CheckFirst’s 6th Birthday: a year of innovations

We can’t believe it’s been six years since we began our efforts to strengthen society against online information manipulation. The past year saw many new beginnings : innovative research, fresh projects, and a new leadership team.

Exploring IMS’s core structure

As researchers spending countless days studying inauthentic content and assets belonging to threat actors, we believe our findings should be clear and easy for anyone interested in tackling online harms to understand and replicate. 

Along with EU DisinfoLab, Viginum, Cassini, the Auswärtiges Amt, the EEAS and the DFRLab, we jointly created a new framework to document, attribute and respond to coordinated disinformation campaigns: the Information Manipulation Set (IMS) framework. This helped us and our partners better understand the ecosystem behind IMSs such as Overload. We immediately adopted the IMS framework and will be using it for all our investigations going forward.

In May 2026, one month ahead of the Armenian parliamentary elections, we monitored disinformation spread by foreign IMSs and tracked content suggested by online platforms’ recommendation algorithms to diaspora users searching for content about the ballot. We also discovered and documented a new pro-Russian IMS that we baptized “Roska Bridge”, which exploits vulnerabilities of the Fediverse to spread anti-Ukrainian and anti-Western propaganda. 

For us, investigating IMSs also means examining the actors who are running them. We did so by adopting an unusual technique to map the FSB’s 16th Centre and the GRU’s Information Operations Troops units. We examined the symbols depicted on old medals sold on the internet, and cross-referenced them with the help of traditional open source intelligence (OSINT) techniques. We are especially proud of these investigations since they demonstrated that it is always possible to conduct OSINT investigations by taking unconventional approaches.

Strengthening links with the counter-disinformation community

Collaborative work is still a big part of our mission. The French-speaking ODIL platform, which we created with our partner, the International Organisation of La Francophonie, aims to unite French-speaking initiatives worldwide and to support their joint projects. We were also part of the SIMODS consortium which published two reports on disinformation prevalence across major platforms based on data provided by us. With the support of Filigran, we also launched the CheckFirst Import Connector on OpenCTI, providing researchers with a ready-to-use dashboard to monitor articles from the Pravda network. 

Our commitment to cooperate with other stakeholders from the counter-disinformation community to foster online information integrity does not stop at documenting IMSs: it also implies protecting the most vulnerable, especially children. That is why we joined the Internet Watch Foundation as a member. This partnership has enabled us to undertake research on sensitive topics while preserving the dignity of children and ensuring the safety of our researchers.

We are still a remote-first company but enjoy meeting the rest of the community in person   by attending several forums all throughout the year. We had the opportunity to showcase our RADAR framework, which we updated in September 2025, during the #Disinfo2025 conference in Ljubljana, in October 2025. We also had the chance to attend other wonderful events in our field, such as the Protect NGO conference, the JRC Information Integrity Workshop, the Romania Imuna launch event and the Infox sur Seine conference, among many others. 

Last but not least: ObSINT (European Open Source Intelligence Organisations Observatory) officially became a Finnish NGO in July 2025! 

How can we help journalists in detecting FIMI? By immersing them in the journey.

Putting OSINT research at the core of our work, we are always keen on sharing our savoir-faire. That’s why we built Tutki, a specialised OSINT training platform designed to help organisations better understand foreign information manipulation and interference (FIMI) operations and strengthen themselves against information manipulation, foreign influence, and disinformation campaigns.

We had several opportunities to showcase Tutki to the public throughout the year. In September 2025, we used it during a training for Armenian civil society organisations and journalists that we conducted in partnership with the Folke Bernadotte Academy (FBA), the Swedish agency for peace, security and development. Later in 2026, we had three opportunities to train French journalists with Tutki: two of these sessions were in collaboration with the French training organisation Samsa, and the third was part of Advens’s Cyber for Good Media programme. 

Same goal, new team

This year, CheckFirst’s leadership changed. Hervé Letoqueux, formerly CheckFirst’s Chief Operating Officer, has officially succeeded Guillaume Kuster as CEO. We were also pleased to welcome back Nelly Pailleux, co-founder of CheckFirst, who has returned to the company as Chief Operating Officer. And to complete this exciting new chapter, Shivika Sharma has been appointed as our Chief Policy Officer.

This evolution hasn’t altered CheckFirst’s core mission: to empower its partners to navigate today’s complex online information ecosystem and equip decisionmakers with customisable solutions to combat online harms.

As we keep aiming at fulfilling our objectives, we would like to wholeheartedly thank you, our readers, for your support. Your trust pushes us to investigate more and develop new solutions to protect the integrity of the online information ecosystem.