The collapse of the FIMI ‘house of cards’: from diagnosis to containment

Overview of the 4th European External Action Service (EEAS) report on threats from foreign information manipulation and interference (FIMI), March 2026

1. Report metadata

In March 2026, the European External Action Service (EEAS) published its fourth annual report on threats posed by Foreign Information Manipulation and Interference (FIMI). The document, titled “Disrupting the FIMI House of Cards,” continues a series of reports issued since 2023.

The report was prepared by the EEAS Strategic Communications Unit (GII.GLOBAL.STRAT.DMD), which has played a key role in monitoring and countering FIMI since 2015. The foreword was signed by Kaja Kallas, High Representative of the Union for Foreign Affairs and Security Policy. The report’s methodology is based on EEAS strategic monitoring and open-source research for the period from 1 January to 31 December 2025. All incidents are encoded in STIX (Structured Threat Information Expression), which enables standardized exchange of threat data.

A crucial caveat the authors make at the beginning of the paper is that the data presented reflects a selective, time-limited sample of observed activity. The EEAS does not cover all regions and languages, so the actual scale of FIMI operations may significantly exceed that documented.

 

2. Key quantitative data

The scale of recorded activity in 2025 is significant. The EEAS identified and analyzed 540 FIMI incidents worldwide, involving approximately 10,500 unique channels, including fake news websites, social media accounts, and blogs. The total number of content units (text, audio, video) recorded was approximately 43,000 objects across 19 different platforms.

The attribution of incidents was as follows: 29% were attributed to Russia, 6% were attributed to China, and 65% remained unattributed. The authors emphasize that unattributed incidents show signs of coordination with infrastructure linked to Russia or China.

The structure of channels involved in FIMI operations is presented as an “iceberg” infographic: only 9.5% of channels are directly linked to a state entity (2.5% are official state channels, 7% are state-controlled media). The remaining 90.5% are hidden resources: 4.5% of channels are linked to the state, and 86% are classified as “state-oriented,” with no established direct connection.

Platform X dominates the sample, accounting for 88% of cases. The authors attribute this to the presence of coordinated inauthentic behavior (CIB) networks, the ease of creating fake accounts, and more direct access to data. Telegram (7%), Facebook (3%), TikTok (2%), and YouTube (1%) lag significantly behind.

The dynamics of AI use deserve special attention: 27% of incidents in 2025 involved tactics using artificial intelligence. The number of such cases increased from 41 to 147, representing an increase of approximately 259% compared to 2024.

Based on the number of incidents, the top five countries most attacked are: Ukraine (112), France (107), Moldova (94), Germany (71), and the United States (51). They are followed by the United Kingdom (36), Armenia (18), Poland (17), Belgium (16), Syria (15), Romania (14), Japan (13), Côte d’Ivoire (13), Italy (11), and Spain (11). In total, more than 100 countries, about 200 organizations, and approximately 140 individuals were attacked.

3. Key findings and trends

3.1 From diagnosis to containment

The report’s most significant conceptual innovation is the shift from threat description to a deterrence model. The EEAS presents the FIMI Deterrence Playbook, which borrows the “kill chain” logic from cybersecurity and applies it to information operations. FIMI operations are broken down into sequential phases, from planning and funding to implementation and reinforcement, with intervention points identified at each stage.

Deterrence is defined as “the ability to alter the cost-benefit ratio of an actor so that it desists from engaging in unwanted behavior.” Four tools form the foundation: sanctions, law enforcement, digital regulation (primarily DSA), and building societal resilience.

3.2. FIMI as an industry: the FIMI-as-a-Service model

The report identifies a fundamental shift: FIMI operates as an entire industry with a multi-layered business ecosystem. Various activities are planned, financed, and subcontracted, creating a “FIMI-as-a-Service” model. This is reflected in FIMI’s intersection with organized crime: criminal organizations provide infrastructure, technical expertise, and global reach, receiving financial rewards and political protection in return.

