# FIMI & Cognitive Warfare Monitor — Issue 16 **27 May 2026** | Published 2026-05-27T09:00:00Z Publisher: Asymmetric Intelligence — License: CC BY 4.0 Schema version: 2.0 --- ## Lead Signal **Russian multi-platform influence operations continue targeting Moldova, Ukraine, and Western audiences with confirmed Tier 1 attribution** Confidence: N/A Actor: RU Source: https://transparency.meta.com/reports/integrity-reports-h1-2026/ ## Key Judgments 1. **Russian multi-platform influence operations persist with Confirmed attribution despite repeated platform takedowns, demonstrating doctrine-layer commitment to infrastructure resilience and multi-platform migration.** - Confidence: High - Trajectory: Stable 2. **Iranian FIMI doctrine is evolving toward English-language Western audience targeting, representing a strategic shift from traditional Farsi and regional targeting. The Q4 2025 disruption of an English-language operation before audience-building phase suggests improved platform detection but also reveals Iranian intent to expand operational scope.** - Confidence: High - Trajectory: Worsening 3. **The four-month disclosure lag between operational activity and public attribution creates a structural vulnerability in the FIMI monitoring ecosystem. Platforms possess real-time detection and disruption capabilities but publish attribution on quarterly or semiannual cycles. This asymmetry benefits actors and disadvantages defenders.** - Confidence: High - Trajectory: Worsening 4. **US, Israeli, and Gulf state FIMI operations are systematically underweighted in Tier 1 platform disclosures and EEAS institutional coverage. This is not evidence of absence but evidence of institutional perimeter design and commercial procurement models that obscure attribution. The structural result is a global FIMI threat picture that systematically overweights Russian and Chinese operations.** - Confidence: High - Trajectory: Stable ## Weekly Brief ## Lead Signal Meta H1 2026 Adversarial Threat Report confirms that Russia, Iran, and China remain the three leading sources of foreign influence operations globally, with increasing sophistication observed across all three actors. The report, published on 2026-03-11, is the most recent Tier 1 anchor for actor ranking and aligns with the six actor framework used by this monitor. Russian operations are described as maintaining the highest operational tempo across multi platform infrastructure that targets Moldova, Ukraine, and wider Western audiences. Iranian operations are assessed as undergoing a tactical evolution toward English language Western targeting, while Chinese operations continue to rely on high volume spam channel infrastructure. No new Tier 1 platform disruptions were disclosed in the week ending 2026-05-21, so this lead signal rests on structural analysis of existing reporting rather than fresh takedown announcements. The absence of new Tier 1 disclosures in the current week reflects structural reporting cadence gaps rather than operational quiet. Meta shifted to semiannual adversarial threat reporting in 2026, Google Threat Analysis Group operates on quarterly bulletins, and Microsoft MSTIC has not published a new influence operations report since March 2026. As a result, operations disrupted in April 2026 may not appear in public transparency outputs until June or later. This cadence driven blackout interacts with Russian multi platform persistence doctrine, in which networks adapt to enforcement by migrating to Telegram, TikTok, and other less moderated surfaces. It also shapes how Iranian and Chinese evolutions are perceived, because public attribution and campaign level detail lag behind platform internal detection by several months. ## Other Developments **Russian multi platform persistence and migration to Telegram and TikTok** remains the clearest structural signal in the current landscape. Stanford Internet Observatory analysis documents that accounts linked to Russian networks disrupted by Meta have reappeared on Telegram and TikTok. This confirms an operational doctrine in which single platform takedowns are treated as a cost of doing business rather than a deterrent. Russian campaigns, including IRA linked channels, Portal Kombat domains, and Doppelganger recidivist infrastructure, demonstrate twelve week narrative persistence across YouTube, Telegram, Blogger, and Google News surfaces. The migration toward Telegram is particularly significant because the platform has no coordinated inauthentic behaviour disclosure programme, no EU Digital Services Act compliance obligations, and limited researcher access, which collectively produce a widening monitoring and attribution gap. **Iranian tactical evolution toward English language Western audiences** represents a notable doctrine shift. Meta H1 2026 reporting describes an Iranian covert influence operation that began targeting English speaking audiences in summer 2025 and was disrupted in Q4 2025 before it had time to build an authentic audience. This operation is assessed as a tactical evolution beyond traditional Farsi language and regional targeting of states such as Iraq, Lebanon, and Yemen. The early disruption suggests improved platform early detection for Iranian tradecraft and indicates that Iranian operations are currently being stopped earlier in their lifecycle than many Russian or Chinese efforts, which often persist for multiple months and secure significant reach before enforcement. **Israel linked YouTube