The Next Generation of Hybrid Warfare? Russia, China and the Prospect of a Federated FIMI Ecosystem

The European Centre for Strategies and Transformations has mapped the architecture of Russian influence in Europe in its analytical brief Russia’s Disinformation Network in Europe: FIMI, AI Operations and the New Hybrid Threat Landscape. The research shows how proxy media, cloned outlets, platform manipulation, AI-generated material and cross-platform amplification already operate as parts of a wider hybrid-pressure system. The question now is whether some of this infrastructure could become interoperable with Chinese influence capabilities.

Where the threat becomes concrete

An election campaign offers a straightforward example of how such a system might work.

A Russian-linked network could obtain or fabricate compromising material, release it through a proxy outlet and begin pushing allegations of fraud, corruption or foreign interference. The original story would not have to convince a large audience. It might only need to create enough noise for other actors to pick it up.

Chinese state media, diplomatic accounts or covert networks could then carry parts of the controversy into other languages and markets. They would not necessarily need to endorse the original allegation. Instead, they could present the controversy itself as evidence of political dysfunction in the West.

Microsoft has documented both Russia’s use of covert websites and fabricated personas in election-related operations and PRC-linked attempts to probe divisive issues among US voters.

These remain separate activities. The concern is what happens if their functions begin to complement each other.

The same pattern could extend well beyond elections. A cyber intrusion might produce stolen documents, which could then be selectively leaked, stripped of context or combined with fabricated material. Russian-linked outlets have considerable experience turning such releases into political scandals. Broader circulation through Chinese media and multilingual account networks could make the material appear to have several independent points of origin. By the time investigators reconstruct where it came from, the political debate may already have moved elsewhere. The key issue is not necessarily formal co-ordination, but sequencing: one network creates the incident while another helps turn it into an international narrative.

Such a model could also give Moscow access to audiences that are less receptive to openly pro-Kremlin sources.

A claim first circulated by Russian outlets could be repeated by Chinese state or semi-official media before returning to European debate as apparently independent foreign analysis.

The source becomes harder to identify. The framing, however, remains.

CEPA’s research on Sino-Russian FIMI convergence already identifies selective amplification and established media co-operation, although it also finds limited evidence of integrated campaign management.

A deeper convergence would not necessarily produce an obvious state-to-state trail.

Much of the practical work could be outsourced. A public-relations company, advertising intermediary, hosting provider or influence-for-hire operator could work for several clients without formally belonging to either government.

Meta has shown how commercial influence operators can blur the line between private services and state-directed campaigns. If the same contractor or technical infrastructure were used by different networks, capabilities could be exchanged without either side exposing its most sensitive assets. Attribution would become harder at the same time.

Generative AI lowers the barrier further.

Its main advantage for influence operators is not that it can automatically produce convincing propaganda. It is that it makes production faster and more flexible: translating material, testing different versions of a message, imitating local political language and keeping large numbers of accounts supplied with fresh content.

A weak narrative can be modified repeatedly until one version begins to gain traction.

Google’s reporting on DRAGONBRIDGE in 2024 shows the scale at which PRC-linked networks are already experimenting with such techniques, even though their organic reach has often remained limited.

In Q1 2025, Google observed more than 20 China-backed APT groups using Gemini. DRAGONBRIDGE alone accounted for around three quarters of PRC-linked information-operation activity. Google also identified three Russia-backed APT groups and four Russia-linked information-operation groups using the same LLM.

Europe’s vulnerability is partly structural. Different institutions often see different pieces of the same operation. A cyber-security team may detect the intrusion. Election authorities may notice a coordinated wave of fraud claims. A platform may remove a cluster of accounts, while financial investigators examine an apparently unrelated contractor. Each institution may hold a legitimate piece of the picture without seeing how those pieces connect. A federated campaign would be most likely to exploit precisely that gap.

The third EEAS report on FIMI threats points towards a more useful approach: tracking infrastructure, behaviour and connections across platforms rather than treating every account or post as an isolated incident.

The immediate threat, then, is not the emergence of a formal Russian-Chinese information alliance.

It is the possibility of campaigns in which different actors perform different functions - stealing, fabricating, laundering, translating or amplifying information - while European institutions continue to assess each fragment separately.

Such operations would not require Russia and China to share every objective or operate under a single command. Limited interoperability could be enough: shared infrastructure, intermediaries, timing or audience targeting.

That is why the issue increasingly looks like a resilience and security challenge that Europe needs to address before a fully coordinated operation can be conclusively attributed.

Where the two systems already converge

The clearest point of convergence is strategic. NATO StratCom COE research identifies alignment around criticism of US dominance, NATO, sanctions, Western military interventions and what Moscow and Beijing portray as Western hypocrisy.

But the alignment is selective rather than automatic. Beijing has not consistently repeated Moscow’s most extreme claims about Ukraine and continues to invest heavily in presenting China as a constructive and responsible international power. Russian operations in NATO information environments are generally more disruptive and more willing to create confusion for its own sake.