3.3. Full integration of AI into FIMI operations

Artificial intelligence has moved from the experimental stage to everyday practice. Synthesized audio, video, and AI-generated text have become cost-effective and scalable tools. Attackers have advanced from simple voice dubbing to advanced voice cloning techniques. Videos imitating specific faces are becoming increasingly sophisticated.

The authors note a paradox: despite this expansion, the majority of AI-generated content remains of low quality. Attackers prioritize quantity over quality, resulting in low levels of natural interaction. The only exception noted in the report is Storm-1516’s ability to generate organic interaction and infiltrate genuine public debate.

A fundamentally new threat: Portal Kombat’s infrastructure is suspected of flooding the information space with low-quality multilingual content in order to influence AI training data and inject false claims disguised as reliable sources. The CheckFirst study cited in the report describes this phenomenon as LLM pollution.

3.4. Russia’s Three-Phase Scenario of Election Interference

The report documents a persistent “scenario” of Russian election interference, consisting of three phases. The first phase, several months before the elections, involves control of the information space and the delegitimization of the political leadership through accusations of corruption, health problems, and subordination to the EU. The second phase, during the election campaign, focuses on weaponizing internal divisions. The third phase, in the final weeks before the vote, aims to undermine the integrity of the elections and encourage abstention.

This scheme was implemented in 2025 in Germany, Poland, Romania, Moldova, the Czech Republic, and Côte d’Ivoire. The EEAS characterizes it as a recurring and predictable scenario that can be anticipated and mitigated in advance.

3.5. Transfer of infrastructure from Moldova to Armenia

One of the report’s most significant findings: following the October 2025 elections in Moldova, Russian IMS (primarily Operation Overload and Storm-1516) redirected their efforts to Armenia in the lead-up to the June 2026 parliamentary elections. Similarities between the campaigns against Moldova and Armenia are evident in four main lines of attack against political leaders: accusations of moral depravity, corruption, serving foreign interests, and loss of sovereignty.

A telling detail: while the narratives play on local fears, they are often circulated in Western European languages rather than Romanian, Armenian, or Russian, indicating a wider audience for the defamation.

3.6. Strategic reorientation of Russian FIMI to Europe

Over the past year, Russian campaigns have undergone a strategic reorientation: the emphasis has shifted from the EU and US to Europe. Russia has focused on the EU as an adversary, demonstrating inconsistency in its stance toward the US and positioning itself as an alternative to the “morally degraded West.” The Russian state media budget for 2026 is 146.3 billion rubles (approximately €1.56 billion), a 7% increase from 2025.

3.7. China’s FIMI: Information Suppression and Soft Expansion

The report positions China as an actor with a fundamentally different approach. While Russia’s strategic goal is primarily division and distortion (as confirmed by the “5D radar”), China dominates the “deflect” category: claiming criticism is biased and promoting its own narratives. Transnational information suppression (TIS) remains a key problem: China encourages self-censorship, targeting the media, businesses, academia, and the diaspora.

4. Actors and infrastructures

The report provides the first such detailed map of Information Manipulation Sets (IMS). An IMS is defined as an adversary’s “digital signature”: a collection of malicious actions, tools, tactics, methods, procedures, and resources believed to originate from a single threat actor.

Russian IMS

Storm-1516(also CopyCop / False Façade) is described as the most successful IMS, capable of infiltrating genuine public discourse. Content receives between 5,000 and 4 million views. In 2025, the volume of activity nearly doubled; five new networks of fake websites were created, encompassing 453 websites targeting German, American, French, Moldovan, and international audiences. Critically, Storm-1516 is increasingly using networks of hired influencers instead of Telegram channels.

Doppelgänger, run by EU-sanctioned organizations Social Design Agency and Struktura, continues to spoof legitimate media. However, its activity remains stable or slightly declining: fewer domains with typos, no content spikes in response to strategic events, and, apparently, the cessation of activity on Meta platforms.

Operation Overload(also known as “Matryoshka”) has significantly increased its activity, publishing up to 20 videos a day and releasing over 700 videos in a year. It has expanded its reach to Poland, Romania, Armenia, and Moldova. A key feature is audience segmentation by platform, with content in Western European languages distributed on X, while content in Eastern European languages is distributed through Telegram.

