Russian Foreign Information Manipulation and Interference Inside the European Union: Democratic Legitimacy and the Limits of Resilience

A comparative analysis of Russian Foreign Information Manipulation and Interference in EU Member States and the EU’s eastern neighbourhood (January 2025 to October 2026) — examining objectives, toolkits, laundering models, regional patterns and the limits of resilience.

Executive Summary

Russian information operations accompanied elections across the European Union in 2026, from Hungary and Bulgaria in the spring to the German Länder, Sweden, Estonia and Latvia in the autumn. Building on the first study in this series, which examined Armenia, Georgia, Moldova and Ukraine, this paper asks whether EU membership protects against Russian foreign information manipulation and interference (FIMI), how the EU case compares with the eastern neighbourhood, and what the elections of 2024 to 2026 reveal about the limits of FIMI’s effect.

The central argument is that, inside the EU, Russia’s most effective laundering nodes are often democratically legitimate actors protected by the norms that membership upholds. This democratic legitimacy paradox has a corrective side: the rule of law that shelters such actors also preserves the means of removing them, as Hungary’s election of April 2026 showed. The paper distinguishes documented cooperation, contact without coordination and independent alignment, and does not treat Eurosceptic voices as instruments of Moscow. The weight of current evidence suggests that Russian operations inside the EU primarily amplify existing domestic political alignments rather than manufacture them.

Russia uses one toolkit in both theatres: Storm-1516, Matryoshka and the Pravda network operate against Member States and neighbourhood states alike. Inside the EU, where Russian state media are banned from broadcasting, operations disguise their origin from the outset and rely increasingly on commercial services and AI-generated content. Membership provides sanctions, platform regulation, national attribution capacities and independent courts, but gaps remain: restricted platform data, linguistic fragmentation, economic grievances and the paradox itself. France and Germany face the largest volume of operations and have gone furthest in public attribution. Central and Eastern Europe shows the widest variation, from documented cooperation at government level in Hungary to the annulment of Romania’s presidential election. The Nordic authorities assess their countries as a low priority for Moscow.

The decisive variable is not membership as such but whether the state is on the side of defence. In Georgia the state itself performs the laundering function; in Moldova, determined institutions with EU support limited the effect of an organised vote-buying network. Across both theatres, election outcomes did not follow the intensity of operations. Research on effects points the same way: party positions shape pro-Kremlin attitudes more than foreign content does, and operations gain traction mainly where trust is low, where domestic voices carry them or where the state becomes a channel. Over-attribution has its own costs, as the unfounded claims that strikes on Yandex data centres had silenced Russian bots showed.

The paper makes seven recommendations, linked to the European Democracy Shield: target the commercial supply chain; protect counter-FIMI capacity from political pressure; attribute operations with stated confidence; secure researchers’ access to platform data and enforce the Digital Services Act; help newsrooms verify fabricated material once rather than many times; keep the threat in proportion; and extend EU instruments to the eastern neighbourhood.

I. Introduction, Research Questions and Scope

Between January and October 2026, Russian information operations accompanied elections across the European Union: in Hungary and Bulgaria in the spring, and in the German Länder, Sweden, Estonia and Latvia in the autumn.¹ The European External Action Service (EEAS) recorded 540 FIMI incidents in 2025 and placed France and Germany among the four most targeted countries, alongside Ukraine and Moldova. It attributed 29 per cent of the incidents to Russia and 6 per cent to China; the remainder showed indicators of coordination with Russian or Chinese assets.² The European Union is not merely the background to Russian operations in its neighbourhood. It is one of their principal targets.

The first study in this series, Russian Foreign Information Manipulation and Interference (FIMI) Operations across the EU’s Eastern Neighbourhood, published by the EU Awareness Centre in June 2026, examined Armenia, Georgia, Moldova and Ukraine. It concluded that Russian FIMI in these countries is systematic rather than episodic and serves a single purpose, preventing the consolidation of sovereign, democratically governed states oriented towards the West, but relies on different tools in each country: finance-driven proxy networks in Moldova, the governing party as the main channel of Kremlin narratives in Georgia, narratives of Western abandonment in Armenia and narrative preparation for military action in Ukraine. The study called this pattern the modular implementation principle.³ The present study asks what happens when the same instruments are turned against EU Member States. It is an independent study, but it uses the conceptual framework of the first so that the findings of the two can be compared directly.

The paper addresses three questions. The first is whether EU membership constitutes a structural defence against Russian FIMI, or whether it changes only the form in which Russia exploits a society. The second is how Russian objectives, methods, laundering models and outcomes inside the EU compare with those documented for the eastern neighbourhood. The third is what the electoral cycle of 2024–2026, in both theatres, reveals about the limits of FIMI’s effect on elections.

The central argument is that, within the EU, Russia’s most effective laundering nodes are often democratically legitimate actors whose activities are sheltered by the legal, political and institutional norms that EU membership upholds. The evidence of 2026 refines this argument in two ways. First, the paradox has a corrective counterpart. In Hungary’s election of 12 April 2026, Tisza won a two-thirds majority despite documented Russian operations in favour of the incumbent, although only after sixteen years in which the government’s electoral mandate shielded it from effective EU sanction.⁴ Second, the paradox runs in both directions. Attributing domestic Euroscepticism primarily to foreign bots overstates external manipulation and ignores evidence that the positions of voters’ preferred parties are the strongest correlate of neutral and pro-Kremlin attitudes in Europe.⁵ The weight of current evidence therefore suggests that Russian influence operations primarily amplify existing domestic political alignments rather than manufacture them.

The analysis covers the period from January 2025 to October 2026. Member States are grouped in four regional clusters: the Baltic States, Central and Eastern Europe, Western Europe and the Nordic States. Individual countries are discussed where the evidence of Russian operations is substantial, as for the larger Member States, or where a case shows Russian FIMI with particular clarity. Norway, a NATO member outside the EU, serves as a point of comparison.

