Russian Playbook: Foreign Infor­mation Manipu­lation and Inter­fe­rence (FIMI) in Ukraine

Part I. Country context and strategic relevance: Ukraine

Ukraine represents the most advanced contem­porary case of Russian foreign infor­mation manipu­lation and inter­fe­rence (FIMI) in terms of scale, duration and integration with military opera­tions. Since Russia’s illegal annexation of Crimea in 2014, and parti­cu­larly following the launch of the full-scale invasion in February 2022, the Kremlin has subjected Ukraine to syste­matic and adaptive infor­mation opera­tions that are closely integrated with kinetic warfare, cyber activities, occupation gover­nance and coercive state­craft.[1] Thus, Ukraine is experi­encing Russian FIMI under the condi­tions of an ongoing military assault, allowing the inter­action between infor­mation opera­tions and kinetic warfare to be observed in real time. It also provides a rare example of how whole-of-society resilience develops under sustained pressure.

Ukraine occupies a central place in the Kremlin’s imperial worldview. Preventing the conso­li­dation of a sovereign, democratic and Euro-Atlantic-oriented Ukraine has become one of Russia’s main strategic priorities. Following the full-scale invasion on 24 February 2022, diplo­matic relations between the two countries were severed, and inter­action has since been limited to commu­ni­cation relating to wartime arran­ge­ments, including prisoner exchanges, third-party mediation and technical negotia­tions. Within this context, Russian infor­mation opera­tions seek to exploit several overlapping societal vulnerabi­lities and strategic depen­dencies in Ukraine. These include fragmented trust in political insti­tution, war fatigue and mobili­sation-related anxiety, depen­dence on digital platforms (parti­cu­larly Telegram) as primary sources of breaking news and security updates, and Ukraine’s continued reliance on sustained inter­na­tional political, military and financial support.[2] Rather than creating these vulnerabi­lities, Russian FIMI seeks to amplify existing societal tensions, deepen uncer­tainty and erode public resilience over time, as it does in other countries targeted by the Kremlin.

Russian infor­mation opera­tions also syste­ma­ti­cally weaponise history, identity and socio-economic grievances to both legitimise the war and undermine Ukrainian sovereignty.[3] Histo­rical narra­tives portray Kyivan Rus and figures such as Volodymyr the Great as part of an exclu­sively Russian histo­rical tradition, while cities such as Odesa are presented as inher­ently “Russian”. Russia likewise exploits the memory of the World War II by portraying the Ukrainian government as “Nazi” and framing the invasion as a process of “denazi­fi­cation” and histo­rical justice. In the tempo­r­arily occupied terri­tories, these histo­rical narra­tives are reinforced through socio-economic messaging portraying Russia as the guarantor of security, recon­s­truction and public services while depicting Ukraine as incapable of governing its own territory and providing for its own people.[4] Russian FIMI is therefore insepa­rable from the broader campaign against Ukrainian statehood. At the same time, cyber opera­tions reinforce these efforts by enabling espionage, infor­mation theft and the manipu­lation of digital infor­mation that can subse­quently be incor­po­rated into broader influence campaigns across Ukraine.

Part II. The Russian FIMI playbook in Ukraine

a) Strategic objectives

Within the broader military and political strategy, Russian FIMI pursues a defined set of objec­tives and is designed to shape the psycho­lo­gical, political, and strategic condi­tions of the war. In Ukraine, Russian infor­mation opera­tions seek to undermine trust in political and military leadership, weaken confi­dence in public insti­tu­tions, reduce support for mobili­sation, increase percep­tions of inevi­table defeat, and erode societal resilience.[5] These messages interact with the wider experience of war, including repeated attacks on residential areas and critical infra­structure, which intensify fear, exhaustion and percep­tions of insecurity amongst the affected population.

b) Target audiences

Russian FIMI campaigns are highly audience-specific. Ukrainian monitoring organi­sa­tions identify residents of government-controlled terri­tories, residents of tempo­r­arily occupied terri­tories, frontline commu­nities, military personnel and their families, internally displaced persons, and younger social media users as distinct target audiences.[6]^,[7] Messaging, emotional framing and disse­mi­nation channels are tailored to each group, allowing Russian actors to exploit different vulnerabi­lities while pursuing common strategic objec­tives. This level of audience segmen­tation reflects an adaptive influence strategy that responds to the realities of wartime rather than relying on uniform mass messaging.

