Skip to content

EEAS 2025 – 3rd Report on FIMI Threats

Role of the source

This is a report from an EU institution, not research. The source list classifies it as secondary, but PLAN.md lists it as one of the sources whose role (object of analysis or source of knowledge) must be clarified with Rebekka.

In brief

The EU's foreign service (EEAS) presents its third annual report on foreign information manipulation and interference (FIMI) (p. 1) [U]. The novelty is the ‘FIMI Exposure Matrix’, a tool for classifying channels by their connection to a threat actor, from official state channels to unattributed ‘state-aligned’ channels (pp. 5, 14–19) [U]. Applied to 505 incidents and some 38,000 channels in 2024, the report maps Russian and Chinese infrastructure and finds that official channels are only ‘the tip of the iceberg’ (p. 5) [U]. FIMI is described as a security threat that requires a whole-of-society response (p. 38) [U].

Research question and main claim

  • The report asks how FIMI operations can be exposed and attributed (p. 7) [U].
  • Main claim: FIMI is not a sporadic tool of influence but a strategic instrument embedded in threat actors' foreign policy (p. 38) [U].
  • Non-attributed covert networks make up 76.5% of the channels investigated and will likely remain central (pp. 20, 38) [U].

Theoretical perspective

  • No academic theoretical framework. Builds on the EEAS's earlier FIMI methodology and response framework, the ABCDE framework, and methods from cyber threat intelligence (STIX, kill chain) (pp. 4, 7, 14) [U].

Empirical material and context

  • 505 FIMI incidents between 4 November 2023 and 4 November 2024, involving 38,000 channels on 25 platforms and over 68,000 pieces of content (p. 9) [U].
  • Case studies: Russian FIMI in Moldova's 2024 elections and EU referendum, Russian FIMI in Africa, and Chinese ‘influence-for-hire’ operations (pp. 29–37) [U].
  • Context: the EU's FIMI toolbox and the first EU sanctions for FIMI in December 2024 (pp. 2, 4) [U].

Method

  • Open source monitoring, incidents encoded in STIX format, and network analysis of 2,055 core channels (pp. 9, 20) [U].
  • Classification by technical and behavioural indicators, from open, proprietary and classified sources (pp. 16–18) [U].

Key concepts

Concept How the source defines or uses it Page U/T
FIMI A mostly non-illegal pattern of manipulative, intentional and coordinated behaviour that threatens values, procedures and political processes 4 U
FIMI Exposure Matrix Four categories: official state channels, state-controlled outlets, state-linked channels, state-aligned channels 14–15 U
coordinated inauthentic behaviour (CIB) Organised efforts to mislead using networks of fake accounts 4 U
attribution Identifying the responsible threat actor; the final decision is political 4, 19 U
information laundering Hiding the origin of content by passing it through intermediaries 24 U
whole-of-society approach The only viable approach to countering FIMI 7, 38 U

How privacy and private data are understood

  • Not a theme. Data protection appears only as a legal restriction on access to proprietary data for researchers (p. 18) [U].
  • The report itself relies on collecting and analysing large amounts of data on online channels (pp. 9, 16–18) [U].

Arguments and findings

  • Ukraine was the main target (257 incidents), followed by France, Germany and Moldova (pp. 9–10) [U].
  • X accounted for 88% of the detected activity (pp. 5, 10) [U].
  • Bot networks and CIB accounts made up 73% of recorded channels (p. 11) [U].
  • Around 41 cases used AI to manipulate information, mainly deepfakes and automated dissemination (p. 11) [U].
  • Russia's infrastructure is decentralised and adapted to regions; China's is centralised and synchronised (p. 20) [U].
  • Campaigns described: Doppelgänger, False Façade, Portal Kombat, African Initiative, HaiEnergy, Paperwall (pp. 26–28, 35–36) [U].
  • The FIMI defender community faces barriers to data access and less political and financial support (p. 7) [U].

Limitations the source itself mentions

  • The data reflect only a limited subset of threat actors' activity and should not be used to draw conclusions about general trends (pp. 6, 9) [U].
  • The EEAS does not cover all regions or languages (p. 9) [U].
  • The true reach and impact of bot networks remain unclear (p. 11) [U].

What the source does not cover

  • Norway [T].
  • The state's own use of citizens' personal data [T].

Possible relevance for the thesis

  • Shows how an EU institution frames the information space as a security domain, which may be a context for Norwegian documents on digital resilience [T].
  • If the thesis includes how the state collects data to counter threats, the report shows how monitoring and attribution are justified [T].
  • Whether this is an object of analysis or a source of knowledge needs clarification (see the warning above) [T].

Connections to other sources

Key quotes

“Our information space has become a geopolitical battleground.” (p. 2)

“It demonstrates how official and attributed channels are only the tip of the iceberg of FIMI activities.” (p. 5)

“The analysis of FIMI operations presented in this report reaffirms that FIMI is not a sporadic tool of influence, but a strategic instrument embedded in the foreign policy toolbox of threat actors.” (p. 38)

Open questions for Rebekka

  • Is this report an object of analysis (what the EU says) or a source of knowledge (about FIMI)?
  • Is information manipulation part of how you understand ‘digital privacy’, or is it a related but separate topic?
  • Do Norwegian documents refer to EU work on FIMI?