From Shadows to Sanctions: Unmasking Russia’s Hybrid Influence Strategy

How years of persistent disinformation transformed into formal recognition and real-world consequences.

On May 20, the European Union announced a significant package of sanctions against Russia. These sanctions aim to disrupt hybrid threats, especially those rooted in coordinated disinformation and influence operations. This latest effort targets a wide network of media fronts, influencers, and infrastructure providers who have supported and amplified Kremlin-aligned narratives across Europe and beyond.

The message is clear: modern influence campaigns are not just about hacking or surveillance. They are about controlling narratives, embedding disinformation into public discourse, and using digital infrastructure to stay operational, even when content is banned.

At ActiveFence, we have been tracking these actors long before their names appeared on sanction lists. The EU’s actions reflect what we have documented for years. These operations are not about quick virality. They are designed for longevity, built to adapt, evolve, and quietly maintain their hold on public opinion.

 

Inside the Influence Ecosystem

Narrative Laundering and Audience Manipulation

The 3rd EEAS Foreign Information Manipulation and Interference (FIMI) Report highlights how these campaigns operate across a “galaxy of interconnected digital networks.” On the surface, the sanctioned entities may look like independent media outlets. In reality, they are highly strategic actors working toward shared goals.

These outlets often present themselves as grassroots voices or alternative media platforms, led by charismatic “truth-tellers.” They build credibility by tapping into local frustrations, repackaging Kremlin narratives as anti-elite, progressive, or populist content. Rather than echoing Russian state lines verbatim, they embed them within broader political or social grievances, tailoring their tone for different regions and ideologies.

Despite appearing unrelated, these platforms frequently push the same storylines, anti-NATO, anti-Ukraine, anti-EU, often using similar visual language, emotional hooks, and recurring collaborators. This coordination makes their messaging feel both familiar and persuasive.

Repeat Offenders with a Proven Formula

Many of the newly sanctioned groups are not new at all. Some are rebranded versions of past operations that were previously banned. Others have continued to operate after being removed from mainstream platforms.

Their strategy is simple but effective: when a campaign is exposed, they relocate, rename, rebuild, and re-engage. This cyclical approach allows them to retain momentum, rebuild audiences, and resume operations with only minor interruptions.

These actors understand that influence is a long game. They don’t seek one-off virality but instead focus on slow, steady audience cultivation across Telegram, fringe platforms, and self-hosted domains. Even after rebranding, many keep the same staff, funding pipelines, and editorial style, exploiting enforcement blind spots and regulatory inconsistencies across jurisdictions.

Geographic disruption also proves temporary. When an operation is shut down in one country, it often reappears in another, under a new legal entity or domain name, often leveraging less-regulated top-level domains to stay active and avoid scrutiny.

Infrastructure That Enables Persistence

Several of the sanctioned entities were instrumental in keeping Russian state media accessible within the EU, and acted as facilitators to various online operations. Their impact extends beyond messaging. They provided the digital infrastructure that allowed these narratives to continue reaching audiences despite regulatory efforts.

This includes services like bulletproof hosting, VPNs, virtual private servers, and multi-platform content distribution services. These tools allow disinformation campaigns to continue operating even after individual accounts or websites are taken down or blocked.

This infrastructure layer is often overlooked, yet it is critical. It connects banned actors with their audiences and ensures content delivery across moderated and unmoderated platforms. By mirroring content across multiple domains, using anonymized hosting, and duplicating social media activity, these actors remain resilient and difficult to root out.

 

What Happens Next?

The EU sanctions are an important milestone. They signal growing recognition of the complexity behind modern influence operations. However, sanctions alone will not dismantle these networks. Long-term disruption will require smarter, faster, and more coordinated action.

These actors do not operate in isolation. They are part of a deliberately networked system designed to avoid detection while shaping public perception. Without real-time intelligence and cross-platform cooperation, the next wave of rebrands and reboots is already underway.

To stay ahead, organizations and governments must invest in deep, continuous intelligence that exposes the full architecture behind influence operations, not just the content on the surface.

Stay Ahead of the Threat

ActiveFence’s Threat Intelligence solution helps uncover and monitor the actors, networks, and infrastructure behind coordinated influence campaigns. Our real-time insights, attribution capabilities, and cross-platform visibility empower teams to move from reaction to prevention.

Learn how our intelligence can help your organization proactively identify risks, map adversarial behavior, and strengthen your defenses against persistent influence threats – Talk to our experts today.