How a secret service raid exposed an alleged spy plot inside the Hungarian opposition
Behind Vladimir Zelensky’s public feud with Viktor Orban, the arrest of two suspected spies in Budapest adds to claims that the Ukrainian leader is waging a shadow campaign to take out the Hungarian prime minister.
On July 8, 2025, agents of Hungary’s National Bureau of Investigation (NNI) and National Security Service (NBSZ) raided two properties: a suburban home in a small town near Budapest, and a houseboat, packed with servers, hard drives, phones and covert recording equipment, moored on the city’s Danube waterfront.
The men targeted in the raids – a 19-year-old in the suburbs and a 38-year-old British/Hungarian dual citizen in Budapest – were IT specialists working for opposition leader Peter Magyar’s Tisza party. Between both locations, the raids yielded enough hard drives, USB drives, and computers that backing up all the data took over a month.
The operation didn’t make any headlines until this week, when two separate versions of events began to emerge.
Did Orban target his opponents?
According to a report by the pro-opposition outlet Direkt36, the government agents claimed that they were searching for child pornography, but came up empty handed. Instead, they seized files suggesting that both men were in contact with an unidentified handler codenamed ‘Henry’, who was instructing them to steal documents from Tisza’s servers and conduct cyberattacks against the party.
In this version of events, the NBSZ and Constitutional Protection Office (AH) steered the NIN’s investigation away from ‘Henry’, holding only in-person briefings on the matter and “persuad[ing]police leadership not to pursue the investigation in this direction.”
To the reporters at Direkt36, one of whom is currently being investigated for possible espionage, this intervention strongly hinted that the child pornography warrants were a ruse, and ‘Henry’ was a creation of the Hungarian secret services, who were running a “covert operation to bring down the [Tisza] party.”
The report does not explain why the secret services would raid their own operatives. Nevertheless, Magyar himself declared that the story “recalls the darkest days of communism and is even more serious than the Watergate scandal.” The supposed plot against Tisza “crosses every line” and “amounts to an attempted coup against Hungary,” he added.
Or was Tisza’s IT team working with Ukraine?
In an intelligence briefing declassified on Tuesday, Hungary’s National Security Committee filled in the details that Direkt36 allegedly left out. The 19-year-old suspect had been under surveillance since 2022, two years before the emergence of Tisza, the briefing states.
The suspect, identified as ‘HD’, allegedly made contact with an Estonian citizen in 2022, who sent him to Kiev the following year to train with the IT Army of Ukraine, a cyberwarfare group run by the Ukrainian government. HD is alleged to have carried out “several operations in the interests of Ukraine,” visited the Ukrainian embassy in Budapest on multiple occasions, and in May 2025, two months before the raid, also visited the embassy of an EU member state in to obtain “secret service tools.” The teenager was questioned twice by counterintelligence officers over these activities.
© Getty Images; Jaap Arriens
The suspect who lived on the boat was well known to Hungarian authorities, the report stated, and had a record of misuse of IT systems, computer fraud, and extortion. Identified as ‘MT’, he came under surveillance when he began working alongside HD for Tisza. The 38-year-old had allegedly been interested in purchasing intelligence tools since 2019, and once in contact with his teenage colleague, “participated in negotiations aimed at purchasing intelligence equipment that requires a license (spyware, signal jamming, devices suitable for disguised image and sound recording).”
The two men contacted a “well-known spyware manufacturer and distributor” in February 2025, aiming to purchase the software, the report states. HD, it claimed, has admitted to counterintelligence agents that “he was assisted in this by the secret service of a European Union country.”
Hungarian authorities launched the raids having received an anonymous tip claiming that the suspects planned to use some of these tools to covertly record child pornography. While the accusations have not been substantiated, they are now being investigated for possessing or manufacturing “military equipment requiring a license.”
In this version, it is unclear whether ‘Henry’ was one of HD’s foreign contacts, or whether he was an undercover Hungarian agent building a case against the two suspects.
Government spokesman Zoltan Kovacz has named ‘MT’ as Tamas Maroti. On Thursday, Kovacz published a series of photos showing the alleged spy meeting with Tisza campaign chief Peter Toth, and leaving the party’s headquarters shortly before Tisza MEP Zoltan Tarr and party vice president Mark Radnai.
