Specialists linked to Russia’s military intelligence service, the GRU, arrived in Hungary last month under diplomatic cover for a hybrid operation aimed at influencing the April 12 election, investigative website VSquare said on March 6. Russia’s embassy in Budapest denied the reports while criticising opposition leader Peter Magyar for making the issue a campaign topic.

According to a report by investigative journalist Szabolcs Panyi, citing multiple European intelligence service sources, the Kremlin deployed a three-member team to its embassy in Budapest under diplomatic status.

The mission is overseen by Sergey Kiriyenko, a senior aide to Russian President Vladimir Putin who oversees Russia’s domestic and international political influence operations.

The former head of state-owned nuclear giant Rosatom became Putin’s key domestic political operative in 2016, deploying Russia’s political manipulation toolkit even in foreign elections, according to Panyi. The other figure reportedly involved in the operation is Vadim Titov, the former head of  Rosatom’s Budapest office until 2019. Titov is not only familiar with Hungarian political and economic elites but also possesses in-depth knowledge of their personal and financial vulnerabilities, he added.

The two are directing the operation from Russia, while the team sent to Budapest likely has tasks that can only be carried out in person, Panyi said in a later post, adding that other European services are also closely monitoring the operation.

The journalist recalls Russian interference in the elections in Moldova, which included vote-buying, online troll operations and local activists being used to influence public opinion against the pro-Western President Maia Sandu.

Hungarian security analyst Ferenc Fresz writes that VSquare’s insights reveal that Hungary’s operational oversight has been assigned to the directorate responsible for the post-Soviet region, indicating that the Kremlin no longer views the country as a sovereign partner but rather as a near-abroad vassal.

In his CyberThreat Report publication, Fresz writes that the operation goes beyond merely supporting an election campaign as it represents a direct application of the Russian New Generation Warfare (NGW) doctrine within the territory of an EU and Nato member state. Moscow has effectively repositioned Hungary within the post-Soviet sphere of influence, marking a significant shift in both the intensity and approach of its intervention.

The hybrid campaign could include digital subversion and “narrative laundering”, creating AI-generated disinformation that is legitimised through local media and amplified via bot networks and influencers (Storm-1516 Group).

According to the cybersecurity expert, Russia's foreign intelligence service, specifically Centre 18, could be responsible for targeted cyber intrusions against opposition parties, including spear-phishing attacks and the leaking of internal strategy documents. 

Security analyst Peter Buda confirmed the findings in the Vsquare report in a note, saying that, unlike in Moldova, where the goal was to destabilise a pro-Western government, in Hungary, the focus is on keeping a Moscow-aligned party in power and amplifying external threat perceptions, linking them to opposition parties and promoting the narrative that only the current government can ensure national security.

Buda stated that European and US intelligence agencies are aware of Russian operatives in Budapest and have shared this with Hungarian authorities. The fact that the story broke through an independent journalist suggests the government may be withholding it, implying possible tacit cooperation with the Russian mission.

The analyst suggested that Russian interference could include vote-buying, covert campaign financing, AI-driven social media propaganda, and disinformation campaigns. These tools may also be used to create falsified documents to discredit opposition leaders, such as Tisza Party chief Peter Magyar, who leads in most independent polls.

More extreme scenarios could include false or staged security threats, such as bomb scares attributed to Ukraine, which the government could use to justify protective measures while linking the opposition to external actors.

Both analysts agree that strategic pre-bunking and public awareness campaigns are the most effective tools to defend against disinformation. For political parties, they advised on multi-factor authentication and security keys to protect internal communication, and on enhanced international monitoring through EU cyber teams and OSCE missions.

After the first reports broke, Tisza Party leader Peter Magyar accused the government of inviting Russian operatives to influence the April parliamentary elections, comparing it to former Communist Party chief Janos Kadar calling on Soviet troops to crush the October 1956 uprising in Hungary in the first days of November. Magyar demanded the immediate expulsion of Russian agents and the convening of Parliament’s National Security Committee.

The Russian embassy on Facebook dismissed the media reports on alleged election interference as speculative and false, stating that no delegation under Sergey Kiriyenko or Vadim Titov operates in Hungary. The embassy also criticised opposition Magyar for making the issue a campaign topic.

“It is, however, unclear why Mr Peter Magyar felt the need to bring up this old record again. Perhaps his voter support is not strong, and therefore he is forced to resort to such methods,” the statement read.

In response to the post, Magyar said that Hungary, celebrating the 70th anniversary of the 1956 anti-Soviet uprising, is a nation of freedom-loving people who cannot be intimidated. He called on Russia to refrain from interfering in the April 12 elections and reaffirmed that a future Tisza government would pursue balanced relations with Moscow while defending Hungary’s sovereignty and place in the European alliance system.

The possible involvement of Russian operatives comes at the height of the election campaign, at a time when pro-Kremlin narratives about the war in Ukraine have increasingly appeared in the government’s narrative describing Kyiv as an enemy. Tensions flared to new highs last week after the heist of a Ukrainian vehicle transporting cash from Austria to Ukraine. Hungary has still not released the money and gold bars confiscated during the raid. 

The Orban government has not commented on the Vsquare report.