c) Dominant narratives

Russian narra­tives reinforce one another and support broader strategic objec­tives. Central messages portray Ukraine as an artificial state lacking genuine sovereignty and histo­ri­cally belonging within Russia’s sphere of influence.[8] Here, the Ukrainian government is depicted as corrupt, extremist and “Nazi”, while the invasion is framed as a legitimate process of “denazi­fi­cation” and histo­rical justice. Additional narra­tives target both Ukrainian and inter­na­tional audiences with claims that Ukraine is losing the war, mobili­sation is unjust or pointless, Western assis­tance is ineffective or misap­pro­priated, and Kyiv is obstructing peace. The Kremlin’s campaigns have also incre­asingly targeted Ukraine’s European integration by portraying EU and NATO membership as unattainable or respon­sible for prolonging the war, while simul­ta­neously exploiting bilateral tensions between Ukraine and individual European partners.[9] Currently, this includes disputes with Poland over histo­rical memory, agricul­tural trade and political support.

d) Tactics, techniques and proce­dures (TTPs)

Russian FIMI campaigns rely on a broad spectrum of opera­tional techniques designed to give false or misleading content the appearance of authen­ticity, indepen­dence and widespread public support.[10] These include coordi­nated ampli­fi­cation through bot networks and fake accounts; imper­so­nation of Ukrainian insti­tu­tions, public officials and media outlets; the disse­mi­nation of forged documents and fabri­cated screen­shots; and the manipu­lation of authentic material through selective editing or removal from its original context. Kremlin-aligned narra­tives are frequently laundered through anonymous Telegram channels, pseudo-local news outlets and osten­sibly independent commen­tators before being amplified across multiple platforms. Campaigns are also synchro­nised with military develo­p­ments, mobili­sation decisions, diplo­matic disputes and attacks on civilian infra­structure, allowing Russian actors to exploit moments of heigh­tened uncer­tainty and emotional vulnerability. Cyber-enabled activities, including hacking, data theft and infor­mation leaks, can provide additional material for subse­quent influence opera­tions. In the tempo­r­arily occupied terri­tories, these techniques are reinforced through syste­matic censorship of Ukrainian infor­mation sources and the monopo­li­sation of local media, creating a controlled infor­mation environment in which independent reporting and alter­native inter­pre­ta­tions of events are incre­asingly difficult to access.

e) Actors

Russian FIMI campaigns are imple­mented through a layered ecosystem that combines state insti­tu­tions, state-controlled media, occupation autho­rities and proxy actors.[11] At the strategic level, the Presi­dential Adminis­tration, the Ministry of Foreign Affairs, the Ministry of Defence and the Russian intel­li­gence services play central roles in setting, producing and disse­mi­nating strategic messaging. Russian state-controlled media remain central disse­mi­nators of narra­tives despite the reduction of the extent of their direct reach within Ukraine due to restric­tions intro­duced in the years following 2014. Disse­mi­nation is further enabled through local colla­bo­rators, occupation media, anonymous Telegram adminis­trators, pseudo-local news outlets and coordi­nated inauthentic social media networks that adapt and amplify pro-Kremlin messaging while obscuring direct state invol­vement.[12] This decen­tra­lized, multi-channel disse­mi­nation model increases the perceived credi­bility of Russian influence campaigns and compli­cates attribution.

f) Infor­mation channels

Russian influence opera­tions rely on a diverse media ecosystem tailored to the Ukrainian infor­mation environment. Telegram has become the principal platform for influence opera­tions due to its widespread use in Ukraine, the promi­nence of anonymous channels and compa­ra­tively limited content moderation.[13] Moreover, Telegram often functions as the entry point for narra­tives that are subse­quently amplified through short-form videos, pseudo-news content and coordi­nated social media accounts on other platforms. Telegram’s role is especially important during periods of acute uncer­tainty, when users seek immediate infor­mation about attacks, mobili­sation or frontline develo­p­ments. Russian actors also exploit TikTok, YouTube, Facebook, and Instagram to reach different demographic groups. In addition, television, radio, and pseudo-local news outlets in the tempo­r­arily occupied terri­tories have been brought under Russian control and integrated into occupation gover­nance.[14]

