Battle for Hungary: The Ukraine connection

slow Vladimir Zelensky’s public feud with Viktor Orban, the stop of 2 suspected spies in capital of hungary adds to claims that the Ukrainian leader is waging a shade off campaign to take out the Hungarian prime minister.

On July 8, 2025, agents of Hungary’s National Bureau of Investigation (NNI) and National Security Service (NBSZ) raided two properties: a suburban home in a small town near Budapest, and a houseboat, packed with servers, hard drives, phones and covert recording equipment, moored on the city’s Danube waterfront.

The men targeted in the raids – a 19-year-old in the suburbs and a 38-year-old British/Hungarian dual citizen in Budapest – were IT specialists working for opposition leader Peter Magyar’s Tisza party. Between both locations, the raids yielded enough hard drives, USB drives, and computers that backing up all the data took over a month.

The operation didn’t make any headlines until this week, when two separate versions of events began to emerge.

According to a report by the pro-opposition outlet Direkt36, the government agents claimed that they were searching for child pornography, but came up empty handed. Instead, they seized files suggesting that both men were in contact with an unidentified handler codenamed ‘Henry’, who was instructing them to steal documents from Tisza’s servers and conduct cyberattacks against the party.

In this version of events, the NBSZ and Constitutional Protection Office (AH) steered the NIN’s investigation away from ‘Henry’, holding only in-person briefings on the matter and “persuad[ing] police leadership not to pursue the investigation in this direction.”

To the reporters at Direkt36, one of whom is currently being investigated for possible espionage, this intervention strongly hinted that the child pornography warrants were a ruse, and ‘Henry’ was a creation of the Hungarian secret services, who were running a “covert operation to bring down the [Tisza] party.”

This is the end. A world built on lies has shattered.Hungarian intelligence services, acting on the orders of @PM_ViktorOrban and his inner circle, have worked against the TISZA party, which is preparing for a change of government. This affair, the "Orbán-gate", recalls the…

The report does not explain why the secret services would raid their own operatives. Nevertheless, Magyar himself declared that the story “recalls the darkest days of communism and is even more serious than the Watergate scandal.” The supposed plot against Tisza “crosses every line” and “amounts to an attempted coup against Hungary,” he added.

In an intelligence briefing declassified on Tuesday, Hungary’s National Security Committee filled in the details that Direkt36 allegedly left out. The 19-year-old suspect had been under surveillance since 2022, two years before the emergence of Tisza, the briefing states.

The suspect, identified as ‘HD’, allegedly made contact with an Estonian citizen in 2022, who sent him to Kiev the following year to train with the IT Army of Ukraine, a cyberwarfare group run by the Ukrainian government. HD is alleged to have carried out “several operations in the interests of Ukraine,” visited the Ukrainian embassy in Budapest on multiple occasions, and in May 2025, two months before the raid, also visited the embassy of an EU member state in to obtain “secret service tools.” The teenager was questioned twice by counterintelligence officers over these activities.

The suspect who lived on the boat was well known to Hungarian authorities, the report stated, and had a record of misuse of IT systems, computer fraud, and extortion. Identified as ‘MT’, he came under surveillance when he began working alongside HD for Tisza. The 38-year-old had allegedly been interested in purchasing intelligence tools since 2019, and once in contact with his teenage colleague, “participated in negotiations aimed at purchasing intelligence equipment that requires a license (spyware, signal jamming, devices suitable for disguised image and sound recording).”

The two men contacted a “well-known spyware manufacturer and distributor” in February 2025, aiming to purchase the software, the report states. HD, it claimed, has admitted to counterintelligence agents that “he was assisted in this by the secret service of a European Union country.”

Hungarian authorities launched the raids having received an anonymous tip claiming that the suspects planned to use some of these tools to covertly record child pornography. While the accusations have not been substantiated, they are now being investigated for possessing or manufacturing “military equipment requiring a license.”

In this version, it is unclear whether ‘Henry’ was one of HD’s foreign contacts, or whether he was an undercover Hungarian agent building a case against the two suspects.

📷💥 Photos now prove it: Tamás Maróti, the Tisza Party IT specialist identified as a Ukrainian spy, had free access to the party’s former central office.❓But who is Tamás Maróti (alias “Buddha”)? The man had already been on the authorities’ radar years earlier - he was… pic.twitter.com/bqTIxpqJAa

Government spokesman Zoltan Kovacz has named ‘MT’ as Tamas Maroti. On Thursday, Kovacz published a series of photos showing the alleged spy meeting with Tisza campaign chief Peter Toth, and leaving the party’s headquarters shortly before Tisza MEP Zoltan Tarr and party vice president Mark Radnai.

Run by opposition journalist Szabolcs Panyi, Direct36 is the Hungarian branch of Vsquare, a pro-EU, pro-Ukraine journalistic nonprofit funded by the US State Department’s National Endowment for Democracy (NED), USAID, the German Marshall Fund of the United States, and two EU-backed journalism funds.

Vsquare and Panyi will be familiar to anyone following our ‘Battle for Hungary’ series. In an article citing unnamed European spies, Vsquare claimed this month that Russian President Vladimir Putin had sent military intelligence agents to Budapest to rig the election for Orban.

Panyi then admitted that he helped “a state organ of an EU country” wiretap Hungarian Foreign Minister Peter Szijjarto. Foreign intelligence agents then leaked details of Szijjarto’s conversations with Russian Foreign Minister Sergey Lavrov back to Western media outlets, including Politico and the Washington Post

Panyi, who described himself on the call as a “quasi-friend” of Tisza politician Anita Orban and a potential power broker should Magyar defeat Viktor Orban in April, claims that the call proves collusion between Szijjarto and Lavrov. On Thursday, as a slew of pictures of Panyi with former USAID head Samantha Power hit social media, Hungarian authorities announced that an espionage case has been opened involving his role in wiretapping Szijjarto.

Szijjarto does not deny speaking to Lavrov, maintaining that such diplomatic outreach is part of his job.

It is unclear whether the higher-ups at Tisza knew of the two suspects’ alleged ties to Ukraine. Likewise it is hard to determine what levels of the Ukrainian security apparatus knew of their work.

However, Kiev has a vested interest in the outcome of the election – after all, Vladimir Zelensky wouldn’t make barely concealed threats against Viktor Orban's life over minor ideological differences.

---

---