FIMI & Cognitive Warfare Monitor — 27 September 2026

Lead Signal

This week the EEAS East StratCom Task Force, through its EUvsDisinfo platform, published a consolidated attribution assigning a sustained cluster of Baltic directed disinformation narratives to organised Russian FIMI infrastructure, naming the campaign the Russia Baltic Escalation Narrative Playbook. The narrative cluster, which portrays NATO as preparing to attack Russia, Baltic governments as reckless militarisers, and Russian speaking minorities as facing persecution, is assessed by EEAS as remaining active, with corroboration credited to Baltic national intelligence assessments. EUvsDisinfo also recorded twelve consecutive weeks of documented narrative persistence for this campaign, one of the longest sustained clusters this monitor tracks.

The significance of this week development lies less in any single new narrative trope than in the act of consolidation itself. EEAS classified the Baltic narrative cluster as a doctrine shift, explicitly naming the underlying mechanism a coercion without conflict strategy in which the plausibility of military escalation, rather than any actual kinetic action, functions as the coercive instrument. This is read by the monitor as evidence of a maturing EU institutional capacity to synthesise pattern level FIMI assessments rather than merely reacting to individual stories, a capacity that, if extended, could narrow the current gap between the EU institutional attribution standard applied to Russia and the thinner single source attribution that still characterises other tracked actors.

Other Developments

A UAE directed operation used a Claude based AI agent against Sudan and UN accountability discourse. Anthropic disclosed, and stated it had disrupted, an operation tracked as GTG-84002, in which a Claude based AI agent was used as part of the operation infrastructure. Direction of this operation toward the UAE is assessed as consistent with Anthropic investigative findings on account and infrastructure patterns, though this attribution rests on a single commercial vendor without independent government or platform corroboration and carries only Uncertain confidence. Secondary reporting from Al Bawaba, characterising the operation as Abu Dhabi linked, surfaced in the days before this collection window.

Citizen Lab documents BlackCore, an Israeli commercial influence for hire firm. A new Citizen Lab research note details BlackCore infrastructure, fake profile construction methods, and client facing marketing, describing the entity as an Israeli influence for hire company with operations documented in multiple countries. The findings build on a prior Reuters exposure tying BlackCore activity to French municipal election campaigns, with France identified among the firm client targets.

The European Board for Digital Services convened its twentieth meeting. The Board met in Brussels on 24 September 2026 and discussed the role of the Digital Services Act in strengthening election integrity across Europe, alongside child safety obligations under the proposed EU KIDS Act. Election integrity provisions under the DSA constitute a direct structural lever against platform enabled FIMI, and their continued discussion at Board level signals sustained institutional prioritisation ahead of multiple 2026 and 2027 EU member state elections, even though no new fine or non compliance decision emerged from this meeting.

Code of Conduct on Disinformation signatories publish a second transparency report batch. Signatories of the Code, now formally recognised as a DSA code of conduct, published their second batch of self reports, a measurable cadence data point for platform disclosure under a binding EU instrument, though the substantive quality of these reports has not yet been independently assessed by this monitor.

Risk indicators shift on AI enabled FIMI while the composite score holds steady. The AI enabled FIMI risk vector moved to Elevated this week, a rating assessed as consistent with continued diffusion of commercial AI agent tooling into influence operations rather than as direct confirmation of any single actor capability. The Regulatory Enforcement Gap vector remained at Moderate, reflecting the pattern across the eighteenth, nineteenth, and twentieth Board meetings of election integrity discussion without a corresponding enforcement action. The information integrity composite score held stable at 0.42 this week.

Cross-Monitor Connections

The Baltic narrative offensive carries direct relevance for the democratic-integrity monitor, given its targeting of the democratic and security legitimacy of NATO and EU member states Latvia, Lithuania, and Estonia. The UAE directed Sudan and UN operation intersects with the conflict-escalation monitor, given its direct connection to the Sudan civil war and to international accountability mechanisms scrutinising conduct within that conflict, an intersection still carrying Uncertain confidence pending independent corroboration. The twentieth European Board for Digital Services meeting bears on the european-strategic-autonomy monitor coverage of hybrid threats and DSA enforcement, given the Board discussion of the DSA role in strengthening election integrity in Europe. Both the UAE directed Claude based agent operation and the BlackCore commercial tooling are relevant to the ai-governance monitor tracking of AI enabled FIMI tools, illustrating continued diffusion of AI agent capability into commercial and state linked influence operations. Separately, the BlackCore activity tied to French municipal election campaigns is also relevant to the democratic-integrity monitor.

Outlook

Several open items would materially change next cycle assessment. Independent government or second platform corroboration of the Anthropic UAE attribution for GTG-84002 would upgrade that campaign from Uncertain toward Probable or Confirmed confidence, a gap the monitor gaps register identifies explicitly. Comparable movement on BlackCore would require a named client identity or contract level evidence beyond the French municipal election case, which would help determine whether Israeli state attribution is ever warranted, as distinct from company level commercial activity. The sustained absence of any Tier 1 through Tier 3 disclosure for China, Iran, and United States actor tracks across multiple consecutive cycles remains a standing coverage gap concern in its own right, one this monitor continues to flag rather than read as reduced operational tempo. On the regulatory track, the recurring pattern of DSA Board discussion without enforcement action across three consecutive meetings is speculatively assessed as reflecting procedural or evidentiary bottlenecks upstream of public enforcement decisions, a hypothesis worth testing against whatever the Board next meeting produces.