Part III. Ukrainian resilience and remaining challenges

Ukraine’s response to Russian FIMI has evolved into a compre­hensive whole-of-society effort involving government insti­tu­tions, civil society organi­sa­tions, independent media, resear­chers and inter­na­tional partners.[15] Respon­si­bility for monitoring, analysing and responding to infor­mation manipu­lation is distri­buted across a broad ecosystem of actors with comple­mentary roles. Government insti­tu­tions, including the Centre for Countering Disin­for­mation, work alongside specia­lised civil society organi­sa­tions such as CAT-UA, Internews Ukraine and the Institute of Mass Infor­mation (IMI). Independent analy­tical and media organi­sa­tions, including Detector Media, Vox Ukraine, Texty.org.ua and StopFake, complement these efforts by monitoring emerging narra­tives, exposing influence opera­tions, fact checking and seeking to strengthen public resilience. Together, these actors have created a distri­buted resilience ecosystem that combines insti­tu­tional capacity with independent expertise and conti­nuous societal engagement.

This insti­tu­tional ecosystem has also been evolving in response to the changing character of the war. During Mykhailo Fedorov’s tenure as Minister of Defence (January-July 2026), the ministry signi­fi­cantly increased the emphasis on military innovation and cognitive warfare, reflecting an even greater effort to integrate infor­mation effects more syste­ma­ti­cally into defence planning. Although some of the reforms are insti­tu­tio­nally fragile due to Fedorov’s dismissal in July 2026, they illus­trate how rapidly Ukraine’s under­standing of the infor­mation domain is developing under wartime conditions.

At the same time, resilience remains uneven and should not be understood as immunity. Russia continues to adapt its tactics, narra­tives and disse­mi­nation methods in response to Ukrainian counter­me­a­sures. Long-term war fatigue, mobili­sation-related anxiety, longstanding distrust in insti­tu­tions and the continued dominance of Telegram as one of the key digital sources of infor­mation create oppor­tu­nities for influence opera­tions that exploit existing societal tensions.[16] Residents of tempo­r­arily occupied terri­tories remain parti­cu­larly vulnerable because their access to independent Ukrainian infor­mation is severely restricted and Russian-controlled media environ­ments dominate everyday infor­mation consumption.[17]

Ukraine’s experience nevert­heless demons­trates that effective responses to FIMI must extend well beyond debunking false infor­mation or removing online content. They require sustained and persistent investment in trusted public insti­tu­tions, independent journalism, strategic commu­ni­ca­tions, media literacy campaigns, civil society partner­ships and conti­nuous adapt­ation to an evolving threat environment. The Ukrainian example  also illus­trates that resilience is not a fixed outcome but an ongoing process that must evolve quickly and efficiently.

Part IV. Impli­ca­tions for Germany and the European Union

As discussed throughout this paper, the Ukrainian case demons­trates that Russian foreign infor­mation manipu­lation and inter­fe­rence (FIMI) cannot be understood as an isolated disin­for­mation problem. During the full-scale invasion, infor­mation opera­tions have functioned alongside military action, cyber opera­tions, diplo­matic pressure and occupation gover­nance as part of a broader strategy to weaken Ukraine’s capacity and willingness to resist. This has important impli­ca­tions for Germany and the European Union. It means that countering FIMI is not solely a question of content moderation or strategic commu­ni­ca­tions, but of streng­thening democratic resilience as an integral component of European security policy through whole-of-society approaches.

The European Union has made signi­ficant progress in developing a more coordi­nated response to FIMI. The European External Action Service (EEAS) FIMI framework, sanctions against Russian state-controlled media, the Digital Services Act, support for independent journalism, and increased coope­ration with Ukrainian insti­tu­tions have all streng­thened Europe’s capacity to identify, expose and respond to foreign infor­mation manipulation.

The Ukrainian experience nevert­heless highlights several limita­tions of current European approaches. Much of the existing policy framework remains reactive, focusing on identi­fying and responding to individual campaigns after they emerge. Ukraine demons­trates that Russian influence opera­tions are adaptive, long-term and integrated with broader military, political and diplo­matic objec­tives. Addressing such campaigns therefore requires responses that  include stronger insti­tu­tional resilience, sustained public trust, independent media and platform ecosystems, and closer integration between strategic commu­ni­ca­tions, cyber security, intel­li­gence and civil society.

