Counter-FIMI as FIMI: Russian Narrative Manipulation and Reputational Hijacking

Key Takeaways

• Four days before Armenia’s 7 June 2026 parliamentary election, an article published by an Social Design Agency (SDA)-linked influence asset (Yerevan One) promoted a narrative framing European counter-FIMI efforts as electoral interference, censorship and an effort to “purge” Armenia’s information space.
  

• The article falsely cited the Cyfluence Research Center (CRC), referred to as “Cyfluence Research,” for allegations that Western funders and French authorities were coordinating information operations in Armenia. CRC made no such claim.
  

• According to leaked SDA documents, Yerevan One was designed to serve as a pro-Russian “news outlet” used to influence Armenia’s election and promote political actors and narratives favourable to Russia.
  

• The case highlights a distinct hostile influence technique: hijacking a legitimate think tank or research institute’s reputation and perceived credibility to support a malign narrative.

Background

A recent CRC blog examined OCCRP reporting on leaked documents linked to the Social Design Agency (SDA), a known Russian influence contractor. Amongst the leaked files was a document describing a plan to use various media outlets in order to target Armenian voters with pro-Russian messaging ahead of Armenia’s general elections. One of these dedicated outlets is Yerevan One (Erevan.One).

Figure 1 - Erevan.One homepage (accessed 27 July 2026).

The Interference-Inversion Narrative

On 3 June 2026, four days before Armenia’s parliamentary election, Erevan.One published an article titled “Censorship Is Democracy: French Press Exposes Paris’s Interference in Armenia’s Elections” (translated from Russian).

The article alleged that French and European actors were financing organizations that supplied information about so-called “malicious disinformation campaigns” and supported a “purge of the information space.” This narrative is founded on the alleged misuse and weaponization of counter-disinformation investigations by Western actors.

In that context, it cast VIGINUM, the French state service whose primary mission is to detect and characterize foreign information manipulation and interference (FIMI), as a vehicle for externally imposed censorship in Armenia. 

To further justify these claims, the Erevan.One article cites “evidence” from select sources. Coincidentally, it went as far as mentioning our organization (mentioned in the article as “Cyfluence Research”) to its support allegations of European interference. The article falsely implied that the CRC, together with a French media outlet (France-Soir) have reported on the alleged European and US-led “malicious campaigns”.

Figure 2 – The Erevan.One article alleging European electoral interference under the guise of counter-disinformation.

Figure 3 - Excerpt from the Erevan.One article falsely presenting “Cyfluence Research” as support for an allegation about European and US funding.

The article’s selection of sources suggests a case of source conflation. A France-Soir opinion article published on 4 May 2026 advanced similar allegations.[1] It listed a CRC blog from 2025, which covered a VIGINUM report on the Russian threat actor Storm-1516, among its sources. However, the cited blog did not concern Armenia, VIGINUM activity in Armenia, or the funding of Armenian NGOs. 

Erevan.One’s framing (i.e. “According to France-Soir and Cyfluence Research”) converted a bibliographic citation into a direct institutional endorsement. This could be the result of careless manual drafting, automated summarization, or AI-assisted content generation.

Needless to say, the aforementioned claims made by Erevan.One are obviously false. The Cyfluence Research Center did not produce any analysis or statement supporting the article’s allegations at any point. This type of misattribution aligns with DISARM Technique T0161.002: Statement Incorrectly Presented as Made by Individual or Institution.

Figure 4 - Concluding passage from the Erevan.One article asserting that France-Soir had reported French interference in the recent Armenian elections.

Erevan.One and SDA-Linked Influence Campaigns

An OCCRP investigation based on leaked documents clearly linked Erevan.One to a wider media infrastructure associated with the Social Design Agency (SDA), a Russian influence (or “cognitive strikes”) contractor sanctioned by the US, the UK, and the EU.

Figure 5 - Excerpt from the investigation report mentioning SDA operational asset "Yerevan One" (Erevan.One). (Courtesy of OCCRP)

According to OCCRP, a document contained in the leak placed erevan.one within a group of 12 media outlets targeting audiences across Armenia, Central Asia, and the wider post-Soviet space. A separate file described Yerevan One as an outlet focused on the Armenian diaspora in Russia and outlined plans to use it during Armenia’s election campaign. The documented objective was to undermine attitudes toward Armenia’s authorities and Prime Minister Nikol Pashinyan, while cultivating support for actors favoring a closer relationship with Moscow.

An EK Strategic Communications Center’s report on Russian interference in Armenia reached a similar assessment. It identified erevan.one as a “documented covert Kremlin proxy platform” affiliated with the SDA, placing it within an operational infrastructure that included Russian state media, regional proxy outlets, Telegram networks, and anonymous social media accounts. According to the report, this influence infrastructure proliferated and amplified narratives portraying European integration as a threat to Armenia’s sovereignty, security, economy, and national identity.