Selective amplification can still change the information environment.

Chinese media do not have to endorse every Russian allegation to reinforce the broader frame around it. Repeating claims about NATO expansion, US policy or Western military assistance can shift attention away from Russian responsibility while allowing Beijing to maintain its own preferred position.

Formal media links add another layer. They do not prove covert campaign management, but they create durable channels through which narratives, techniques and professional practices can move between the two systems.

The foundations for deeper convergence are therefore already in place. What remains unclear is whether those connections could extend into covert operational infrastructure.

Why the scenario is no longer remote

The possibility is no longer confined to abstract speculation. It has increasingly entered mainstream security analysis.

If China were to move further towards disruptive covert operations, it could draw on parts of Russia’s existing influence infrastructure, much of which operates through semi-private networks responsive to financial incentives.

Such a scenario would not require Beijing to gain access to a classified Russian command structure. A state-linked actor could simply purchase a specific service from an intermediary with experience in Russian-aligned influence operations. For now, however, this remains a prospective scenario rather than an observed arrangement.

Dr Tamás Matura places this risk squarely within the wider European security debate.

He points to mutual amplification, shared anti-Western narratives, media co-operation and increasingly similar use of social media and artificial intelligence, while also stressing that evidence of direct collusion remains limited.

Other researchers have taken the idea further. Dr Maria Papageorgiou described a possible complementary “division of labour”, in which bots and anonymous accounts could amplify opposing sides of political disputes.

Because this interpretation comes from ongoing research rather than a completed peer-reviewed publication, it is better treated as an emerging hypothesis than as established attribution.

A 2025 CSIS tabletop exercise reached a similarly useful, although limited, conclusion.

When simulated Chinese and Russian teams were allowed to co-ordinate following a disputed election in Guatemala, they were able to combine their activities effectively during the initial crisis. Their priorities diverged later.

The Guatemala exercise is relevant to Europe because it illustrates how a disputed election or political crisis can create a temporary opening for Russian and Chinese influence activities to reinforce one another.

A comparable dynamic could emerge in Europe if both actors saw an advantage in increasing uncertainty and weakening public trust in democratic institutions, even while their longer-term strategic interests remained different.

How the threat could materialise

A plausible future system would look more like a federation than a hierarchy.

Each state would retain its own political objectives, intelligence structures and operational networks. Co-operation would take place only where connecting the two systems offered a practical advantage.

What the interfaces could include

• Reciprocal amplification and content laundering through state media, proxy outlets and apparently local accounts.

• Common contractors, influence-for-hire companies or technical service providers.

• Shared hosting, advertising, analytics, language resources or audience research.

• Co-ordinated activity around elections, protests, military incidents or diplomatic crises.

• Sequencing cyber intrusions, leaks, narrative framing and multilingual distribution.

Neither side would have to expose its most sensitive capabilities. An intermediary could receive a target, narrative or specific time window without being given access to the wider campaign.

If discovered, individual components could be presented as commercial spam operations, independent media projects, activist groups or opportunistic contractors. The structure would therefore be difficult to distinguish from the normal noise of the online information environment.

The UK Strategic Defence Review 2025 notes that China and Russia have deepened their relationship.

At the same time, it stresses that strategic and opportunistic alignment among these states remains shaped by different interests and longstanding mistrust.

A federated ecosystem would fit that reality. It would allow Moscow and Beijing to co-operate selectively without requiring the level of trust associated with a formal alliance.

Elections are the most likely test

Elections provide the clearest environment in which such a model could emerge.

Russian operations can target the legitimacy of institutions, intensify hostility between political groups, question the credibility of electoral results and generate confusion. Contradictory narratives can be useful when the goal is disruption rather than persuading voters to support a particular position.

China’s approach has traditionally been more selective, with greater emphasis on regime reputation and specific policy interests.

Recent reporting on Russian election interference and Microsoft’s analysis of PRC-linked activity point to a wider willingness among state-linked actors to probe domestic fault lines and election-related tensions.

According to Microsoft, CCP-affiliated deceptive accounts posed contentious questions around divisive political issues in the United States. The activity could help identify sensitive themes and particular groups of voters, although Microsoft found little evidence that the broader campaign had materially shifted public opinion.

Google’s reporting on DRAGONBRIDGE, also known as Spamouflage, illustrates both the scale and the limitations of current PRC-linked activity.

The network responds quickly to social wedge issues and international events and has experimented with multilingual and AI-generated content. Yet it has often struggled to generate significant organic engagement.

That weakness points towards a possible area of complementarity.

Microsoft has documented Russian narrative laundering through fabricated personas, covertly managed websites and staged amplification. Chinese-linked networks can provide state-media reach, diplomatic framing and multilingual distribution.

There is no public evidence that these capabilities have been combined. But the functional fit is difficult to ignore.

A joint effect would not require the two sides to perform identical tasks.

A Russian-linked network could introduce a forged document or polarising allegation. Chinese-linked accounts could then amplify the broader theme - Western instability, institutional hypocrisy or democratic failure - without necessarily repeating the original falsehood.

