Developing a Unified Framework for Financial Identity Management Infrastructure

Russia’s Disinformation Operations Exposed Through New Framework

Four years after Russia’s full-scale invasion of Ukraine triggered an unprecedented surge in disinformation campaigns across Europe, experts are introducing a more sophisticated approach to combating foreign information manipulation and interference (FIMI).

The rapidly expanding field of disinformation monitoring has created significant challenges for researchers and security officials. Duplicate reporting of incidents and a lack of coordination between stakeholders have inflated perceptions of the scale of operations while obscuring the strategic relationships between different disinformation campaigns.

A new report, developed through a collaborative working group facilitated by EU DisinfoLab, introduces the Information Manipulation Sets (IMS) framework as a practical solution to these challenges. The framework, endorsed by organizations including CheckFirst, Viginum, Cassini, the German Federal Foreign Office, the European External Action Service, and the DFR Lab, aims to strengthen attribution standards and enhance countermeasures against state-sponsored disinformation.

“The current fragmented response landscape leads to easily bypassed ad hoc measures,” explains the report. “We need to move beyond focusing solely on isolated incidents toward a ‘supply chain’ perspective that identifies vulnerabilities across the entire disinformation ecosystem.”

The IMS model, originally developed by France’s VIGINUM agency, defines an Information Manipulation Set as a collection of adversarial behaviors, tools, and tactics likely linked to the same threat actor. This approach bridges the critical gap between individual incidents and full campaign attribution, enabling analysis at tactical, operational, and strategic levels.

By implementing the IMS framework, analysts can transcend repetitive incident tracking to reveal the operational infrastructure behind disinformation campaigns. This allows for better attribution thresholds, clearer mapping of enabling technology, and sharper distinctions between different types of operations—even when orchestrated by the same threat actor.

The working group applied this framework specifically to Russian operations targeting European audiences, identifying five key IMSs: Doppelganger, Media Brands/RRN, Undercut, Storm-1516, and Overload. Each operation employs distinct methods, infrastructures, and objectives while operating within Russia’s decentralized yet state-linked disinformation apparatus.

Doppelganger, described as “one of the most emblematic Russian information operations since the end of the Cold War,” specifically targets Western information ecosystems through sophisticated impersonation techniques. The operation exemplifies Russia’s evolving approach to information warfare.

The report also assessed the effectiveness of EU sanctions through the IMS framework, revealing significant implementation gaps. Despite sanctions existing on paper, enforcement remains inconsistent. Sanctioned entities like Russia’s Strategic Development Agency (SDA) continue to access EU-based services despite formal asset freezes. Multiple barriers undermine effectiveness, including inadequate notification systems, widespread use of proxies, fragmented enforcement mechanisms, and limited platform transparency.

The investigation revealed the complex ecosystem supporting these operations, including the SDA, remnants of the former Prigozhin network, and ideological actors affiliated with Alexander Dugin’s sphere of influence. These overlapping contractor networks provide Russia with plausible deniability while maintaining operational capabilities.

To address these challenges, the report recommends several concrete actions: strengthening sustained data collection on IMSs; improving coordination between platforms, researchers, and public bodies; introducing IMS tagging in takedown databases to support cross-platform monitoring; enhancing transparency about how IMSs function within social media platforms; and reforming the EU sanctions regime to better target operational structures supporting disinformation networks.

“The IMS framework provides a structured, practical approach to improve collective attribution and design more effective countermeasures,” the report concludes. “Continued cooperation across sectors will be essential to translate these insights into meaningful disruption of FIMI threats.”

The working group has expressed openness to collaborating with vetted stakeholders who can contribute additional technical documentation, infrastructure data, and attribution methodologies to further strengthen the collective response to Russian disinformation operations.