II. Research Design: Continuity with the First Study

A comparison is possible only if both studies use the same concepts. This paper therefore adopts the definitions and tools of the first study: the EEAS definition of FIMI as “a mostly non-illegal pattern of behaviour that threatens or has the potential to negatively impact values, procedures and political processes”, with its four dimensions of actors, behaviour, content and effects; the four-tier model of Russia’s information architecture; the concept of information laundering; the six-step operational grammar; and the modular implementation principle.⁶

The FIMI concept closely mirrors the framework that James Pamment developed in 2020 for the EEAS, in a series that also found EU policy on disinformation marked by “a lack of terminological clarity, unclear and untested legal foundations, a weak evidence base”.⁷ Bennett and Livingston trace the spread of disinformation in Western democracies to declining confidence in institutions, and associate its sources with both nationalist, primarily radical-right, and foreign, commonly Russian, strategies.⁸ The emphasis of the FIMI concept on foreign origin fits the eastern neighbourhood, where the source of most operations is rarely in doubt. Inside the EU, where Russian narratives are often carried by domestic parties and media, the line between foreign interference and domestic political speech is itself contested. Table 1 sets out how the design of the present study relates to that of the first.

Table 1. Research design of the first and the present study

Source: author’s compilation.

Three concepts are specific to this paper. The first is the democratic legitimacy paradox. The underlying tension is old: Karl Loewenstein argued in 1937 that democracies must be able to defend themselves against movements that use democratic freedoms to undermine democracy, and Karl Popper formulated the “paradox of tolerance” in 1945.⁹ Walker and Ludwig later used the term “sharp power” for the way authoritarian states exploit the openness of democratic societies to “pierce, penetrate, or perforate” them.¹⁰ The difference from the eastern neighbourhood is not that laundering nodes inside the EU are elected: Georgian Dream is also an elected government, and the first study identified it as the main domestic channel of Kremlin narratives in Georgia.¹¹ The difference is that, inside the EU, functioning rule-of-law systems both protect such actors and retain the capacity to correct them. The concept must be applied with care. Following Pamment’s question of whether an actor works on its own account or on behalf of another,¹² this paper separates three degrees of involvement: documented cooperation with Russian state actors, such as payment or operational coordination; contact without evidence of coordination; and independent alignment, in which domestic actors advance similar narratives for their own reasons. The term “laundering node” is reserved for the first. Alignment alone is not treated as evidence of Russian direction, and the paper does not suggest that parties or voters holding Eurosceptic or Russia-friendly views act on Moscow’s behalf. To do so would lend credibility to Russian claims that European governments silence their critics.

The second concept is inverted laundering. In the neighbourhood, laundering through local validators often follows injection through openly Russian sources. Inside the EU, where RT and Sputnik have been suspended from broadcasting since March 2022,¹³ an operation must convert content of Kremlin origin into apparently domestic speech as early as possible. The third is the FIMI supply chain. The EEAS notes that outsourcing to intermediaries provides deniability and complicates attribution, and that 91 per cent of the channels in its network map of 2025 were unattributed, state-aligned channels.¹⁴ Peer-reviewed research describes the same movement towards commercial “digital mercenaries” and towards service providers that overlap with organised cybercrime.¹⁵ Russian FIMI is therefore treated here as a chain of functions, from strategy and content production to hosting, distribution and paid amplification, each of which may be performed by a different, often commercial, actor.

Evidence is drawn from official documents, including EEAS reports, Council decisions and the assessments of national agencies such as France’s VIGINUM; research organisations; peer-reviewed literature; and reputable journalism. Evidence is considered up to October 2026. Attributions are reported in the terms, and at the level of confidence, used by the attributing body, and they are not strengthened in the retelling.

III. Russia’s Strategic Objectives Inside the EU

The first study identified four objectives of Russian FIMI in the eastern neighbourhood: blocking Euro-Atlantic integration, eroding institutional trust, intensifying polarisation and preparing the ground for coercive action.¹⁶ Member States have already made the choice that Russia seeks to prevent in its neighbourhood. Russian objectives inside the EU are therefore directed less at preventing integration than at reversing or exhausting its consequences: the sanctions regime, support for Ukraine and the cohesion of the Union itself (Table 2).

Table 2. Russian strategic objectives in the two theatres

Source: author’s compilation, based on the first study and the sources cited in this section.

Fracturing Unity Through the Unanimity Rule

Decisions on sanctions, and on most of the EU’s common foreign and security policy, require unanimity in the Council.¹⁷ For Russia, a single sympathetic government is therefore worth more than a broad but diffuse current of opinion. In early 2026 Budapest blocked a €90 billion EU loan to Ukraine, citing a dispute over the transit of Russian oil through the Druzhba pipeline, a dispute that also delayed a new sanctions package. Within two weeks of the April election, Hungary lifted its veto, and EU ambassadors approved both the loan and the sanctions.¹⁸ Under Orbán, Hungary combined two roles that Russia rarely finds in one place: an amplifier of Kremlin-aligned narratives at home and a veto player in Brussels.¹⁹ The unanimity rule is what turns a laundering node into a veto player.

Exhausting European Support for Ukraine

The targeting has followed the money. According to NewsGuard, citing the Kiel Institute for the World Economy, US aid to Ukraine fell by 99 per cent in 2025, while European military aid rose by 67 per cent compared with its 2022–2024 average. Over the same period, the Russian information manipulation set Storm-1516 turned to France and Germany: between January 2025 and February 2026 it advanced 34 false claims about the two countries, spread through 175,000 posts and articles and viewed 274 million times on X alone, against 12 such claims in the whole of 2024.²⁰ The targets were Germany, now Ukraine’s largest military donor, and France, whose President has become one of Kyiv’s most prominent advocates in Europe.

