Global FIMI & Cognitive Warfare Monitor — W/E 30 March 2026

This is the inaugural briefing of the Global FIMI & Cognitive Warfare Monitor. It tracks foreign information manipulation and interference as a global cross-actor doctrine across six actors: Russia, China, Iran, Gulf states, United States, and Israel. Full actor attribution, campaign detail, and doctrinal frameworks are available on the live dashboard.

CRITICAL — Russia: Social Design Agency confirmed in Budapest Embassy

The EEAS Rapid Alert System activated on 19 March 2026 following confirmation that Russia’s Social Design Agency (SDA) is operating from within the Russian Embassy compound in Budapest, conducting coordinated targeting of Hungarian social media ahead of the April 12 parliamentary election. Operations include fake local news site seeding and pro-Orbán narrative amplification through Telegram channel networks. The SDA has previously been attributed to electoral interference in Romania (2024), Germany (2021), and France (2022). The April 12 Hungarian election is assessed as the highest-priority active FIMI target in Europe.

Source: EEAS Rapid Alert System, 19 March 2026

CRITICAL — Russia: Meta removes 1,700+ Doppelganger assets

Meta’s February 2026 CIB report documented the removal of over 1,700 assets attributed to Russia’s Doppelganger network — the largest Russia-attributed platform enforcement action since 2022. Assets included fake news sites cloning major German, French, and Ukrainian outlets, coordinated Facebook pages, and Instagram accounts targeting Bundestag election narrative and French domestic politics. The operation exploited algorithmic amplification via coordinated engagement timing. Attribution: Confirmed.

Source: Meta Adversarial Threat Report, February 2026

HIGH — United States: Turning Point Action launches Alliance of Sovereign Nations

On 5 March 2026, Turning Point Action launched the Alliance of Sovereign Nations (AoS) — a formal European far-right coalition including MEPs with documented connections to Russian-linked networks. The AoS shares organisational infrastructure, funding patterns, and narrative frames with Kremlin-aligned actors while operating through US-registered entities, creating a convergence dynamic that standard FIMI attribution frameworks — which treat US and Russian operations as separate categories — are structurally poorly equipped to capture. Attribution: High confidence.

Source: Politico EU, March 2026; Deutsche Welle, March 2026

HIGH — Israel: Black Cube lobbying investigation in Bundestag

Haaretz and Süddeutsche Zeitung reporting in March 2026 confirmed a Black Cube operation targeting German Bundestag politicians, involving profiling of political figures, honey-trap approaches, and opposition research commissioned by an undisclosed client. Black Cube’s methodology — private intelligence operations using commercial cover — represents the commercial cognitive warfare model at its most developed: state-level capability with full deniability for the sponsoring actor. Attribution: Confirmed (operator); client: unattributed.

Source: Haaretz, March 2026; Süddeutsche Zeitung, March 2026

HIGH — China: Google TAG disrupts Dragonbridge / Spamouflage network

Google’s Threat Analysis Group Q1 2026 report documented disruption of a coordinated Dragonbridge/Spamouflage operation across YouTube, Blogger, and X targeting Taiwan Strait and Indo-Pacific narratives. Approximately 2,500 assets removed. The operation showed continued evolution in tactics: shorter content cycles, more localised language targeting, and greater use of AI-generated commentary to pass platform quality filters. Attribution: Confirmed.

Source: Google Threat Analysis Group, Q1 2026

MODERATE — Iran: Campus protest amplification network

DFRLab’s Q1 2026 reporting documented an Iran-aligned network systematically amplifying pro-Palestinian campus protest movements across EU and US university environments, using a combination of authentic activist accounts and coordinated inauthentic amplification infrastructure to inflate apparent organic support. The operation exploits the blurred boundary between genuine political expression and foreign-directed amplification — the most methodologically difficult FIMI category to attribute with confidence. Attribution: Assessed.

Source: DFRLab, Q1 2026

MODERATE — Platform gap: X enforcement at historic low

The EEAS 4th Annual FIMI Threat Report (12 March 2026) found that 88% of EU-targeted FIMI content identified through the Rapid Alert System remained live on X (formerly Twitter) following flagging — compared to 23% on Meta platforms and 31% on YouTube. X Trust and Safety staffing has fallen by approximately 80% since the 2022 ownership change. The platform now functions as the primary low-enforcement environment for cross-actor FIMI operations. This is a structural feature of the current information environment, not an enforcement cycle anomaly.

Source: EEAS 4th Annual FIMI Threat Report, 12 March 2026

MODERATE — Structural note: EEAS framework covers 2 of 6 active actors

The EEAS 4th Annual FIMI Report — the most systematic public FIMI attribution framework available — formally attributes operations to Russia and China only. Four of the six actors tracked by this monitor (Iran, Gulf states, United States, Israel) have no institutional EU tracking mechanism. CIDOB (Barcelona) has formally identified this as a critical analytical gap. This monitor’s coverage of all six actors is a direct response to that gap, drawing on NATO, OSCE, G7, Five Eyes, and investigative journalism sources to compensate. The methodology governing attribution standards is published at asym-intel.info/monitors/fimi-cognitive-warfare/methodology/.

Source: EEAS 4th FIMI Report; CIDOB