Portal Kombat(the Pravda network) increased its publication volume to 10,000 articles per day across 101 websites. By the end of 2024, 26 new subdomains were registered, targeting specific regions and ethnic communities, including the Basque Country, Republika Srpska, and the Balkans, with narratives on autonomy, identity, and regional nationalism.

Chinese IMS

SpamouflageIn 2025, it perfected the use of AI-generated videos with impersonations to discredit dissidents.Paperwallcarried out its largest infrastructure expansion, adding 108 additional domains and covering 40 new countries in 15 new languages, while populating its sites with content translated from Russian-language sources, including state-controlled media. The networkFalsos Amigos, affiliated with CGTN, uses AI to paraphrase and translate content to create seemingly independent articles.

General infrastructure “for service”

A key finding of the report: the same “rented” CIB network on the X platform was used to amplify content for both Spamouflage (China) and Operation Overload (Russia). This points to the existence of a commercial market in which amplification networks are mobilized by various actors for a fee.

5. Regional focus: Eastern Partnership and the Baltic States

5.1. Ukraine

Ukraine remains the primary target of Russian FIMI. This activity pursues three main goals: reducing international support (the EU is portrayed as prolonging the war), portraying Ukraine as the instigator of attacks (false flag operations, including the Chernobyl incident), and accusing it of destabilizing activities (false accusations of terrorism against Ukrainian refugees). All levels of the Russian FIMI ecosystem are mobilized for four audiences: Ukrainian, European, Western, and African, with content and languages adapted for each.

5.2. Moldova and Armenia

The parliamentary elections in Moldova (October 2025) faced an unprecedented wave of hybrid threats. TikTok blocked over 13,000 inauthentic accounts active during the elections. After the Moldovan cycle concluded, FIMI’s infrastructure was reoriented toward Armenia. The documented similarities between the four lines of attack (moral corruption, corruption, foreign interference, and loss of sovereignty) confirm the existence of a standardized interference “template.”

5.3. Belarus

While Belarus is not the specific focus of the report, several points are directly relevant to the Belarusian context. First, 12 individuals are included in the sanctions list under the Belarusian sanctions regime for activities related to FIMI. Second, the Russian mechanisms for suppressing independent voices described in the report (over 1,000 individuals and organizations are prosecuted under laws on foreign agents, extremists, and treason) are functionally similar to practices employed in Belarus since 2020, although the report does not directly draw this parallel. Third, Russia’s promotion of state-owned platforms Max and RuTube, while simultaneously restricting YouTube and Telegram, is changing the landscape of Russian-language content accessible to Belarusian audiences: as Russian content producers migrate to state-owned platforms, the composition of the information offering for the entire Russian-language space is also changing.

5.4. Baltic States

The report notes that Lithuania and Estonia (along with Poland and Romania) are among EU countries targeted by Russia’s escalating hybrid operations (drone intrusions, acts of sabotage, attacks on critical infrastructure), which were accompanied by FIMI events. In the context of the upcoming elections, Estonia, Latvia, as well as Sweden, Denmark, Slovenia, Hungary, Bulgaria, and Cyprus, are among the member states that may face interference schemes. The Baltic Sea and the Arctic are projected as new target regions in the information space.

6. Methodological innovations

The report introduces several analytical innovations. The FIMI Operations Galaxy visualizes the interconnections between approximately 3,000 of the most active channels, identifying a central core (primarily Russian infrastructure) and peripheral clusters focused on specific regions (Moldova, Armenia, MENA, and sub-Saharan Africa). A second network graph labels channels by IMS affiliation, showing that the Doppelgänger and RRN Media Brands cluster is isolated from other IMS, Storm-1516 occupies a central position in the overall network, and Portal Kombat, despite its significant domain size, is located on the periphery.