Figure 6 - Excerpt from a report classifying Erevan.one as a documented covert proxy platform attributed to the SDA. (Courtesy of EK Strategic Communication Center)

OCCRP appropriately cautions that the authorship of every individual document in the leaked archive cannot always be assigned conclusively to the SDA. However, current evidence places Yerevan One within an influence infrastructure connected to the SDA and that plans existed to deploy the outlet in support of Russian strategic objectives surrounding Armenia’s election.

Turning Influence Defense Into “Foreign Interference”

Whether deliberate or incidental, Erevan.One’s misleading citing of CRC served several mutually reinforcing narrative functions:

• Authority laundering - Referencing an established European research center made the false allegations appear to rest on independent analysis. 
  

• Narrative inversion - Instead of presenting hostile influence campaign (HIC) detection and monitoring as a defensive activity, the article reframed the identification of FIMI efforts as devices of censorship and foreign interference. By doing so, it turned respected research institutions into malign actors. Meanwhile, the outlet actually identified as part of a foreign influence infrastructure (Erevan.One) is presented as the defender of free democratic discourse.
  

• Reputational smearing - By injecting the CRC into a narrative about covert and hostile European intervention, the article attached fabricated claims to the organization.
  

The observed tactics messaging seen in this specific case match the overall narratives spread by Russian proxies and Russia-aligned actors. The pre-emptive promotion of “Western interference” narratives seems to have been intended to weaken confidence in the election and Armenia’s relationship with Europe.

Borrowed Legitimacy and Forced Association

In a previous blog, we examined different models of credibility abuse by hostile influence actors, including the exploitation of legitimacy associated with news organizations, OSINT platforms, research institutes, and other authoritative entities (see DISARM Technique T0097.204: Think Tank Persona). These operations frequently imitate reputable institutions or create pseudo-research organizations whose visual identity and analytical language make political messaging appear credible.

The erevan.one article exhibits usage of a different technique. In this case, threat actors did not impersonate the CRC or create a counterfeit website. Instead, they simply inserted the organization’s name into a narrative, while assigning it a supportive role. The observed misattribution can be seen as forced association: the unauthorized incorporation of a legitimate institution into a malign narrative to appropriate its authority, alter public perceptions of its work, or both.

Conclusion and Implications

Influence defense practitioners and cognitive security stakeholders should incorporate reputational abuse and forced associated into existing analytical frameworks. 

Ongoing brand monitoring should examine not only the frequency of mentions but also the context, narratives and claims attached to them. Suspicious references should be documented immediately (through screenshots, URL archiving, etc.). Threat researchers should map the velocity and reach of narratives across platforms and influence assets.

Public correction should be quick and deliberate. Defenders need to establish an authoritative record without reproducing or amplifying unfounded allegations. If possible, this step should be accompanied by removal demands and appropriate legal action.

Protecting our information environment requires defending not only platforms, data, and narratives, but also personal and organizational identities and reputations. Threat actors continue to impersonate credible media outlets and abuse legitimacy in order to target vulnerable audiences in pursuit of their strategic goals.

[References:]

1. France-Soir. Macron choisit le Premier ministre des Arméniens ? Les services secrets français accusés d’ingérence. [online] Published 25 July 2026. Available at: https://www.francesoir.fr/opinions-tribunes/macron-choisit-le-premier-ministre-des-armeniens-les-services-secrets-francais
   

2. erevan.one, “Цензура — это демократия: французская пресса вскрыла вмешательство Парижа в выборы Армении”, 3 June 2026. https://web.archive.org/web/20260727111815/https://erevan.one/42960-cenzura-jeto-demokratija-francuzskaja-pressa-vskryla-vmeshatelstvo-parizha-v-vybory-armenii.html
   

3. EK Strategic Communications Center, The Kremlin’s 2026 Election Campaign in Armenia, 5 June 2026. https://ekstrategies.org/articles/the-kremlins-2026-election-campaign-in-armenia
   

4. Organized Crime and Corruption Reporting Project, Leaked Documents Reveal Russian ‘Cognitive Strikes’ Against the West, Including Islamophobic ‘Pig Head’ Attacks in Paris, 24 May 2026. https://www.occrp.org/en/investigation/leaked-documents-reveal-russian-cognitive-strikes-against-the-west-including-islamophobic-pig-head-attacks-in-paris 
   

5. Cyfluence Research Center, Borrowed Legitimacy: Three Models of Credibility Abuse in Influence Operations, 15 June 2026. https://www.cyfluence-research.org/post/borrowed-legitimacy-three-models-of-credibility-abuse-in-influence-operations 
   

6. Cyfluence Research Center (CRC), Behind the Curtain: Leaked SDA Files, Russian Influence Operations, and Defensive Cyfluence, June 1, 2026; updated June 14, 2026.https://www.cyfluence-research.org/post/behind-the-curtain-leaked-dsa-files-russian-influence-operations-and-defensive-cyfluence 
   

7. Financial Post, Russia’s “Wiki Warfare” Tries to Distort Reality, Documents Show, June 23, 2026. https://financialpost.com/pmn/business-pmn/russias-wiki-warfare-tries-to-distort-reality-documents-show