Russia’s information warfare after 2022

The full-scale invasion of Ukraine on 24 February 2022 was not only a military operation, but also a test of Russia’s ability to impose its interpretation before the consequences of the attack became fully visible. The Kremlin expected the Ukrainian state to lose cohesion, society to become disoriented and Western governments to remain divided. Initial communication described the invasion as limited and justified, while denying Ukraine’s capacity for longer resistance. When the rapid military result was not achieved, it also became a failure in the information dimension.

Ukraine kept state communication functioning and used short, direct messages from its political leadership. International audiences also received a continuous flow of visual evidence from the conflict. Social media, open-source intelligence and foreign journalists reduced Russia’s ability to control the first interpretation of events. At the same time, the suspension of Russian state broadcasters in the EU and restrictions used by technology platforms limited some of the channels previously used by the Kremlin. Russia did not lose the capacity to conduct information operations, but it had to adapt them to faster attribution and more public scrutiny.

This adaptation should be analysed in the wider context of Russian strategic thought. Information has for a long time been treated not only as support for military operations, but as an instrument shaping the political environment before, during and after the use of force. Russian documents define the information space very broadly, including media, communication systems, digital infrastructure and the psychological condition of society. The line between defensive and offensive activity is unclear on purpose. Measures described as protection of information sovereignty can also limit domestic debate and prepare conditions for operations against external audiences.

The experience of 2022 did not cause Russia to abandon this model. It accelerated its modification. Moscow moved from the expectation of quick narrative dominance to a longer information confrontation. The model now combines repression at home, technological control, state media, proxy networks, cyber operations and messages prepared for different political groups. The objective is not always to persuade audiences that the Russian version is true. Creating uncertainty, reducing confidence in institutions and making joint action more difficult may be enough.

Information sovereignty

The first area of adaptation was the expansion of domestic control. Legal measures adopted after the invasion punished information contradicting the official description of military operations and gave broad possibilities to prosecute journalists, activists and ordinary citizens. Access to independent media was restricted, some foreign platforms were blocked or limited and the state increased pressure on technology companies and communication providers. It created an environment in which the personal cost of questioning the official narrative became much higher.

The logic of this policy is connected with a prolonged war. Authorities need to manage expectations, hide losses and prevent dissatisfaction from becoming organised opposition. Domestic censorship is therefore not separated from external information warfare; it is one of its conditions. The Kremlin cannot keep a coherent message abroad if alternative descriptions circulate freely inside Russia. Independent journalism was restricted through security and anti-extremism regulations, while state television and loyal digital channels still present the war as a confrontation with a hostile collective West.

Technological sovereignty is the second element of domestic consolidation. Russia invested in filtering internet traffic, removing content and reducing dependence on Western digital infrastructure. This does not mean that the Russian internet became completely isolated. The authorities still benefit from access to global platforms when these platforms can be used for influence or collection of information. The objective is selective control: useful connections are kept, but the state wants to be able to restrict them during a political or military crisis.

The domestic system relies on repetition and adaptation, not on one stable narrative. Earlier claims can be changed when they are impossible to maintain. Military setbacks are presented as planned withdrawals, economic problems as proof of Western hostility and mobilisation as a defensive answer to external aggression. Contradictions do not always make the message ineffective. A constant production of different explanations can exhaust the ability to verify facts and encourage citizens to withdraw from political judgement. In such a model, passivity may be as useful as active support.

The main limitation of internal control is the growing dependence on coercion. The more information is restricted, the more difficult it becomes for institutions to receive accurate assessments from lower levels. A system built to protect political stability can reduce organisational learning and encourage officials to report what superiors want to hear. The tension between control and reliable information remains a structural weakness of the Russian approach.

Influence and cyber

The second area of adaptation concerns operations abroad. When official broadcasters lost access to part of the European market, Russian actors increased the use of regional portals, nominally independent commentators, social media personalities, messaging applications and organisations repeating Kremlin narratives without looking like direct state representatives. Telegram became especially important because it allows quick distribution and circulation of material across languages and borders. The structure is now more decentralised, which makes attribution difficult and means that the loss of one platform does not stop the whole campaign.

The European External Action Service describes this wider activity as foreign information manipulation and interference. Its 2026 assessment points out that artificial intelligence is already used in Russian and Chinese influence operations, while AI-generated images and videos have become a normal part of the information environment. Generative systems reduce the costs of producing large amounts of localised content, translating it and changing it for different audiences. They also make false identities, synthetic experts and apparently authentic visual material easier to create. Not every item needs to be fully convincing. Large volumes and repetition can keep manipulated content present in the public debate.

