For those who may not know:
Doppelganger is the name given for a Russian disinformation campaign established in 2022. It targets Ukraine, Germany, France and the United States, with the aim of undermining support for Ukraine in Russia's invasion of the country.
Here is the report (pdf)
- The campaign employs domain cloning and typosquatting techniques to create websites that impersonate legitimate European media entities. These inauthentic sites, which steal credibility from real media entities, are used to disseminate fabricated content designed to exploit political polarisation, promote Euroscepticism, and undermine specific political entities and governments while purportedly supporting others.
- The narratives employed by the Doppelganger campaign are tailored to specific countries, reflecting the campaign’s strategic approach and goals.
- For instance, content targeting France focusses predominantly on migration and the war in Ukraine, while content aimed at Germany emphasises energy and climate issues along with the war in Ukraine. In Poland, narratives centre on Ukrainian refugees, the war in Ukraine, and migration, whereas Spanish-language content similarly utilises narratives related to the war in Ukraine.
- Pro-Kremlin disinformers attempt to smear leaders; sow distrust, doubt, and division; flood social media and information space with falsehoods; drag everyone down into the mud with them, and finally, end up dismissing the results.
Sophisticated tactics
The Doppelganger campaign utilises a sophisticated, multi-stage approach to amplify its disinformation efforts. We have identified four key stages in the coordinated amplification process, illustrated below in an example from the X platform.
- Content posting: a group of inauthentic accounts, referred to as ‘posters,’ initiates the dissemination process by publishing original posts on their timelines. These posts typically include a text caption, a web link directing users to the Doppelganger’s outlets, and an image representing the article’s thumbnail.
- Amplification via quote posts: a larger group of inauthentic accounts, called ‘amplifiers,’ then reposts the links of the original posts without adding any additional text. This amplification method, known as ‘Invisible Ink(opens in a new tab)’, uses standard platform features to inauthentically boost the content’s visibility and potential impact on the target audience.
- Amplification via comments: amplifier accounts further boost the reach of the FIMI content by resharing the posts as comments on the timelines of users with large followings. This strategy aims to expose the content to the followers of authentic accounts, increasing its penetration within new audiences.
- Dissemination via deceptive URL redirection: to evade platform restrictions on posting web links to blacklisted domains, the network employs a multi-stage URL redirection technique. Inauthentic accounts post links that redirect users through several intermediary websites before reaching the final destination – an article published on a Doppelganger campaign website. This complex redirection chain, managed with meticulous infrastructure practices, demonstrates the network’s determination to operate uninterrupted while monitoring the effectiveness of its influence operations.
Our democratic processes under fire
The Doppelganger campaign underscores the persistent threat posed by foreign actors who utilise FIMI and inauthentic websites to interfere in democratic processes across Europe.
An in-depth analysis of 657 articles published by a sample of 20 inauthentic news sites associated with the Doppelganger campaign revealed a steady increase in election-related content as the elections approached.
Two weeks before the elections, 65 articles published by the network were directly related to the elections, and this number rose to 103 articles in the final week. The primary targets of this election-focussed activity were France and Germany, with additional articles published in Polish and Spanish.
Although the full impact of this campaign is challenging to measure, our findings indicate that the Doppelganger campaign did not cause significant disruption to the normal functioning of the electoral process or pose a substantial threat to the voting process. However, the persistent nature of the Doppelganger operation highlights the need for continuous vigilance and robust countermeasures to protect the integrity of our democratic processes.