Who’s reporting what? Behind Direkt36
Run by opposition journalist Szabolcs Panyi, Direct36 is the Hungarian branch of Vsquare, a pro-EU, pro-Ukraine journalistic nonprofit funded by the US State Department’s National Endowment for Democracy (NED), USAID, the German Marshall Fund of the United States, and two EU-backed journalism funds.
Vsquare and Panyi will be familiar to anyone following our ‘Battle for Hungary’ series. In an article citing unnamed European spies, Vsquare claimed this month that Russian President Vladimir Putin had sent military intelligence agents to Budapest to rig the election for Orban.
Panyi then admitted that he helped “a state organ of an EU country” wiretap Hungarian Foreign Minister Peter Szijjarto. Foreign intelligence agents then leaked details of Szijjarto’s conversations with Russian Foreign Minister Sergey Lavrov back to Western media outlets, including Politico and the Washington Post
Panyi, who described himself on the call as a “quasi-friend” of Tisza politician Anita Orban and a potential power broker should Magyar defeat Viktor Orban in April, claims that the call proves collusion between Szijjarto and Lavrov. On Thursday, as a slew of pictures of Panyi with former USAID head Samantha Power hit social media, Hungarian authorities announced that an espionage case has been opened involving his role in wiretapping Szijjarto.
Szijjarto does not deny speaking to Lavrov, maintaining that such diplomatic outreach is part of his job.
Why is Ukraine involved?
It is unclear whether the higher-ups at Tisza knew of the two suspects’ alleged ties to Ukraine. Likewise it is hard to determine what levels of the Ukrainian security apparatus knew of their work.
However, Kiev has a vested interest in the outcome of the election – after all, Vladimir Zelensky wouldn’t make barely concealed threats against Viktor Orban’s life over minor ideological differences.
Hungary has used its EU veto powers to delay every package of energy sanctions imposed on Russia by the bloc, relenting only when given exemptions that allow it to continue purchasing Russian fossil fuels. Orban opposes Ukraine’s potential accession to NATO, refuses to supply arms to Kiev, and is currently vetoing a €90 billion EU loan package for Kiev, hacked together after Commission President Ursula von der Leyen’s failure to push through a move to steal Russia’s frozen sovereign assets.
Zelensky has responded by publicly attacking Orban and by refusing to reopen the Druzhba pipeline, which carries Russian oil to Hungary and Slovakia via Ukraine. He insists that the pipeline – which Hungary depends on for more than 80% of its oil imports – was damaged in a Russian attack. Budapest and Bratislava claim that satellite photos prove Druzhba is visibly operational, and that Zelensky is lying in order to force both countries off Russian oil or crowbar Budapest into backing more aid for Kiev.
The EU has made public overtures toward restarting Druzhba, with Brussels proposing a “fact-finding mission” to assess the supposed damage and resolve the dispute. However, as RT explored in the first installment of our ‘Battle for Hungary’ series, the bloc is also working against Orban in the runup to the election, leveraging its online censorship tools to benefit Magyar.
In a phone conversation leaked earlier this month, European Commission President Ursula von der Leyen’s communications adviser told a Politico reporter that the EU won’t force Zelensky to reopen the pipeline, as doing so would benefit Orban’s campaign.
Orban has claimed for months that Ukraine is waging a quiet war against his government “The Ukrainians are actively working to bring about a change of government in Hungary,” he told Hungary’s Kossuth Radio in October. “Their secret service is here all the time. Tisza is a pro-Ukrainian party, this is their party, so they will do everything to help the Tisza party form a government.”
“I call on president Zelensky to order his agents home immediately and respect the will of the Hungarian people,” Orban said in a video address on Thursday. “Ukrainian spies and IT specialists paid by the Ukrainians come in and out of the Tisza party. There has never been an election in Hungary so deeply interfered with by foreign secret services.”
The bottom line
Brussels, Kiev, and the Hungarian opposition media have made no secret of their desire to oust Orban. With the election nearly two weeks away, every new scandal suggests closer collaboration between all three players, and use of the very same tactics that Panyi and the opposition accuse Orban of deploying.
A counterintelligence probe into the case of the two IT specialists is ongoing. One side says that the raid was a textbook example of political repression; the other says it was the culmination of a years-long investigation into well-known cybercriminals working in cahoots with Ukraine.
Hungarian government spokesman Zoltan Kovacs said on Tuesday that “further facts will be made public this week so that it becomes clear to everyone that the Hungarian left is once again attempting to come to power with foreign – primarily Ukrainian – assistance.”