Information activity is also more closely connected with cyber operations. Stolen and selectively published documents, attacks against media or public institutions and compromised trusted accounts can create material for a later narrative campaign. A cyberattack may interrupt public services, while coordinated online activity explains it as government incompetence. Disinformation can also prepare audiences to interpret a later technical incident in a way useful for the attacker. For this reason, cyber defence and strategic communication should not be organised as completely separate policy areas.

Russian campaigns are adapted to different geographic audiences. In Europe they use disputes about the cost of supporting Ukraine, migration, energy prices, sovereignty and distrust of political elites. In the Global South, Russia more often presents itself as an anti-colonial power opposing Western domination. Historical grievances, criticism of sanctions and selective information about food or energy insecurity are used to weaken support for Ukraine and reduce diplomatic isolation of Moscow. The same event can be explained in several different ways without maintaining full consistency between narratives.

This flexibility increases reach, but also creates weaknesses. Decentralised networks are more difficult to control and proxy actors may introduce extreme or contradictory messages. Open-source investigators and intelligence services can map infrastructure, identify repeated patterns and expose links between platforms. AI also supports defensive analysis by detecting coordinated activity and reused media. The information contest is therefore a process of continuous adaptation on both sides and not a permanent advantage of one actor.

The Western response

European institutions gradually moved from treating disinformation mainly as a communication problem to seeing it as a wider security challenge. The EU developed instruments for responding to Russian destabilising activity and expanded restrictions against individuals and entities involved in information manipulation. Additional listings in 2026 targeted propagandists and organisations working inside the pro-Kremlin influence structure, including unofficial media relays and state-supported bodies. Such measures are intended to increase the political and financial costs, although they cannot remove the phenomenon by themselves.

Sanctions and platform restrictions cannot replace social resilience. Effective counteraction needs rapid attribution, communication based on verified information and cooperation between governments, media, researchers and technology companies. Public institutions should not answer every false claim, because constant repetition can amplify it. Priority should be given to narratives which may produce security consequences, undermine trust during a crisis or influence democratic processes. The aim is not a state monopoly over information, but protection of conditions in which citizens can distinguish evidence from manipulation.

Protection of independent media has key importance as well. Russian censorship shows that control over information is used to remove accountability and prevent society from assessing the costs of the war. Western states should treat media freedom, access to public information and professional journalism as parts of national resilience. This also includes support for independent Russian-language outlets, protection of journalists and development of fact-checking and open-source capacities working across borders.

The future Russian model will probably become more automated, more local and more connected with other forms of hybrid pressure. Artificial intelligence will make production of synthetic content easier, while data analysis will improve targeting of groups already divided by political or social disputes. Information campaigns may accompany sabotage, cyberattacks, military exercises and incidents involving critical infrastructure. Their purpose will often be to shape interpretation before governments finish technical attribution.

At the same time, Russian information warfare has limitations. Repeated exposure reduces credibility of known channels, operational networks can be uncovered and Kremlin narratives have to compete with direct evidence from the battlefield. Centralised control also weakens internal feedback and makes the system vulnerable to its own propaganda. Russia adapted after 2022, but adaptation does not mean unlimited effectiveness.

Central and Eastern Europe

Central and Eastern European countries are particularly exposed because Russian operations can use historical disputes, linguistic minorities, economic fears and different national policies towards Ukraine. The region cannot be treated as one information space. Narratives ineffective in Poland may find an audience in Slovakia, Hungary, Moldova or the Baltic states. Counteraction needs local knowledge, languages and cooperation with regional media and research institutions. A central message prepared in Brussels can support political consistency, but it cannot replace communication adjusted to national circumstances.

Election periods, military incidents and disruptions of critical infrastructure are moments of increased risk. Governments need procedures connecting technical attribution with public communication, so an information vacuum does not appear in the first hours of a crisis. Premature accusation can damage credibility, but too long a silence allows hostile actors to define an event. Coordination between services, ministries, regulators and infrastructure operators should be agreed before a crisis and regularly exercised.

Education and media literacy remain necessary, but responsibility cannot be moved only to individual citizens. The scale and automation of influence operations are too large for users to verify every item separately. Public authorities and platforms must limit coordinated inauthentic behaviour, protect access to reliable information and explain methods used by hostile campaigns. Social resilience is created when institutions are transparent and credible, not only when citizens are told to be more sceptical.

Information has become a permanent area of strategic confrontation. A ceasefire or lower intensity of fighting in Ukraine would not finish Russian influence operations against Europe. The objectives of weakening Western cohesion, reducing support for Ukraine and rebuilding Russian political influence would remain. The response has to be long-term and institutional, combining technical detection, legal instruments, international coordination, public communication and education. A state which reacts only after a campaign becomes visible will usually be too late. Resilience starts earlier, before the first false narrative is widely repeated.