Amplifying Domestic Divisions

The EEAS found that nearly half of the incidents it recorded in 2025 were triggered by specific events, especially breaking news and elections, and that Russia targeted elections in Germany, Poland, Romania, the Czech Republic and Moldova during the year.²¹ Much of the material Russia needs is already present in domestic politics. A study of eleven European radical right parties found that, after the 2022 invasion, most neither defended Russia nor openly changed position; instead, they used the war to sharpen their opposition to the EU, above all through arguments about energy prices and sanctions.²² A second study finds the European far right increasingly divided on Russia since 2022.²³ Russian operations are most effective when they amplify narratives that domestic actors already produce for their own reasons.

A Long-Term Investment

These objectives are pursued as a permanent programme. The EEAS reports that Russia’s budget for state-controlled media is set to reach 146.3 billion roubles, approximately €1.56 billion, in 2026, 7 per cent more than in 2025, and that funding for FIMI will rise as part of that increase.²⁴ The figure does not include the cost of covert operations, much of which is outsourced. The European response has also become permanent: by October 2026 the Council’s sanctions regime against Russia’s destabilising activities covered 80 individuals and 20 entities, up from 65 and 17 in January, and it has been extended until October 2027.²⁵

IV. The FIMI Toolkit and Supply Chain Inside the EU

The first study described Russia’s toolkit in the eastern neighbourhood: state media, impersonation of trusted media, the Pravda network, bot networks, oligarchic proxies and AI-generated content.²⁶ The same instruments operate inside the EU, but they are combined differently (Table 3).

Table 3. The Russian FIMI toolkit in the two theatres

Source: author’s compilation, based on the first study and the sources cited in this section.

State Media After the Bans

The EU suspended the broadcasting of RT and Sputnik in March 2022 and of four further outlets in May 2024, and in May 2025 broadened its framework to allow further Kremlin-controlled broadcasters to be suspended.²⁷ The bans have reduced the direct reach of Russian state media without removing its content. During Bulgaria’s 2026 campaign, EDMO monitors found sanctioned Russian broadcast content still circulating on Facebook and TikTok, and Telegram, which sits outside the strictest obligations of the Digital Services Act (DSA), hosted the densest pro-Kremlin ecosystem of the four spring elections EDMO examined.²⁸ Inside the EU, state media now serve less as broadcasters than as a library of content for other channels.

Information Manipulation Sets

Three information manipulation sets dominate the documented record. The first is Storm-1516. France’s agency against foreign digital interference, VIGINUM, analysed 77 of its operations between August 2023 and March 2025 and found that it seeds content through burner and paid accounts, launders it through foreign media and amplifies it through pro-Russian networks. VIGINUM established the involvement of John Mark Dougan, a former US police officer living in Russia, and described Yury Khoroshenky, publicly accused of financing and coordinating the set, as “a potential officer of the GRU Unit 29155”.²⁹ The EU sanctioned Dougan in December 2025. In 2026 the set’s infrastructure was also used against Armenia’s parliamentary election, a direct link between the two theatres compared in this paper.³⁰

The second set is Matryoshka, also tracked as Operation Overload, which specialises in short videos and forged reports imitating established media. Before Germany’s state and municipal elections of September 2026, the Institute for Strategic Dialogue identified 269 Matryoshka posts in 21 days and found the operation predictable and technically weak, with limited reach unless others amplified it; in August 2026 VIGINUM attributed to it forged media reports targeting candidates in the 2027 French presidential campaign.³¹ The third is the operation known as Doppelganger, or RRN, run by the Social Design Agency, which the EU sanctioned in July 2023; the EEAS still recorded RRN sites promoting AI-generated articles in 2025.³² Beneath all three runs the Pravda network, which in 2025 published on average some 10,000 articles a day across 101 websites and, at the end of 2024, added 26 subdomains for specific countries and regions, including the Basque Country.³³ Its value lies less in persuading readers than in keeping Kremlin narratives permanently available to search engines, AI systems and anyone looking for material to share.

The Supply Chain: Outsourcing and Commercial Services

These sets increasingly depend on services that Russia buys rather than builds, and the EEAS now proposes to deter FIMI by targeting the intermediaries and service providers on which operations depend.³⁴ VIGINUM found that Storm-1516 relies on paid accounts and on foreign media very likely paid to publish its stories, and peer-reviewed research shows the same reliance on commercial “digital mercenaries” and on providers that overlap with organised cybercrime.³⁵ The monitoring group Antibot4Navalny assessed in October 2026 that the network amplifying Storm-1516 content is most likely a commercial engagement-for-hire provider rather than a state-run asset.³⁶ Attribution therefore becomes harder, and disruption has to reach the commercial layer.

Political Proxies

The Voice of Europe case remains the clearest documented example of the first degree of involvement. On 27 March 2024 the Czech government, acting on information from its security service, sanctioned Viktor Medvedchuk and Artem Marchevskyi for running the Prague-registered outlet as a pro-Russian influence operation that financed cooperation with journalists and gave covert financial support to selected candidates in the European Parliament elections; the Council suspended its broadcasting in May 2024.³⁷ In a separate case, Nathan Gill, a former British Member of the European Parliament, was sentenced in November 2025 to ten years and six months’ imprisonment for accepting bribes to make pro-Russian statements.³⁸ Such cases are few, and they must not be confused with the much larger field of independent alignment. Both produce similar content; only evidence of payment, coordination or instruction distinguishes them, and such evidence usually emerges, if at all, through intelligence work or criminal proceedings years later. This is the practical core of the democratic legitimacy paradox.