State media could report on the controversy as if it were an organically emerging political issue, while local influencers provided a layer of domestic credibility.

What makes convergence easier

Several developments are lowering the cost of connecting otherwise separate systems.

First, CEPA notes that both governments can benefit when Western societies become more polarised, support for Ukraine weakens, NATO members disagree and confidence in elections declines.

Their foreign-policy objectives do not have to be identical for them to recognise overlapping strategic advantages.

Second, information operations require much less integration than military operations. A contractor, content repository, encrypted communications channel or shared target list could be enough to connect activities for a particular campaign.

Third, the commercial influence market provides a ready-made layer of intermediaries.

Meta’s State of Influence Operations report documents “IO-for-hire” services offered by media, marketing and public-relations companies to both domestic and foreign clients. Private firms make attribution harder and could allow different state-linked customers to draw on overlapping skills, personnel or infrastructure.

Fourth, generative AI is making multilingual adaptation faster and cheaper.

Reporting by Microsoft on PRC-linked operations, Microsoft on Russian operations and Google on DRAGONBRIDGE shows that state-linked actors have already experimented with AI-generated and AI-enhanced text, images, audio and video.

The evidence so far points more clearly to gains in scale and speed than to proven gains in persuasion. But the cost of producing and adapting large volumes of content is falling.

Finally, direct co-operation is not necessary for operational learning.

Platform takedowns, indictments, investigative reporting and academic research reveal which tactics were attempted, how they operated and why they were detected. One system can absorb the lessons of another without receiving direct instructions from it.

Why full fusion remains unlikely

Convergence does not make a unified system inevitable.

Russian activity in NATO information environments is generally more disruptive, while Chinese operations have traditionally placed greater emphasis on projecting a positive international image.

Their preferred outcomes can also diverge. Moscow may benefit from electoral chaos regardless of which candidate ultimately wins. Beijing, by contrast, may favour a particular candidate because of their position on Taiwan, trade, telecommunications or investment screening. Russia may seek to undermine confidence in the political system itself, while China still needs functioning governments capable of signing agreements and protecting Chinese investments.

Operational sharing would also create new vulnerabilities.

Exchanging infrastructure, contractor access or audience data would increase the risk of penetration and exposure. Neither government has a strong reason to place complete trust in the other.

The more credible scenario is therefore co-ordination without dependency: temporary collaboration where interests overlap, while each side preserves its own capabilities for periods when their priorities diverge.

What Europe should watch

Narrative similarity is a weak indicator of actual co-operation.

More useful evidence would be technical and behavioural. Analysts should look for recurring use of the same hosting providers, domains, analytics identifiers, advertising accounts, cryptocurrency wallets, account-creation patterns or content-management systems by networks that are otherwise linked separately to Russia and China.

Cross-language handovers could be equally revealing.

A narrative might begin inside a Russian-language proxy ecosystem, move into Chinese state or semi-official media, and then return to European audiences through English, French, German, Spanish or local-language accounts.

The route taken by the narrative may tell investigators more than the original claim itself.

Timing is another potential indicator. Near-simultaneous activation of dormant Russian- and Chinese-linked networks around a political candidate, security incident or disputed election result would be more significant than generic anti-Western rhetoric appearing across both ecosystems.

Other warning signs could include shared local influencers, identical audience segmentation, reciprocal promotion of newly created websites, common contractors, or a sequence in which a cyber intrusion is followed by Russian-style leaking and Chinese-linked amplification.

The relevant unit of analysis is therefore no longer only the state actor.

It is the campaign interface connecting otherwise separate systems.

Building resilience before convergence becomes operational

European governments need to become better at joining these dots.

A cyberattack, a suspicious leak, a sudden wave of election-related claims and an opaque payment to a communications contractor may all form part of the same operation. Yet they are still too often handled by different institutions.

Governments should establish permanent channels for sharing information between intelligence services, cyber-security bodies, electoral authorities and financial investigators.

They should also focus less on individual posts and more on the infrastructure behind them: domains, contractors, advertising accounts, payment routes and patterns of activity across languages and platforms.

The private sector has a central role as well.

Platforms, hosting providers, advertising firms, media companies and AI developers need to understand who is using their services and be prepared to act when the same networks move between them.

Stronger checks on clients and contractors, proper preservation of evidence and faster sharing of technical indicators would make it harder for influence-for-hire firms to conceal state-backed activity behind ordinary commercial services.

This will become increasingly important as generative AI makes it cheaper to produce large volumes of localised content and keep coordinated networks active for longer.

Civil society, journalists and researchers should also look beyond the latest false claim and pay closer attention to how a story travels.

The critical question is often not simply whether an individual post is true or false. It is who introduced the narrative, who gave it credibility and how it moved from an anonymous source into mainstream political debate.

Answering those questions requires sustained multilingual monitoring, stronger open-source investigations and greater caution around dramatic leaks and apparently independent foreign commentary.