Leak alleges SVR Budapest rally plot

TLDR

• InformNapalm says leaked data links SVR-tied officers to a planned Budapest rally backing Paks II.¹³
• The evidence is a leaked email, a 106-member Telegram group and PDF metadata naming an author.²³
• The material comes from hackers and is unverified. The rally was cancelled and no payments are evidenced.²³

InformNapalm and the Ukrainian Militant analytical group say a CYBINT review of data obtained by the hacktivist group 256 Cyber Assault Division links officers tied to Russian military unit 33949 to preparations for a rally in Budapest in support of the Rosatom-backed Paks II nuclear plant.¹³ InformNapalm says open sources have long identified the unit as part of Russia's Foreign Intelligence Service (SVR).³ The article is dated 26 October, and the Ukrainian-language original shows a publication time late on 25 October.³

Why it matters: the case combines methods investigators reuse: following a leaked email to the public posts it implies, joining the organisers' Telegram group from a separate account, and reading file metadata to find who wrote the campaign material.²³ It also shows the limits, because the starting point is hacked data that outsiders cannot check.³

Driving the news:

• A leaked email dated 16 September from a colonel to a lieutenant colonel says the "aktivka" in Budapest has been moved and asks for profiling the next day, according to InformNapalm. Names are withheld here.³
• On 16 September a Facebook account posted in Russian-speaking groups seeking "initiative people" for an energy project, InformNapalm says. A Telegram group, "Friendship of Peoples", then had 106 members and stated the aim was to back Paks II.²³
• The rally was planned for around noon on 20 September near parliament, moved to 26 September over a permit delay, and cancelled about 30 minutes before it was due, according to InformNapalm and UNITED24.²³
• A Hungarian-language banner PDF lists an author name that InformNapalm says matches the maiden name the lieutenant colonel used on the Russian network Moy Mir. The file dates are 16 and 18 September.³

The big picture: UNITED24 places the story after Hungary expelled ten Russian diplomats on 8 September over activities incompatible with their status, and after Hungarian authorities opened an inquiry in August into financial transactions linked to Paks II.²

The other side: no outside party confirms the leaked documents are genuine. Organisers offered additional reward, but investigators found no evidence that payments were made.²³ InformNapalm says the timing of the colonel's email "indicates possible awareness" of the rally, and notes the email does not reveal his powers.³ None of the coverage reviewed includes a response from Russia, Hungary or Rosatom.

Single-source note: every claim traces to InformNapalm and Ukrainian Militant, working from data supplied by 256 Cyber Assault Division. Militarnyi and UNITED24 restate it, and the documents and metadata were not independently reviewed here. The first Ukrainian-language version appeared late on 25 October.