AI-Enabled Content

Artificial intelligence has changed the cost of production more than the nature of the operations. The EEAS found AI-related techniques in 27 per cent of the incidents it recorded in 2025, up from 41 cases in 2024 to 147. Synthetic audio has become standard, and both Storm-1516 and Operation Overload have moved from generic voiceovers to cloned voices. The first study documented the same techniques against President Sandu in Moldova; inside the EU they are used at a larger scale.³⁹

V. The Operational Grammar Inside the EU

The first study set out a six-step operational grammar: narrative seeding, laundering through local validators, saturation, contradiction as method, emotional targeting and synchronisation with other instruments.⁴⁰ All six steps are visible inside the EU, but their weight and sequence differ (Table 4).

Table 4. The operational grammar in the two theatres

Source: author’s compilation, based on the first study and the sources cited in this section.

The most important difference concerns laundering. In the neighbourhood it follows injection through openly Russian channels; inside the EU, where state media are banned from broadcasting, the operation has to disguise its origin from the first moment. Storm-1516 publishes through burner accounts and very likely paid foreign media, and in 2025 many incidents recorded by the EEAS involved the impersonation of Western news outlets.⁴¹ Two further features stand out. Fabricated stories are anchored to genuine events: in Latvia, a false report that a Ukrainian soldier had killed three NATO servicemen was timed to a real military exercise. And stories travel selectively: EDMO found that claims about internationally known figures crossed borders quickly, while claims about domestic candidates mostly stayed at home.⁴² Linguistic fragmentation therefore protects the EU only partly.

Synchronisation also takes a different form. In the neighbourhood, FIMI prepared the ground for military action in Ukraine; inside the EU, it accompanies hybrid actions below the threshold of open aggression. When Russian drones violated Polish airspace on the night of 9 to 10 September 2025, Poland requested consultations under Article 4 of the North Atlantic Treaty and NATO launched Eastern Sentry two days later, while Prime Minister Tusk urged a “fact-based interpretation” of events whose meaning was quickly contested.⁴³

VI. Structural Vulnerabilities: What EU Membership Does and Does Not Protect Against

The first study traced the effectiveness of Russian FIMI in the neighbourhood to four structural vulnerabilities: linguistic dependence on Russian-language media, weak institutions and low public trust, unresolved conflicts, and the authority of national churches in identity politics.⁴⁴ EU membership changes this picture substantially, but not entirely.

What Membership Protects Against

Membership provides instruments that no country in the first study possesses. The EU can suspend Russian broadcasters across 27 states and sanction those involved in FIMI. Its platform regulation has begun to produce enforcement: in December 2025 the Commission adopted its first non-compliance decision under the DSA, fining X €120 million, among other reasons for obstructing researchers’ access to data. The European Democracy Shield, presented in November 2025, adds a European Centre for Democratic Resilience to pool detection and early-warning capacities.⁴⁵ Member States have attribution capacities of their own, and membership anchors independent courts, media and electoral administrations, which make state capture of the Georgian kind far harder, though not impossible.

What Membership Does Not Protect Against

Four gaps remain. The first lies in platform architecture: the EEAS recorded 88 per cent of FIMI instances in 2025 on X, Telegram remains outside the DSA’s strictest obligations, and most platforms restrict the data needed to measure manipulation; in Bulgaria, thresholds in Meta’s research tools excluded 291 election-related posts with more than 12 million views.⁴⁶ The second is fragmentation across 24 official languages and national information spaces, which requires monitoring capacity in each Member State. The third is the democratic legitimacy paradox itself. The fourth is economic grievance: energy prices and the cost of sanctions and of supporting Ukraine provide authentic material that domestic parties use for their own purposes and Russian operations amplify.⁴⁷

Table 5. Structural vulnerabilities in the two theatres

Source: author’s compilation, based on the first study and the sources cited in this section.

Government as Laundering Node: The Case of Hungary

The most serious vulnerability arises when the government itself performs the laundering function, as the first study showed for Georgia. Hungary between 2010 and 2026 is the clearest EU case. Over sixteen years the Orbán government consolidated control through nearly fifty constitutional amendments and changes to the electoral system, and repeatedly used its veto on EU decisions concerning sanctions and Ukraine.⁴⁸ Leaked recordings of telephone calls between Foreign Minister Szijjártó and Sergei Lavrov from 2023 to 2025, obtained and verified by a consortium of investigative outlets, show the Hungarian minister sharing information on EU deliberations with his Russian counterpart and coordinating efforts to remove individuals from EU sanctions lists; in one case, the sister of the oligarch Alisher Usmanov was delisted seven months after the request was discussed.⁴⁹ This is documented cooperation at government level. During the 2026 campaign, EDMO found domestic networks tied to Fidesz, AI-assisted propaganda and at least two distinct Russian-linked operations converging in a single campaign. Voters removed the government nonetheless.⁵⁰

VII. Regional Profiles

These instruments are used across the Union, but not evenly. The EEAS recorded 540 FIMI incidents worldwide in 2025. Among the Member States for which it publishes figures, France (107) and Germany (71) were targeted far more often than the rest; Poland, Belgium, Romania, Italy and Spain each recorded between 11 and 17 incidents. In the eastern neighbourhood, Ukraine (112) and Moldova (94) remained the main targets, and Armenia (18) was rising ahead of its 2026 election.⁵¹ The figures include incidents linked to China and many that could not be attributed, so they measure exposure rather than Russian activity alone, but they show that the volume of operations follows political weight and the electoral calendar more than geography (Figure 1).

Figure 1. FIMI incidents recorded by the EEAS in 2025, by targeted country (selection)

Source: European External Action Service, 4th EEAS Report on FIMI Threats, March 2026, “2025 FIMI in numbers”. Only countries for which the EEAS publishes a figure are shown; countries outside the two theatres are omitted, and Georgia is not among the countries listed. The figures include incidents attributed to Russia and China and unattributed incidents.

