Photo: Canva Collage

This article was first published by Truthmeter.mk (North Macedonia), within the framework of Western Balkans Anti-Disinformation Project.

Democratic elections in European countries are among the primary targets of Russian FIMI operations, the latest report by the European External Action Service on information manipulation and obstruction from abroad finds. At the heart of Russia’s FIMI infrastructure is a layer of channels directly tied to the Kremlin. Media outlets such as Sputnik, RT, TASS, RIA Novosti, Gazeta, Lenta, Soloviev Live and Ukraine.ru play a central role in producing and reinforcing Russian narratives

Author: Miroslava Simonovska

Russia’s military invasion of Ukraine on February 24, 2022, has intensified the wide range of information manipulation tactics used by the Kremlin, including the construction of disinformation narratives that have been in place since 2013, according to the latest report by the European External Action Service on FIMI (Foreign Information Manipulation and Interference) in 2024. According to the report, Russia’s manipulative efforts are in fact an attempt to build a false facade to hide pro-Kremlin information laundering operations, or to impersonate legitimate media outlets to bolster their credibility.

According to the report, in 2024, Russia particularly deployed these manipulative tactics in the context of the European elections, where pro-Kremlin outlets attempted to target voters across EU member states with narratives undermining support for Ukraine.

Other significant elements include campaigns to discredit prominent European political leaders with allegations of corruption, as well as attempts to discourage voters from exercising their democratic rights and to instill distrust in European institutions, the report says.

However, the EU and its member states quickly recognized these manipulative attempts and countered the false claims through awareness and disclosure campaigns. EUvsDisinfo actively published analyses exposing FIMI operations aimed at influencing elections.

 Russia’s FIMI campaigns have also sought to exploit specific vulnerabilities in the political, social and technological spheres with carefully tailored and targeted content, particularly where Russia seeks to advance its foreign and security policy interests. In 2024, Russia also sought to interfere in democratic processes in Moldova, targeting both its Presidential elections and the referendum on EU accession. The Kremlin’s attempted interference in Moldova demonstrates how overt political pressure is backed by covert influence operations through obfuscated money transfers, paid influencers and social media flooding. Similarly, the parliamentary elections and the ensuing civic unrest in Georgia were also on Russia’s radar, with pro-Kremlin FIMI actors seeking to erode social cohesion and exacerbate the political divide. These manipulative attempts confirm that democratic elections are among the prime targets for Russian FIMI operations, the report states. 

The report presents key trends in foreign information manipulation in 2024, targeting 90 countries. The main victim, as in 2023, remains Ukraine, accounting for more than half of the incidents, while France, Germany, Moldova, and Sub-Saharan Africa are also heavily targeted. In addition to elections, attacks are also targeting organizations and individuals, the EU, NATO, as well as independent media outlets. According to the report, 88 percent of the detected activities are on the social network “X,” and the key tactics are bots, coordinated inauthentic behavior, identity theft, and the creation of inauthentic news websites, which is called the “Doppelgänger Campaign.” Artificial intelligence is also abused because it is cheap and can quickly create inauthentic content and amplify FIMI activities.

 

Trends in 2024 with FIMI

The report analyzed 505 FIMI incidents between November 4, 2023 and November 4, 2024. This sample involved 38 thousand unique channels on 25 platforms and 68 thousand pieces of content. Threatening foreign actors use information manipulation and obstruction from abroad as part of a broader hybrid arsenal. The content is in different languages in order ​​​​to reach a wide variety of audiences, however, Ukraine remains the main target of Russian FIMI attacks. Of the 505 incidents, 257 were recorded in Ukraine. The content is aimed first at Ukrainians themselves, to weaken resistance to the Russian military invasion, and then at Western partners (the US, NATO, G7 and EU countries with a focus on Germany and Poland) to reduce support for Ukraine. After Ukraine, France is the second target with 152 cases detected in the report, which originate from the ecosystem of Russian and Chinese information manipulation. Attacks on Germany have mainly occurred during political events, international visits, and farmers’ protests, which have attracted significant media attention. Organizations, particularly the EU, NATO, and the armed forces of some Western countries, such as Germany, France, and the United States, have also been targeted. Independent media outlets such as the BBC, France 24, and Der Spiegel, as well as those fighting against foreign information manipulation such as Bellingcat, EU Disinfo Lab, and Correctiv, have also been targeted. About 53 percent of the incidents target individuals, including smear campaigns against EU leaders such as Ursula von der Leyen, Kaja Kallas, and Josep Borrell.

The core of the FIMI infrastructure is a network of channels that are openly controlled by a threat actor. The report notes that at the heart of Russia’s FIMI infrastructure is a layer of channels directly tied to the Kremlin. Within this group, state-controlled media outlets are the main links that carry Kremlin-backed content. Media outlets such as Sputnik, RT, TASS, RIA Novosti, Gazeta, Lenta, Soloviev Live, and Ukraine.ru play a central role in producing and reinforcing state narratives.

Beyond these, diplomatic channels operate more discreetly, reposting content from the Russian Foreign Ministry and interacting with influential but unattributed channels in the larger infrastructure. Behind this “cover,” Russia also operates through channels that conceal its ties to the state apparatus. These covertly connected entities help to expand Russia’s reach, making these narratives appear more organic and diverse. The third layer consists of state-linked but unattributed channels that amplify the Russian message without being officially recognized as part of the Kremlin network, the report says.

These include news sites, blogs, influencers, and YouTube channels that repackage content from state-controlled media to target different audiences. Some have large followings and strong influence in specific clusters and help the content spread in echo chambers.

Already existing FIMI operations such as “Portal Kombat” and “False Façade” are key clusters in this space, ensuring that Russian narratives will be active and influential, even when official sources are banned or restricted in certain regions, the report says.

The fight against FIMI—a priority for the EU and partners

The fight against foreign information manipulation must remain a priority for the EU and its partners, the report concludes. This requires enhanced international cooperation to protect democratic institutions and the integrity of free, diverse and open information spaces. In the future, it is very likely that covert networks and unattributed channels, which account for over 75 percent of the channels investigated in this report, will continue to play a central role in FIMI operations.