Seeing the whole picture: a new way to track Russian FIMIBy EUvsDisinfo
Russian disinformation campaigns are not random but organised, persistent, and designed to manipulate how people think, vote, and trust institutions. Despite years of research and monitoring, responses to these operations remain fragmented. The lack of coordinated reporting and a shared framework leads to duplication of efforts and limits the impact of counter-FIMI measures.
That is why EU DisinfoLab, together with its partners the European External Action Service (EEAS), Viginum, DFRLab, CheckFirst, Cassini, and the Auswärtiges Amt published Building a Common Operational Picture of FIMI. The report proposes a clear terminology and a new model for defining, detecting, describing, and disrupting FIMI operations.
Why FIMI is often ‘lost in translation’One major problem is terminology. Reports often mix words like incidents, operations, campaigns or a threat actor as if they mean the same thing. This creates ‘conceptual noise’: duplication of effort, confusion over who is behind what, and missed opportunities to respond effectively.
To address this, the report builds on the Information Manipulation Set (IMS) model developed by the French agency Viginum. An IMS captures the identifiable pattern of behaviour used by a specific disinformation actor, including their tools, methods, platforms, and tactics over time. Using this approach, the framework was applied to four well-documented operations: Doppelganger, Storm-1516, Undercut, and Overload.
From labels to behaviourTake the well-known label ‘Doppelganger’, that has often been used as a catch-all for many pro-Kremlin influence activities. But the IMS approach shows that these operations are not identical. Some of them impersonate real media outlets. Others create fake ‘alternative’ news brands from scratch. Some rely heavily on video, others on cloned websites or paid advertising. By looking at how these operations work – not just what they say – analysts can distinguish between them and trace them back to specific networks, including EU sanctioned Russian entities such as the Social Design Agency.
Overall, an IMS can be understood as a threat actor’s ‘digital fingerprint’. It brings together the behaviours, tools, tactics, techniques, procedures, and resources used by the same actor – whether that actor is already known or not. A threat actor controls an IMS, and through it runs information campaigns, which can then be broken down into individual operations or incidents.
Seeing the whole supply chainThe IMS model shifts attention away from isolated posts or fake articles towards the disinformation supply chain. It helps identify who produces the content, who amplifies it, which platforms and services enable it, and where vulnerabilities exist.
As a result, this enables the following capabilities:
• collective and credible attribution,
• detection of vulnerabilities in FIMI operations,
• assessment of the effectiveness of countermeasures against FIMI campaigns.
Key conclusions from the expert groupThe IMS approach is not without limits. Its main challenge is cooperation. Public authorities and private organisations work under different mandates and priorities, which makes sustained collaboration hard to maintain. While the IMS model improves how disinformation is analysed, its full potential depends on stronger and more consistent cooperation between researchers and analysts.
The expert group reached three main conclusions. First, the IMS makes it possible to attribute information operations collectively rather than in isolation. Second, disinformation networks run by Russia or other any other actor rely on financial and operational intermediaries, including on those based inside the EU. Third, the model can strengthen both the design and enforcement of sanctions by improving the identification of networks, intermediaries, and enabling structures behind FIMI operations. By providing a clearer picture of how these networks function, the IMS model supports more targeted, evidence-based sanctions that are better aligned with the operational realities of disinformation campaigns.
Using the Cassini mapping tool, experts tracked campaigns linked to the Social Design Agency across Europe. Their analysis showed that sanctions have not stopped these networks from using technical intermediaries, cloaking services, hosting providers, and advertising infrastructure in several EU member states. The report concludes that this ongoing activity points to weaknesses in enforcement rather than a lack of evidence.
From tools to action: strengthening cooperation and enforcementThe report is clear: better tools alone are not enough without stronger cooperation and enforcement.
It recommends:
stable funding for long-term cooperation between public and private actors,
greater transparency from platforms on how disinformation networks operate,
tagging IMSs in takedown databases to improve shared awareness.
To improve the impact of sanctions it advocates for:
strengthening the evidentiary value of open-source investigations,
improving coordination of sanctions enforcement,
tailoring sanctions to disrupt FIMI networks more effectively.
Disinformation is a coordinated threat. Countering it requires a shared picture, shared responsibility, and the political will to act on what is already known.
https://euvsdisinfo.eu/seeing-the-whole-picture-a-new-way-to-track-russian-fimi/
