By EUvsDisinfo
Russia’s disinformation campaigns are not a loose collection of random lies; they are the product of a carefully engineered system. This system is best visualised as an iceberg: a structure where the loudest pro-Kremlin voices are merely the visible tip, supported by a vast and often hidden system below.
For every government official or Kremlin propagandist on Russia’s generously funded state TV channels, there are a multitude of more and less visible channels – websites, blogs, social media accounts, influencers, and pseudo-commentators. They amplify, contradict, mock, spin, question, and confuse – all in the pursuit of the Kremlin’s broader goal of dominating the information space.
Russia’s foreign information manipulation and interference (FIMI) operations rely on a large, well-funded and purpose-built architecture, composed both of visible and obscured parts. It involves both state and non-state elements. It is flexible, highly adaptable, and capable of deploying tailored approaches to shape perceptions and influence behaviour across Russia’s neighbourhood and far beyond.
Previous research into Russia’s disinformation and information manipulation efforts have shed light on the complex architecture behind the Kremlin’s lies. They have been likened to a digital hydra, with distinct pillars and the ability to evolve and transform under pressure.
Building upon the existing insights within the research community, the 3rd EEAS Report on FIMI threats takes a fresh look at the architecture behind Russia’s FIMI operations through the lens of technical and behavioural indicators. This is a novel way to look at websites, social media accounts and other digital channels used for information manipulation, enabling a much deeper dive beyond the tip of the iceberg.
A word on indicators
Some of the Russian state-controlled and state-financed outlets like to flaunt their connections to the Kremlin. Notably, the editor in-chief of RT has (in)famously and publicly equated its importance with that of Russia’s need for a Defence Ministry. At the same time, RT has been known to run ‘projects‘ that go to great lengths to obscure their true origins and sources of funding.
In many cases, when a given channel’s funding, editorial control or governance is purposefully obscured, a combination of technical and behavioural indicators can be used to fill in the gaps.
Technical indicators include digital signatures, hosting patterns, domain ownership and other technical traces that help identify the underlying digital infrastructure of a FIMI operation.
Behavioural indicators refer to activity patterns in content creation, distribution and engagement (e.g. patterns of automated republishing, linguistic patterns, use of AI, etc.).
Combined together, these indicators help to systematically classify pro-Kremlin disinformation sources based on how close they are to the Kremlin, better understand their position in the overall information manipulation architecture, and craft more targeted and more efficient responses.
Four blocks of the FIMI architecture
The official state channels
At the tip of the FIMI iceberg are channels that are the most open and transparent about their connections to the Kremlin – the official state channels. These include the Russian government, its institutions and representatives, reflecting Russia’s official voice.
Throughout the years, the Kremlin and officials such as the Minister of Foreign Affairs or the head of Russia’s spy agency have been among the most prominent voices of disinformation. In many cases, they set the tone for the rest of the system to amplify certain false claims. In some instances, they themselves have amplified anonymous sources elevating conspiracy theories to the highest political level. These official channels also have access to international forums, which they frequently use to launder pro-Kremlin disinformation claims at the highest political level.
State-controlled outlets
Another layer of the iceberg is state-controlled outlets, which are funded, managed and editorially controlled by the state or state-appointed bodies. Their connections to the Russian state are out in the open.
Most of Russia’s federal TV channels as well as RT and Sputnik fall into this category. Many of them have been sanctioned by the EU for supporting Russia’s invasion of Ukraine.
State-linked channels
An even deeper layer of the FIMI iceberg, just beyond the line of visibility, is state-linked outlets that operate under state oversight without publicly disclosing their affiliation. They function in the grey zone, obscuring their origins and blurring the lines between government, media and online influence to push for political and strategic goals. They are designed to shape narratives, manipulate perceptions, sow confusions and operate in an opaque manner. It takes research and continuous effort to attribute them to a specific threat actor (e.g. the Kremlin).
An outlet like NewsFront is a good example. Registered in illegally annexed Crimea, it operates in multiple European languages, presenting itself as ‘documentary journalism’. In reality, it was established by individuals with close links to the Russian state and has connections to Russian foreign intelligence services. It has been publishing pro-Kremlin narratives for years and was involved in broader information manipulation operations online as an amplifier for Russia’s messaging. Its operations online have been exposed by online platforms and governments, illustrating that in some cases open-source information has to be complemented with classified or proprietary information to reliably attribute a channel.
Another example is The Doppelganger campaign, a multifaceted FIMI operation originating from Russia and involving a whole network of inauthentic websites, which has targeted Ukraine as well as the EU Parliament elections.
State-aligned channels
Descending even further into the grey zone of Russia’s FIMI underworld is the bottom layer of state-aligned FIMI channels. These are sources that cannot be directly attributed to state control or state funding with current evidence. However, a combination of technical and behavioural indicators (e.g. shared infrastructure, or patterns of systematic amplification of the same disinformation narratives) show strong, repetitive patterns of alignment with other known and already attributed parts of Russia’s FIMI architecture.
State-aligned channels such as social media accounts, blogs, or websites impersonating other outlets have featured prominently in Russian influence operations that have recently been exposed, such as False Façade, Portal Kombat and others.
They remain unattributed to a state actor (e.g. the Kremlin) until additional evidence emerges, however, they still play a systemic role in FIMI operations and are an integral part of Russia’s FIMI architecture.
Knowledge is power
Mapping disinformation actors based on their proximity to the Kremlin is more than a classification exercise – it’s essential to understanding how Russia’s manipulation machine works.
The more precisely we understand the structure and function of this architecture, the better prepared we are to respond. So #DontBeDeceived – dive into the full 3rd EEAS FIMI Report.
By EUvsDisinfo