A second lesson concerns the value of Ukrainian expertise. Over more than a decade of confronting Russian infor­mation opera­tions, and more than four years of full-scale war, Ukraine has developed practical knowledge that extends far beyond individual tools or techno­logies. Expertise has accumu­lated across government insti­tu­tions, civil society organi­sa­tions, independent media, resear­chers and technology specia­lists, creating a uniquely mature under­standing of how Russian influence opera­tions evolve over time and in parallel with military action. European coope­ration should therefore incre­asingly move beyond tradi­tional donor-recipient relati­onships towards even more syste­matic knowledge exchange and insti­tu­tional partner­ships, in which Ukrainian practi­tioners contribute directly to policy develo­pment, profes­sional training, capability develo­pment and early-warning mecha­nisms. Moreover, partners still need faster infor­mation-sharing, stronger joint early-warning systems and more syste­matic cross-countries coordi­nation.[18]

Finally, the Ukrainian experience suggests that democratic states should move beyond a predo­mi­nantly reactive approach to countering FIMI. This does not imply mirroring autho­ri­tarian infor­mation manipu­lation or engaging in disin­for­mation. Instead, it includes timely strategic commu­ni­cation, coordi­nated public attri­bution of hostile activities, the release of credible intel­li­gence where appro­priate, pre-bunking and inocu­lation efforts, and the integration of infor­mation activities into broader political and security strategies. This evolution mirrors broader develo­p­ments in Ukrainian cyber strategy, where resilience has incre­asingly been comple­mented by deter­rence and carefully governed offensive capabi­lities.[19] Similar lessons can be drawn for the infor­mation domain.

Democratic approaches to FIMI should therefore evolve from those aimed solely at protecting the infor­mation environment towards approaches that proac­tively shape condi­tions such that hostile influence opera­tions become less effective and adver­sarial narra­tives gain traction. In doing so, democratic states should seek not only to strengthen resilience against hostile influence, but also to shape the infor­mation environment in ways that reinforce democratic security and increase the costs of autho­ri­tarian infor­mation operations.

[1] FIMI as part of Russian war machine: Ukraine’s fight – Ukrainian Prism

[2] Ukrainian Resis­tance to Russian Disin­for­mation: Lessons for Future Conflict | RAND

[3] Analy­tical Report: Histo­rical Context of Russian Propa­ganda – PR Army

[4] Examining Disin­for­mation: Perspec­tives on Residents from Occupied and Freed Terri­tories on Social Media: Detector Media

[5] FIMI as part of Russian war machine: Ukraine’s fight – Ukrainian Prism

[6] Media Audience Segments in Ukraine: Research Results /​ LMF

[7] Examining Disin­for­mation: Perspec­tives on Residents from Occupied and Freed Terri­tories on Social Media: Detector Media

[8] «Як російський інформаційний корабель пішов на… Наративи пропаганди під час повномасштабної війни»

[9] Results of pro-Russian infor­mation manipu­lation and disin­for­mation monitoring targeting Ukraine-EU relations during June – August, 2025 | EEAS

[10] Strategic Narra­tives and Infor­mation Warfare: Russian FIMI Campaigns against Ukraine’s Armed Forces in the Context of War and Societal Impact – dif.org.ua

[11] The Archi­tecture of Russia’s FIMI Opera­tions – EUvsDisinfo

[12] StratCom | NATO Strategic Commu­ni­ca­tions Centre of Excel­lence Riga, Latvia

[13] Over One-Third of Ukrai­nians Turn to News Exclu­sively from Social Media | Internews Ukraine

[14] Examining Disin­for­mation: Perspec­tives on Residents from Occupied and Freed Terri­tories on Social Media: Detector Media

[15] Ukrainian Resis­tance to Russian Disin­for­mation: Lessons for Future Conflict | RAND

[16] FIMI as Part of Russian War Machine: Ukraine’s fight – Ukrainian Prism

[17] Hybrid CoE Research Report 11. How Ukraine fights Russian disin­for­mation: Beehive vs mammoth

[18] Time to Take a Step Forward from Analysis to a Collective Response – EUvsDisinfo

[19] Offense Is the Best Defense | Orange Cyber­de­fense CERT Threat Research

Hat Ihnen unser Beitrag gefallen? Dann spenden Sie doch einfach und bequem über unser Spendentool. Sie unter­stützen damit die publi­zis­tische Arbeit von LibMod.

Spenden mit Bankeinzug