The Baltic States

In the Baltic States, the operations of 2026 concentrated on the security questions that shape voters’ choices rather than on candidates or voting procedures. The fabricated report of NATO deaths in Latvia was spread by dozens of accounts with a combined audience of more than 1.85 million before the vote, and a fake site imitating EUobserver linked Estonia’s outgoing President Alar Karis to the Epstein network. The aim was to erode trust in Ukraine, in NATO and in the countries’ own air defences. The region also lies where FIMI meets hybrid action: the EEAS recorded drone incursions, sabotage and attacks on critical infrastructure in Lithuania and Estonia, as in Poland and Romania, accompanied by FIMI designed to manage public perception.⁵²

Latvia’s election of 3 October 2026 shows how far the evidence goes and where it stops. Prime Minister Andris Kulbergs’s United List won 35.3 per cent and 41 of 100 seats. Latvia First came second with 13.1 per cent, and Sovereign Power/Union of New Latvians, which draws much of its support from Russian speakers, third with 11.7 per cent.⁵³ In the 502 channels monitored by the Centre for East European Policy Studies, Sovereign Power and Latvia First were among the few parties mentioned more positively than negatively, but the data showed no coordination between the parties’ accounts and the channels that amplified them. The Kremlin-aligned core of this space, about a dozen Telegram channels around Sputnik Latvija, did not back a single list: one channel urged a vote for Sovereign Power, while the most widely reposted item of election week attacked the leader of another pro-Russian list, For Stability!. The authors judged the involvement opportunistic rather than centrally directed, and the State Security Service found no systematic Russian attempt to influence the result. One question remains open: Sovereign Power’s leader, Jūlija Stepaņenko, had declared gifts of about €420,000 from her father, a construction entrepreneur in the Moscow region whose company reportedly made anti-tank obstacles for the Russian army; in September 2026 the Foreign Minister barred him from entering Latvia, and several security agencies were assessing the origin of the funds.⁵⁴ On this evidence, the case belongs to independent alignment, amplified opportunistically; the financial question does not, so far, establish cooperation.

Central and Eastern Europe

Central and Eastern Europe offers the widest range of cases. Romania provides the first case in the Union of a national election annulled on grounds that included foreign interference. On 6 December 2024 the Constitutional Court annulled the first round of the presidential election, won by Călin Georgescu, a candidate who had been polling at around 5 per cent, on the basis of declassified intelligence reports describing a campaign run through some 25,000 accounts with a coordination that suggested a state actor. The decision was contested: the Centre for Eastern Studies described its evidentiary basis as vague, and an investigation by Snoop.ro later reported that one TikTok campaign turned in Georgescu’s favour had been paid for by the governing National Liberal Party. Georgescu was barred from the rerun, which Nicușor Dan won in May 2025 with 53.6 per cent.⁵⁵ The case showed that institutions can act decisively against suspected interference, and it gave Russian operations a narrative they have used ever since.

Poland’s presidential election of 2025 was targeted by Doppelganger, Operation Overload and the Pravda network. According to an assessment by the FIMI-ISAC, Russia-aligned content attacked both leading candidates, presenting the contest as a “puppet theatre” controlled from abroad; the aim was to undermine the legitimacy of the outcome rather than to elect anyone. The research institute NASK reported 14,890 accounts, mostly on X, linked to coordinated inauthentic behaviour. Karol Nawrocki won the run-off with 50.89 per cent.⁵⁶ In the Czech Republic, before the elections of October 2025, analysts identified 286 interlinked TikTok accounts that spread pro-Russian content and supported several radical parties at once; Czech intelligence passed them to the regulator, TikTok removed dozens, and an intelligence source called the operation “an unsuccessful attempt”. Andrej Babiš’s ANO won 80 of 200 seats and formed a government with the SPD and the Motorists, with an agenda that moves the country away from its previous support for Ukraine.⁵⁷ The record does not show that these operations produced the result; the change in policy came through a democratic vote.

Bulgaria shows most clearly how Russian operations amplify domestic voices rather than create them. On 19 April 2026 former President Rumen Radev, a critic of EU sanctions against Russia and of military aid to Ukraine, won 44.6 per cent and an absolute majority with his new Progressive Bulgaria. When the caretaker government requested activation of the EU’s Rapid Response System for elections, Radev accused it of preparing to “steal” the election on the “Romanian model”. According to the DFRLab, his post was taken up within hours by domestic outlets, a Telegram channel associated with the UK-sanctioned Rybar project, InfoDefense and Pravda network sites, and a post by the French politician Florian Philippot reinforced the same narrative. The DFRLab concluded that domestic and external amplification “did not always require coordination to be mutually reinforcing”.⁵⁸

Western Europe

France and Germany are the most targeted Member States, and their authorities have gone furthest in public attribution. VIGINUM now counts 205 operations by Storm-1516 since August 2023 and describes the set as attributed to Unit 29155 of the GRU, supported by the Moscow-based Center for Geopolitical Expertise. During the municipal elections of March 2026, it characterised four foreign digital interferences, two conducted through known pro-Russian sets, including a Storm-1516 operation against the Paris mayoral candidate Pierre-Yves Bournazel, which reached only a limited audience. Most of the more than one hundred “.fr” domains registered through CopyCop to imitate local newspapers were suspended by the French registry after identity checks.⁵⁹ In Germany, CORRECTIV, NewsGuard and the Gnida Project identified 102 German-language domains prepared by Storm-1516 before the federal election of February 2025. On 12 December 2025, after a joint analysis by the BfV and the BND, the Federal Government stated that Russia had used Storm-1516 to try to influence the election and to destabilise Germany, named the Center for Geopolitical Expertise and the Double-Headed Eagle movement as the actors behind it, and summoned the Russian ambassador.⁶⁰

Belgium’s exposure is shaped by the presence of the EU institutions: in April 2024 the Belgian Prime Minister announced that the intelligence services had confirmed pro-Russian networks seeking to help elect pro-Russian candidates to the European Parliament, and the federal prosecutor opened an investigation. Italy’s distinctive feature is the use of overt state channels. In February 2025 the Russian Foreign Ministry’s spokeswoman called “blasphemous inventions” a speech in which President Sergio Mattarella compared Russia’s aggression against Ukraine with the project of the Third Reich; the attack produced cohesion rather than division, as Prime Minister Giorgia Meloni, the opposition leader Elly Schlein and parties across the spectrum declared their solidarity with the President.⁶¹ Spain’s National Security Report for 2025 describes the country as a secondary target of Russian hybrid activity; the Pravda network nonetheless opened a Basque subdomain, and the general election called for 29 November 2026 falls outside the period of this study.⁶²

The Nordic States and Norway

The Nordic States combine high resilience with low priority for Moscow, in the assessment of their own authorities. After Denmark’s general election of 24 March 2026, the intelligence and civil protection services reported that they had not uncovered influence activity by foreign intelligence services; profiles linked to Russian online milieus had spread distorted statements about Danish politicians with limited reach, and their posts gained views mainly after Danish media reported on them.⁶³ Before Sweden’s election of 13 September 2026, the authorities stated that Sweden was not a priority target; Matryoshka nevertheless published seven fabricated videos impersonating SVT, Dagens Nyheter, Euronews and Der Spiegel, much of whose apparent reach was inauthentic, and X removed them only after nearly a week. All parties in the Riksdag support Sweden’s backing for Ukraine, which leaves Moscow little to exploit.⁶⁴ Finland’s Security and Intelligence Service adds a caution: because events are readily attributed to Russia, Russian influence may appear more extensive than it is, and such interpretations increase Russian deterrence. Almost all drone sightings investigated in Finland were caused by other flight operations.⁶⁵

Table 6. Russian FIMI by regional cluster, January 2025 to October 2026

Source: author’s compilation, based on the sources cited in this paper.

Norway, a NATO member outside the EU, offers a point of comparison. What researchers described as the first known Storm-1516 operation against it, in June 2025, used a fake environmental organisation to claim that heavy-water pollution had caused mass deaths of wildlife in the Nitelva river near Oslo and might force the cancellation of the UN Internet Governance Forum, which Norway hosted that month after Russia had sought the role. A specialist at the Norwegian Defence Research Establishment said the operation fitted Storm-1516’s methods but that its authorship could not be established with certainty.⁶⁶ The sets examined here operate across the Union’s external border regardless of membership; what membership changes is the response, not the exposure.

VIII. Comparative Analysis: The EU and the Eastern Neighbourhood

Shared Architecture

The same information manipulation sets operate in both theatres. Storm-1516, which targeted the German federal election in 2025 and the French municipal elections in 2026, was also active against Moldova and then Armenia, where its activity began in April 2025, more than a year before the June 2026 election. Operation Overload worked in parallel in both theatres, and the Pravda network serves all of them. The High Representative put it directly: the playbook deployed in Moldova in 2025 was being redeployed in Armenia in 2026, and elections in Member States could face similar patterns.⁶⁷ Russia does not keep separate toolkits for members and non-members. It keeps one toolkit and adjusts the mix to the environment.

Divergent Laundering Models

The theatres diverge in the route by which a narrative enters the domestic debate. In the neighbourhood, narratives arrive through Russian media that still have large audiences, through oligarchic networks able to buy votes as well as attention, and, in Georgia, through a governing party that repeats Kremlin narratives. In Moldova in 2025, international observers reported that the authorities and investigative journalists had credibly identified an organised network, funded from Russia and linked to Ilan Shor, which coordinated vote buying alongside disinformation.⁶⁸ Inside the EU none of these routes is fully open: state media are banned from broadcasting, vote buying on that scale would face criminal investigation, and among Member State governments only Hungary’s is documented as having cooperated with Moscow. Russian operations therefore depend on domestic voices that already say what Moscow wants said, as in Bulgaria, where the narrative began with a domestic candidate and a French politician and Russian networks amplified it. The flow runs from domestic politics outwards and back again, rather than from Moscow inwards.

Georgia and Hungary: Two Governments, Two Outcomes

Georgia since 2012 and Hungary between 2010 and 2026 offer the most instructive comparison. Both governments repeated narratives convenient to Moscow, both weakened checks on their own power, and V-Dem classified both as electoral autocracies on its 2025 data. Georgia’s elections of October 2024, which official results gave to Georgian Dream with almost 54 per cent, were marred, according to international observers, by an uneven playing field, widespread pressure on voters and frequent breaches of ballot secrecy; a month later the government suspended EU accession talks until 2028.⁶⁹ In Hungary, the government lost the election of 12 April 2026 to Péter Magyar’s Tisza, which won 53.2 per cent of the list vote and 141 of 199 seats, and Orbán conceded quickly.⁷⁰

Four factors may account for the difference: electoral integrity, since Hungary’s process, whatever its imbalances, still allowed a large shift in votes to change the government; media pluralism, constrained in both countries; opposition unity, since the Hungarian opposition vote concentrated largely on a single party, whereas Georgian voters in 2024 were offered 18 candidate lists; and external leverage, since membership exposed Hungary to the Union’s legal instruments, including the suspension of €6.3 billion in budget commitments under the rule-of-law conditionality mechanism in December 2022, while the EU’s leverage over Georgia depended on an accession process that the government could simply suspend.⁷¹ Two cases cannot establish the relative weight of these factors, which remains an open question. The comparison does show that the rule of law that protects a government aligned with Moscow also preserves the means of removing it.

The 2024–2026 Election Cycle

Table 7 summarises the electoral cycle in both theatres. Russian operations accompanied almost every election, but their documented scale varied with Moscow’s priorities and the target’s resilience. Outcomes did not follow the intensity of operations: the most heavily targeted electorates in the neighbourhood, Moldova in 2025 and Armenia in 2026, returned pro-European majorities, and the Hungarian government that had cooperated with Moscow lost power. Where governments more sceptical of support for Ukraine came to power, in the Czech Republic and Bulgaria, they did so with their own electoral strength and on agendas in which domestic issues featured prominently. Some of the heaviest Russian pressure was not online at all: in Armenia, observers recorded trade restrictions and security threats by Russian officials aimed at influencing voters.⁷²

Table 7. Selected elections, October 2024 to October 2026

Source: author’s compilation from official results and the sources cited in this paper. Eastern neighbourhood and EU elections are listed together in chronological order.

Capacity to Respond

The sharpest asymmetry lies in the capacity to respond. Inside the EU, the state is normally the defender: France and Germany attribute operations publicly, Czech and Danish authorities publish their findings, and the Council extended its regime against Russia’s hybrid activities until October 2027. In the neighbourhood, capacity depends on the government’s orientation. Moldova shows what a determined state with EU support can achieve: law-enforcement action against the vote-buying network in 2025 led to 844 searches and 122 detentions, and observers judged that it had a mitigating and deterrent effect. In Georgia the state itself performs the laundering function, and legislation presented as protection against foreign influence has drawn international concern for stigmatising civil society organisations and independent media.⁷³ Hungary stood between the two. The variable that matters most is not membership as such but whether the state’s institutions are on the side of defence. Table 8 summarises the comparison.

Table 8. Russian FIMI in the eastern neighbourhood and in EU Member States: summary comparison

Source: author’s compilation, based on the first study and the sources cited in this paper.

IX. Why Russian FIMI Works Inside the EU, and Where It Fails

Documenting an operation is easier than demonstrating its effect. The most rigorous study of exposure to a Russian campaign, which linked survey data to the Twitter feeds of American users in 2016, found exposure heavily concentrated, with 1 per cent of users accounting for 70 per cent of exposures, and no meaningful relationship between exposure and changes in attitudes, polarisation or voting. European survey research finds that neutral and pro-Kremlin attitudes towards the war are linked most strongly to the positions of the parties respondents support, followed by disinformation and ideology. Party cues matter more than foreign content. Yet belief in disinformation can still move votes at the margin: a panel study of the 2017 German election found that it drew voters from the main governing party towards the AfD, and that the less people trusted media and politics, the more they believed it. Experiments with pro-Russian astroturfing comments show that they can alter opinions even among people warned in advance.⁷⁴

Figure 2. Resilience to disinformation: Media Literacy Index 2026, selected countries

Source: Open Society Institute – Sofia, Media Literacy Index 2026, January 2026. Scores range from 0 to 100; higher scores indicate greater resilience. Armenia is not covered by the index.

Susceptibility also varies between societies. The Central European Digital Media Observatory found Polish society largely immune to Russian narratives about the war, Slovak society relatively receptive and Czech society in between. The Media Literacy Index, which combines press freedom, education, interpersonal trust and e-participation, shows a similar gradient (Figure 2): the Nordic and Baltic Member States lead, Bulgaria ranks last in the EU, and Moldova and Georgia rank 35th and 38th of 41 countries.⁷⁵ The index measures resilience, not exposure or effect, but its pattern is consistent with the limited reach reported by the Nordic authorities.

On this evidence, Russian FIMI gains traction inside the EU under four conditions: when it attaches itself to existing domestic voices and grievances, as in Bulgaria; when trust in media and institutions is low; when the state itself becomes a channel, as in Hungary until 2026; and when it exhausts the capacity of newsrooms to verify, which is what operations such as Matryoshka attempt by sending fabricated content to journalists disguised as requests for verification.⁷⁶ It fails where fabricated content has no domestic carriers: the EEAS found the AI-generated videos of Storm-1516 and Operation Overload easily identifiable and of limited engagement, and the operation against the Paris candidate Bournazel drew fewer than 20,000 views, against some 100,000 for a typical Storm-1516 operation. It fails where overt pressure provokes cohesion, as in Italy, and where institutions hold: in Romania the courts annulled the round that operations were alleged to have distorted, and Hungarian voters removed the government that had cooperated with Moscow.⁷⁷ Table 9 summarises these conditions in both theatres.

Table 9. Conditions under which Russian FIMI gains or loses traction

Source: author’s compilation, based on the first study and the sources cited in this paper.

Over-Attribution: The Yandex Episode

Over-attribution is the mirror image of under-detection, and it has its own costs. Between 7 and 11 October 2026, Ukrainian drones struck three Yandex data centres in Sasovo, Kaluga and Vladimir; Yandex confirmed that two had been shut down and part of the third put out of service. Within a day of the third strike, posts on X claimed that Russian-run accounts had fallen silent in communities around the AfD, the MAGA movement and Reform UK, and President Zelenskyy said there was “less hate, less division and fewer provocations” online because of “fewer bots”.⁷⁸ The claim rested on a chart from Cloudflare Radar showing a collapse in automated traffic from Yandex’s network, traffic consisting mainly of Yandex’s own search crawler rather than social media accounts. Graphika found no notable decline in the communities named, and researchers at dTeam told BBC Verify that accounts linked to Storm-1516 and Matryoshka were still active; Zelenskyy’s office later said he had been referring to the “atmosphere” on social media.⁷⁹ The available evidence cannot establish whether the strikes affected Russian operations. It does show how a real event and an authentic chart became evidence for a claim the chart could not support. Attributing domestic Euroscepticism to foreign bots is comforting, because it implies that removing the bots removes the problem; the research reviewed here suggests otherwise.

