4th EEAS Report on FIMI Threats – Dismantling the FIMI house of cards

Modern conflicts extend far beyond the battlefield. Alongside tanks and drones, they unfold in the information space, where narratives, algorithms, and digital platforms are used to mislead and manipulate audiences.

The information space has become a critical arena where state-sponsored actors attempt to mislead and manipulate citizens by shaping public opinion, political choices, and even electoral outcomes.

What’s new in the 4th EEAS Report on FIMI Threats

The 4th EEAS Report on FIMI (Foreign Information Manipulation and Interference) Threats provides new data on the scale of these activities and introduces practical ways to make them harder and more costly to carry out.

Since 2023, the EEAS has published a series of annual FIMI threat reports mapping the evolving FIMI threat landscape and outlining the EU’s approach to countering it. Each report has introduced new instruments to address key questions related to the analysis and responses to FIMI.

How to analyse? The First Threat Report presented the FIMI Methodology establishing a standardised approach to investigating manipulation activities through open-source analysis.

How to respond? The Second Threat Report introduced a Response Framework outlining how the EU and its partners can coordinate responses to FIMI campaigns, including those targeting elections.

How to expose? The Third Threat Report developed the FIMI Exposure Matrix, a tool designed to reveal the connections between digital channels and the infrastructure behind influence operations.

The newly released Fourth EEAS Report on FIMI Threats focuses on how to deter FIMI operations. Building on previous frameworks and the EU’s FIMI Toolbox, it introduces the FIMI Deterrence Playbook, a structured approach aimed at increasing the costs and reducing the operational space for those conducting information manipulation.

The report draws on an investigation of 540 incidents recorded throughout 2025. These cases involved approximately 10,500 social media channels and websites used to produce or amplify manipulative content.

State-linked actors and plausible deniability

Among incidents where attribution was possible, 35% were linked to state actors, including 29% associated with Russia and 6% with China. However, much of the activity remains difficult to attribute. Both countries frequently rely on complex and opaque networks that allow them to expand their reach while maintaining plausible deniability.

The report confirms that Ukraine remained the primary target of FIMI operations that sought to decrease international support for Ukraine and its people and to question the legitimacy of its leadership and its resistance against Russia’s war of aggression.

Elections under pressure

Electoral processes continue to attract particular attention from threat actors. In 2025, elections in several countries – including Germany, Poland, Romania, Moldova, Czech Republic, and Côte d’Ivoire – were targeted by FIMI campaigns.

Technological developments are also shaping these operations. In 2025, 27% of the incidents analysed involved artificial intelligence, including AI-generated text, synthetic audio, and manipulated video. Such tools enable faster content production and allow influence campaigns to scale with fewer resources.

Behind the screens: networks and Infrastructure

Network analysis conducted in the report also expands our understanding of the broader ecosystem behind FIMI operations. By mapping connections between channels and platforms, the report identifies a central digital infrastructure linked to regional hubs targeting areas such as Sub-Saharan Africa, the Middle East, and North Africa as well as Eastern Europe.

The findings highlight that FIMI campaigns are frequently triggered by major political events or news events. Nearly half of the recorded incidents were linked to specific developments, including elections, protests, or international crises, which provide opportunities for manipulation narratives to gain traction.

Why this matters

Moments of major political or news events are when people actively seek information to make sense of what is happening. This heightened attention creates a window of vulnerability that hostile actors deliberately exploit. By injecting manipulative narratives at these moments, FIMI actors can shape first impressions, distort understanding, and influence public reactions before accurate or contextualised information has time to circulate. As a result, FIMI can spread more rapidly and take deeper root, precisely when citizens are most reliant on trustworthy information.

From analysis to action: the FIMI Deterrence Playbook

The latest threat report presents a FIMI Deterrence Playbook that proposes a shift from diagnosis to action. By identifying key vulnerabilities within the infrastructure, intermediaries, and supply chains used by threat actors, the EU and its partners can mobilise existing instruments such as sanctions, law enforcement cooperation, digital regulation, and resilience-building to disrupt these activities.

For a deeper look at the data, networks, and tactics behind these operations, explore the Fourth EEAS Report on FIMI Threats, which offers a detailed analysis of how the threat is evolving and how it can be countered.

EXPLORE THE GALAXY

Lastly, the report features the FIMI Galaxy Explorer – the first public interactive dashboard on FIMI activities.

It lets you easily navigate key networks used in FIMI attacks, demonstrating connections between players involved in information manipulation activities and their role in interconnected networks. You can see that attacks occur not in a sole, isolated manner, but are a part of a complicated galaxy of hostile information activities.

While currently reflecting key FIMI activities in 2025, the explorer is created as a long-term tool that will be updated regularly.