operation critical of Canada exposes attribution methodology gaps**. Google Threat Analysis Group Q4 2025 bulletin disclosed the termination of two YouTube channels and one Ads account that were linked to Israel and that shared English language content critical of Canada. This low volume operation is methodologically important because Tier 1 platform attributions to Israel remain rare, and open source coverage of Israeli foreign information manipulation and interference is structurally thin. Google TAG provides minimal detail on the attribution methodology in this entry, in contrast with the richer technical fingerprints routinely provided for Russian or Chinese operations. The single source nature of this disclosure and the lack of follow on Tier 2 or Tier 3 corroboration over four months highlight an evidentiary and monitoring gap for this actor. **Platform reporting cadence and transparency gaps escalate the risk vector of platform opacity**. No new Meta coordinated inauthentic behaviour reports, Google TAG bulletins, or MSTIC reports were published in the week ending 2026-05-21. The most recent Tier 1 anchors are the Meta H1 2026 adversarial threat report of 2026-03-11 and the Google TAG Q4 2025 bulletin of 2026-01-29, representing a ten week gap since the last Meta disclosure and a sixteen week gap since the last Google disclosure. Platforms have real time detection and disruption capacity but choose quarterly or semiannual public reporting schedules that are driven by corporate communications calendars rather than public interest urgency. The resulting two to five month attribution and accountability blackout undermines EU DSA Article 40 transparency obligations and is most acute on X and Telegram, where there is either no coordinated inauthentic behaviour programme or no DSA jurisdiction. **Chinese high volume spam channel infrastructure persists with limited cross platform visibility**. The actor tracker and risk indicators assess Chinese operations as maintaining high volume through spam channel infrastructure such as Spamouflage and Taizi Flood, with persistent churn across YouTube and Blogger. A smaller subset of Chinese channels carries targeted political content on United States China relations and Taiwan, with a shift toward down ballot United States political targeting noted in prior threat centre reporting. However, there is a structural open source intelligence gap on Chinese activity on platforms such as WeChat, Weibo, and domestic amplification networks. This gap likely leads to underestimation of true amplification reach, because the most visible spam channels may represent only a fraction of total coordinated activity. **Gulf, United States, and Israeli operations remain structurally under monitored**. The actor tracker records no new Tier 1 disclosures for Gulf states, the United States, or Israel in the 2025 to 2026 cycle to date, beyond the single Israel linked YouTube case. Prior baselines include United Arab Emirates linked operations targeting Qatar and Turkey, Saudi linked operations targeting Iran and Yemen, and United States military psychological operations targeting Central Asia and the Middle East. The EEAS FIMI framework formally tracks Russian and Chinese operations but excludes United States and Israeli operations from the FIMI Explorer by documented political design. The European Parliament PEGA Committee documented specific United States operations that met DISARM tactic criteria but were not entered into that database. This institutional perimeter choice produces a two tier attribution system that normalises higher transparency for some actors while leaving others in a structural blind spot. ## Cross Monitor Connections The current week developments intersect directly with several sibling monitors. For the european strategic autonomy monitor, Russian multi platform operations against Moldova and Ukraine and their migration toward Telegram and TikTok are central to the European information security environment. Narrative persistence across YouTube, Blogger, Google News, and Telegram surfaces, combined with the absence of robust disclosure frameworks on Telegram and X, reduces the effectiveness of EU Digital Services Act risk mitigation and complicates European strategic communications. For the conflict escalation and strategic crisis monitor, ongoing Russian campaigns targeting Ukraine and Western audiences and the documented use of AI assisted content production in Doppelganger and IRA linked activity suggest an evolving blend of kinetic conflict and information operations. AI tools are being integrated as force multipliers for content generation, translation, and targeting, even if fully autonomous operations are not yet documented. This integration widens the gap between platform detection speed and public attribution, especially when semiannual or quarterly reporting cadences are applied. The democratic integrity monitor is directly affected by Iranian and Chinese doctrine shifts. Iranian tactical evolution toward English language Western audiences, including the Q4 2025 operation disrupted before audience building, points toward future election related campaigns aimed at conservative media ecosystems and broader English speaking publics. Chinese shifts toward down ballot United States political targeting within high volume spam channel infrastructures also raise clear electoral manipulation concerns, particularly where enforcement remains focused on headline