X. Evidentiary Uncertainty

The findings rest on evidence of uneven quality, and four limits should be stated plainly. First, confidence in attribution varies. Some attributions rest on formal government procedures, such as the German national attribution of Storm-1516 or VIGINUM’s reports, which state their level of confidence; others on researchers and journalists without access to intelligence; and the EEAS itself left 65 per cent of the incidents it recorded in 2025 unattributed.⁸⁰ This paper reports each attribution at the confidence level used by the attributing body and does not rely on a single unnamed source for any classification.

Second, effect is far harder to measure than activity. Different bot-detection methods applied to the same political discourse produce widely divergent estimates, platforms restrict researchers’ access to data, and measured reach is itself inflated by inauthentic amplification.⁸¹ Figures for views and audiences therefore indicate potential exposure, not persuasion. Third, characterisations of governments and parties are contested and may change: the Romanian annulment was criticised as resting on vague evidence, and the financial ties of a Latvian party leader to Russia are still under assessment. Every classification in this paper is provisional. Fourth, much of the evidence for 2025 and 2026 comes from official reports, research organisations and journalism rather than peer-reviewed research, which lags events by several years. These limits define the form of the central argument: the weight of current evidence suggests that Russian FIMI inside the EU primarily amplifies; it does not prove that it never creates.

XI. Policy Implications

If Russian FIMI inside the EU primarily amplifies, the priority is not to suppress domestic opinion, which would be both wrong and self-defeating, but to raise the cost of amplification, protect the institutions that detect it and keep the threat in proportion. The European Democracy Shield, presented on 12 November 2025, provides the framework. Its centrepiece, the European Centre for Democratic Resilience, began work on 24 February 2026 with all Member States participating, and on 13 October 2026 ministers endorsed the association of Albania, Bosnia and Herzegovina, Moldova, Montenegro, North Macedonia, Serbia, Ukraine and Kosovo.⁸² Seven implications follow (Table 10).

Target the supply chain. Deterrence should reach the commercial layer on which operations depend, as the EEAS now proposes. The French registry’s suspension of most CopyCop domains after identity checks shows what can be achieved at modest cost; the NIS2 Directive already requires registries and registrars to verify registration data, and consistent application would make pre-positioned networks costlier to build. The EU’s regime against Russia’s destabilising activities should also be used against commercial providers of engagement that knowingly serve Russian operations.⁸³

Protect counter-FIMI capacity. The institutions that detect and attribute operations need protection from political pressure, including pressure from their own governments; Hungary showed how long a government can cooperate with Moscow while remaining in office. In September 2026 the European Parliament called for the European Centre for Democratic Resilience to receive a legal mandate and a dedicated budget, which would allow it to maintain situational awareness where national capacity has been weakened.⁸⁴

Attribute with stated confidence. Public attribution should state its confidence and its limits and keep the three degrees of involvement apart. The German attribution procedure, VIGINUM’s reports and the post-election assessments of the Danish and Latvian authorities offer models: they name operations when the evidence allows, say when it does not, and do not treat parties or voters as agents of Moscow. The EU Blueprint for countering FIMI proposed in the Democracy Shield could set common standards.⁸⁵

Secure data access and enforcement. The DSA rules on access to platform data for vetted researchers have applied since 29 October 2025, and the Commission’s first DSA non-compliance decision, against X, concerned among other things the obstruction of researchers. The DSA incidents and crisis protocol foreseen in the Democracy Shield should be in place before the French presidential election of 2027, which Russian operations have already begun to target. Telegram remains the largest regulatory gap.⁸⁶

Support verification without exhausting it. The European Network of Fact-Checkers proposed in the Democracy Shield, with its shared repository, could serve as a clearing house, so that a fabricated story sent to dozens of newsrooms is verified once and the result shared with all.⁸⁷

Keep the threat in proportion. Over-attribution inflates Russia’s reach and distracts from the domestic sources of the grievances it amplifies. The more durable protection lies in education, media freedom and trust, the components of the Media Literacy Index. These fall largely within national competence, but the Democracy Shield’s media resilience programme and its support for citizenship and digital skills in schools point in the right direction.⁸⁸

Extend the instruments to the neighbourhood. Moldova shows what determined institutions with EU support can achieve, and its association with the Centre is a step forward. Georgia and Armenia are not among the partners endorsed in October 2026.⁸⁹ Armenia, which is not a candidate country, would require a different format of cooperation. In Georgia, where the state itself performs the laundering function, support should go to independent media, civil society and researchers rather than to state institutions.

Table 10. Findings, policy implications and relevant EU instruments

Source: author’s compilation, based on the findings of this paper and the instruments cited in this section.

XII. Conclusion

EU membership changes the form of Russian FIMI more than the fact of it. The same information manipulation sets operate on both sides of the Union’s eastern border, with the same operational grammar. What membership changes is the environment the operations meet: laundering must be disguised from the outset, vote buying on the Moldovan scale would face criminal investigation, and the state is normally on the side of defence.

The democratic legitimacy paradox runs through the findings. Elected actors who repeat narratives convenient to Moscow are protected by the norms that membership upholds, and in Hungary a government that cooperated with Moscow remained in office for sixteen years. The same norms preserved the means of removing it, which is the decisive difference from Georgia. The electoral cycle of 2024 to 2026 shows the limits of FIMI’s effect: outcomes did not follow the intensity of operations, and where governments more sceptical of support for Ukraine came to power, they did so on their own electoral strength. The weight of current evidence therefore supports the central argument: inside the EU, Russian influence operations primarily amplify existing domestic political alignments rather than manufacture them.

That is no reason for complacency. Amplification matters where trust is low, and the operations examined here are cheap, persistent and increasingly outsourced. Finland’s security service expects Russian intelligence and influence resources now tied to the war in Ukraine to become available elsewhere once it ends.⁹⁰ The French presidential election of 2027 and the period after any ceasefire will test the instruments now being built. The task is to raise the cost of amplification, protect the institutions that expose it and invest in the trust that limits its effect, without mistaking Europe’s own political disagreements for the work of a foreign adversary.

---