protection in Serbia, a country partially controlled by Vladimir Putin.
Being under Russia's umbrella discouraged Romanian authorities, who helplessly watched Sebastian Ghiță conduct hybrid operations against Moldova and Romania from Belgrade, using RTV, his television station in Bucharest, as a propaganda tool.
At the beginning of March, three years ago, during prime time, Marina Tauber, Ilan Șor's associate, appeared on RTV, being interviewed about the situation in Moldova.
At that time, with the help of Șor and Tauber, the Kremlin had developed a network of instigators and subversive and violent actions aimed at overturning the democratic regime and ousting Maia Sandu from the presidency.
Both Tauber and Ilan Șor sought refuge in Moscow, after being charged by prosecutors in Chișinău.
Secret documents stolen from the Kremlin's computers confirm Sebastian Ghiță's direct connection with Vladimir Putin's associates, who coordinate hybrid attacks through the media.
In several messages from the Social Design Agency (SDA), the idea of using Romanian activist Sebastian Ghiță to support the claim that Maia Sandu's administration attempted to block the dissemination of negative news about her on Romania TV, a channel owned by Ghiță, in exchange for the sum of 150,000 euros was discussed, as stated in the report published by FIP from Armenia.
"The documents also reveal that Maia Sandu is mentioned as one of the main targets on the SNG.TODAY website... owned by the Social Design Agency (SDA) and sponsored by the Kremlin...," the report further states.
Over time, several journalists have suggested that Sebastian Ghiță has received protection from Russia, an adversary of Romania, and in exchange, he carries out a series of actions against the strategic interests of our country and Moldova, within the context of an intense hybrid war launched by the Kremlin in Europe.
"I reject all these false claims about my ties to Putin and the Kremlin, made by Sorosist agents (the names of intelligence agents are not disclosed). The lies and fabrications forced by the Sorosist press are useless," reacted Sebastian Ghiță from Belgrade in a Facebook post.
Regarding the above reaction, it should be noted that no one has stated that Sebastian Ghiță is an FSB agent or from any other Russian intelligence service. In Kremlin correspondence, he is labeled as an "activist," meaning "an instrument at the disposal of Russian secret services."
Two friends
George Simion, another "activist" of Russia, was also created by Romanian intelligence services, who most likely was recruited by the Kremlin between 2012-2015 when he was involved in political actions in Chisinau.
The leader of AUR has active bans from entering Ukrainian and Moldovan territories, being considered a threat to the security and independence of both states, according to statements from Romanian officials, as well as officials from both countries.
Between 2011 and 2014, when George Simion was involved in political actions in the Republic of Moldova, he was funded by the SRI through donations from military units, according to a journalistic investigation conducted by Press Hub and published in January 2023.
In 2016, a few days before the parliamentary elections and Sebastian Ghiță's escape from the country, the latter met with George Simion to discuss a political project.
Three years later, AUR was founded, participating in the parliamentary elections in December 2020, where it unexpectedly obtained 9% of the valid votes cast.
In the local elections of the same year, held in September, George Simion's party was non-existent.
The cases of Sebastian Ghiță and George Simion once again show, if there was any need, how deeply penetrated the Romanian state institutions and political organizations are by Russian intelligence services and how little has been done, after Romania's accession to NATO and the European Union, to neutralize the strong Kremlin infiltration that began in December 1989 through the wide-open door of Ion Iliescu.