By EUvsDisinfo
Foreign Information Manipulation and Interference (FIMI) has evolved into a dense and interconnected ecosystem of actors, infrastructures and narratives operating across digital platforms and geopolitical contexts. The concept of the “FIMI Galaxy”, part of the recently published 4th EEAS Report on FIMI Threats, captures this systemic reality. It exposes the complex architecture behind influence operations and provides a strategic tool for understanding and countering them.
The FIMI Galaxy: mapping the architecture of information manipulation
Compared to previous assessments, the 2025 landscape appears denser and more active. The number of detected FIMI incidents and operational channels have increased, and the consistency with which threat actors reuse their assets across campaigns and geographic spaces have become more visible. This reflects the growing sophistication of the FIMI ecosystem, where manipulation increasingly becomes an organised industry supported by specialised services. The integration of artificial intelligence tools has accelerated the production and distribution of manipulative content at reduced cost and at scale.
Another defining development is the expansion of frontlines in the information space. Almost every major geopolitical event now has a parallel dimension in the FIMI domain. Narratives linked to conflicts, elections, or geopolitical tensions circulate simultaneously across multiple regions and languages, creating persistent information pressure that seeks to influence perceptions and public debate.
Against this background, the FIMI Galaxy is an interactive tool that visualises and exposes the networks behind these operations:
https://euvsdisinfo.eu/fimi-explorer
It is structured around three analytical layers:
- Threat Actors: Russia, China and a large number of unattributed networks. This layer provides insights into the channels and infrastructures associated with each actor. Importantly, many of the most active assets cannot be directly attributed to a specific state actor, reflecting the use of proxies, intermediaries and covert networks designed to obscure responsibility.
- Information Manipulation Sets (IMS): An IMS is a digital “fingerprint” of a persistent manipulation infrastructure. These sets bring together channels, techniques, and infrastructure elements that are likely linked to the same actor or operational ecosystem. They help identify how similar infrastructures or tactics are reused across different actors, reflecting an increasing convergence of methods within the FIMI environment (e.g. Portal Kombat).
- Targets: FIMI campaigns target specific countries, organisations or individuals. By linking channels and IMS infrastructures to their targets, the Galaxy helps reveal the strategic objectives behind manipulation campaigns.
Within the Galaxy, different clusters illustrate how some networks primarily address international audiences, while others concentrate on particular regions, such as the Eastern Neighbourhood, the Middle East and North Africa (MENA) or Sub-Saharan Africa. This demonstrates how threat actors adapt narratives to regional contexts while maintaining coordination across the broader network.
Assets can be redeployed across geopolitical contexts. After the Moldovan elections, for example, similar networks and techniques began targeting Armenia ahead of its parliamentary elections. These campaigns follow familiar patterns: networks of fake accounts, fabricated investigations, impersonation of media outlets, and coordinated amplification. They reflect a recurring playbook in which manipulation networks attempt to discredit political leaders, intensify polarising narratives during the campaign period, and undermine confidence in the electoral process as the vote approaches.
The mapping exercise currently visualises around 3,000 of the active channels and their interconnections. This represents only a fraction of the wider ecosystem but already illustrates the scale and complexity of the network. Crucially, around 90 percent of these channels belong to the covert ecosystem, meaning they are not directly identifiable as state-controlled assets linked to Russia or China.
The 2025 FIMI Galaxy is, above all, a call to action. Understanding its architecture is therefore a crucial step in strengthening deterrence, building resilience, and protecting the integrity of the information environment.
Main FIMI narratives this week
Russia presented itself as indispensable to Europe’s stability and pushed for the removal of sanctions:
‘Russian energy is indispensable for the EU’
Pro-Kremlin FIMI outlets claimed Russia would ultimately prevail in its confrontation with the West because Europe cannot survive without Russian oil and gas, doubling down on the narrative that sanctions hurt the West more than Russia and using the Iran-related energy crisis to portray Europe as facing collapse while pushing for the lifting of sanctions.
Ukraine was portrayed as a destabilising actor to erode trust in its international partnerships:
‘Ukraine is preparing a provocation in the Middle East’
Pro-Kremlin messaging alleged that Ukraine was sending saboteurs to Qatar, Saudi Arabia, and the United Arab Emirates under the guise of air defense experts to prepare provocations against Russia. The claim is aimed at undermining trust in Ukraine, whose expertise in countering drone attacks could be valuable to Gulf countries and potentially challenge Russian influence in the region.
By EUvsDisinfo