The “5D Radar” of strategic objectives (Dismay, Distort, Distract, Divide, Dismiss) is applied separately to Russia and China, revealing qualitative differences: Russia predominates in the “distortion” and “division” categories, while China dominates in “deflection.” The Deterrence Playbook systematizes the three layers of the FIMI architecture (organizational structure, digital infrastructure, content) and four instruments of influence (sanctions, law enforcement, digital regulation, resilience) into a single matrix with specific triggers and expected consequences.

An important methodological clarification is the distinction between IMS (a set of information manipulations serving as a subject’s “digital signature”) and infrastructure (the underlying technological foundation that may be part of an IMS). This distinction, developed jointly with the French agency VIGINUM, allows for a more precise description of complex network structures.

7. Practical recommendations

The report concludes with a set of specific recommendations addressed to EU Member States, institutions, and partners. Strengthening data collection and information sharing mechanisms: establishing cross-jurisdictional channels for the transfer of evidence, including through open-source investigations. A three-pronged approach to sanctions is proposed: improving the accuracy of designations, strengthening enforcement measures, and adapting mechanisms to prevent circumvention. Measures targeting intermediaries and service providers involve strengthening information sharing between government agencies and the private sector. Using legal and law enforcement mechanisms: closer integration of law enforcement in countering FIMI. At the EU level, a study of existing legal instruments is proposed to identify gaps and ways to strengthen the legal framework.

8. Critical assessment

The authors of the report acknowledge a number of limitations. The data reflect a limited range of activities, as the EEAS does not cover all regions and languages. The identified trends should not be considered exhaustive. The findings do not claim to be representative of the overall activities of the entities mentioned.

In addition to the limitations acknowledged by the authors, several additional observations are worth noting. The concentration of 88% of cases on platform X may be biased: this does not necessarily mean X is the primary platform for FIMI, but rather reflects data availability. Access restrictions on other platforms (Meta, TikTok, YouTube) may obscure significant volumes of activity.

Despite being mentioned in the context of sanctions and foreign agent legislation, Belarus does not receive a separate section. This may be because the EEAS focuses on FIMI’s external operations, while much of Belarusian propaganda is aimed at a domestic audience. Nevertheless, Belarus’s role as a relayer of Russian narratives deserves a deeper analysis.

The report does not quantify the effectiveness of the deterrent measures already in place. The assertion that sanctions and law enforcement measures can “bring down the house of cards” requires empirical verification. Significantly, the report itself documents the continued activity of Doppelgänger, despite the inclusion of its operating organizations, Social Design Agency and Struktura, on the EU sanctions list.

9. Relevance for Belarus and the region

Although Belarus is not the central focus of this report, its findings have direct relevance to the Belarusian context in several dimensions.

The FIMI-as-a-Service model described in the report provides an analytical framework for understanding the mechanisms facing the Belarusian information space.[FactCheck.LT Observation:]FORESIGHT MAS data (a FactCheck.LT knowledge base containing over a million documents from Belarusian sources) reveals patterns consistent with those described in the FIMI Galaxy: synchronicity of narratives between Russian and Belarusian state media, and the use of similar TTPs.

[FactCheck.LT Observation:]The three-phase Russian electoral interference scenario documented in the six-country report for 2025 bears structural similarities to events in Belarus in 2020: delegitimizing the opposition, exploiting internal divisions, and undermining election integrity. The EEAS report does not draw this parallel.

The threat of contamination of LLM training data by Portal Kombat described in the report has direct implications for the Russian-language information space, including Belarus.[FactCheck.LT Observation:]Research conducted by FactCheck.LT as part of the LLM Bias Study project (testing 10 models on 50 questions about Belarus) showed that Russian-language models demonstrate significantly lower resistance to propaganda narratives.

The report’s recommendation to establish interjurisdictional channels for the transfer of evidence directly affects civil society organizations operating in exile. Standardizing data exchange in the STIX format, described in the report, is a priority for organizations working to combat FIMI in the Belarusian context.

Finally, the report’s prediction that the Baltic Sea region will become a new target in the information space directly affects Lithuania and other countries where Belarusian research organizations operate. This underscores the need to integrate monitoring of Belarusian state media into broader European early warning systems.