national contests rather than local or issue level races. The ai governance monitor is engaged by the documented use of AI assisted content production in Russian multi platform operations. Current reporting frames AI tools as integrated into existing campaigns for scaling and translation, rather than as independent autonomous actors. However, this AI enabled foreign information manipulation and interference capability is underweighted in mainstream coverage relative to speculative fully autonomous scenarios. Governance debates that focus solely on frontier models risk overlooking the concrete, presently deployed AI assisted capabilities that already amplify FIMI campaigns. The global macro monitor and the environmental risks monitor have indirect but notable touchpoints. The platform disclosure cadence gap and the EEAS institutional perimeter gap for United States and Israeli operations represent structural governance failures that parallel asymmetries in economic coercion and climate related information battles. Where some states face dense webs of monitoring and sanction in economic or environmental domains, they also face higher transparency in the information domain, while others operate with comparatively little scrutiny across all these arenas. ## Outlook In the coming weeks, the critical watchpoint is the interaction between platform reporting cadences and multi platform migration doctrines. If Meta and Google maintain semiannual and quarterly disclosure schedules while Russian operations continue to shift activity to Telegram, TikTok, and other less moderated platforms, public situational awareness will lag ground truth by several months. The risk is that narrative trajectories in Moldova, Ukraine, and Western democracies will be shaped by campaigns that are only formally acknowledged in retrospective transparency reports. Analytically, the most valuable new evidence would include timely Tier 1 or Tier 2 reporting on Iranian and Chinese operations that target English language Western audiences, detailed methodology for Israel linked campaigns, and any structured disclosures covering United States and Gulf state operations at equal evidentiary standards to Russian and Chinese cases. On the technical side, further documentation of AI assisted content production practices, including concrete examples of tooling, workflow, and cross language amplification, would sharpen assessments within the ai governance and democratic integrity monitors. Until such disclosures appear, the information integrity composite will remain under pressure from governance gaps, platform opacity, and the continued shift of significant operations onto less transparent infrastructures. ## Cross-Monitor Flags - **FIMI as constitutive mechanism of democratic erosion — Hungary election FIMI density at critical level** (Democratic Integrity Monitor) — Active — verified (adjacent Issue 20) - **Cognitive warfare as operational preparation for European strategic paralysis — Hungary election as test case** (European Strategic Autonomy Monitor (EGHTM)) — Active — verified (adjacent Issue 23) - **AI-generated YouTube network (1.8B views) as operational proof of AI-FIMI convergence at scale** (AI Governance Monitor) — Active — verified (adjacent Issue 23) - **Post-election FIMI lull following Slovenia parliamentary elections (March 22, 2026) may precede escalation cycle targeting upcoming EU member state elections. Recommend forward-looking monitoring for FIMI activity targeting 2026-2027 electoral cycles.** (democratic-integrity) — Active — verified (adjacent Issue 20) - **Iranian FIMI operations targeting Israel-Palestine narratives remain active at baseline. No escalation detected this week, but recommend continued monitoring for FIMI activity correlated with Middle East conflict escalation events.** (conflict-escalation) — Active — verified (adjacent Issue 21) - **Russia deploys Moldova FIMI playbook against Armenia ahead of June 2026 elections** (democratic-integrity) — Active — verified (adjacent Issue 20) - **EU sanctions Russian FIMI infrastructure entities Euromore and Pravfond targeting EU legitimacy and Ukraine support** (european-strategic-autonomy) — Active — verified (adjacent Issue 23) - **Cross-actor AI-generated content amplification documented in Russian FIMI narrative** (ai-governance) — Active — verified (adjacent Issue 23) - **Vovan and Lexus prank-call operations target Greenland Foreign Minister in Arctic strategic competition context** (conflict-escalation) — Active — verified (adjacent Issue 21) - **Doppelganger explicitly targets EU member states with fake news sites and multi-platform amplification** (european-strategic-autonomy) — Active — verified (adjacent Issue 23) - **Doppelganger and Portal Kombat amplify pro-Russia, anti-Ukraine narratives across Western European audiences** (conflict-escalation) — Active — verified (adjacent Issue 21) - **Endless Mayfly/IUVM targets English-speaking Western audiences with Israel-Palestine narratives** (conflict-escalation) — Active — verified (adjacent Issue 21) - **Russian multi-platform operations targeting Moldova, Ukraine, and EU audiences with Confirmed attribution** (european-strategic-autonomy) — Active — verified (adjacent Issue 23) - **Russian multi-platform operations targeting Ukraine with Confirmed attribution** (conflict-escalation) — Active — verified (adjacent Issue 21) --- ## Data - Full report JSON: - Living Knowledge: - Archive: - Dashboard: - Methodology: