Russia-linked ‘Doppelgänger’ social media operation rolls on, report says

Researchers have tracked more activity by an influence campaign linked to Russia that spreads disinformation and propaganda in the U.S., Germany and Ukraine through a vast network of social media accounts and fake websites.

The campaign, attributed to the Russia-linked influence operation network called Doppelgänger, has been active since at least May 2022. The U.S. tech company Meta previously referred to Doppelgänger as the “largest” and “most aggressively persistent” malign network sponsored by Russia.

Researchers from Recorded Future’s Insikt Group are currently tracking over 2,000 inauthentic social media accounts associated with Dopplegänger, but say the actual number could be even higher. The Record is an editorially independent unit of Recorded Future.

According to Insikt, the impact of Doppelgänger’s activity on users in Germany, Ukraine, and the U.S. is limited.

“Despite the campaign’s high volume, we did not identify any significant engagement from authentic social media users,” researchers said in a report published Tuesday. “Viewership and other engagement metrics — reshares, likes, and replies — were negligible across the network.”

And yet, Doppelgänger’s activity is worth paying attention to, researchers said, as its operators are constantly improving their tools and tactics and are “willing to invest in extra measures to evade detection.”

Meta warned last week that foreign groups are looking to expand their influence operations as 2024 is an important year for elections around the world.

Insikt did not specify which social media networks the Doppelgänger operation used.

Fake tales of decline

In the campaign analyzed by Insikt, Doppelgänger focused on three targets — Ukraine, Germany and the U.S.

In an operation against Ukraine, a Russia-linked threat actor created over 800 social media accounts that shared links to fake articles impersonating multiple reputable Ukrainian news organizations. These articles “spread narratives undermining Ukraine’s military strength, political stability, and international relationships with Ukraine’s Western allies.”

For example, some of them suggested that the U.S. prioritizes the war in Israel more than the one in Ukraine or sowed doubts about Ukraine’s ability to win the war.

In a campaign that targeted Germany and the U.S., a Russian network operator created fake news outlets producing propaganda content, which was then shared on social media, the researchers said.

Unlike impersonating existing Western news sources, as commonly seen with Doppelgänger so far, these outlets appear to be an attempt to create seemingly new and original sources, researchers said. “This evolving approach likely aims to establish a long-term influence network by evading detection efforts to identify inauthentic impersonators.”

The campaign’s goal in Germany was to share fake narratives of “Germany’s domestic decline due to migration, economic policies, and continued support for Ukraine,” Insikt said.

In the U.S., the threat actor promoted hostile articles criticizing the LGBTQ+ movement (which was recently outlawed in Russia) and raised doubts about U.S. military competence. One of the fake websites linked to Doppelgänger produced election-related content, which was likely generated by artificial intelligence (AI).

“This campaign likely intends to exploit US societal and political divisions ahead of the 2024 US election,” researchers said.

Kremlin-approved tactics

Influence operations like Doppelgänger are common tactics used by Russia as part of its information warfare.

Doppelgänger was previously linked to two Russian companies: Structura National Technologies and Social Design Agency, whose clients include several Russian government agencies, local government entities, state-owned enterprises and private companies.

Both companies were sanctioned by the European Union in August for their involvement in Doppelgänger.

In November, the U.S. government also linked these two entities to a disinformation campaign across Latin America aimed at undermining support for Ukraine and discrediting the U.S. and NATO.

In its previous campaigns, Doppelgänger also targeted the U.S. and seven European countries, with a specific focus on Germany and France. The network’s most common tactic is the impersonation of media outlets or political organizations, such as the French Ministry of Public Affairs, the German Ministry of the Interior, and the North Atlantic Treaty Organization (NATO).

The network’s evolution indicates that it can “have long-term societal impacts,” while the likely use of generative AI to create written content demonstrates “the evolving use of AI in Russian information warfare campaigns.”

“As the popularity of generative AI grows, malign influence actors, including Doppelgänger, will very likely increasingly leverage AI to produce scalable influence content,” researchers said.