What is the Doppelganger operation? List of resources

Doppelganger has mostly used the following tactics to disseminate its operation:

1. Content production

a) Clones of media websites

Most of Doppelganger’s public-facing operations consisted of developing websites impersonating established news organisations. Such impersonations have targeted Le Monde, The Guardian, Ansa, Der Spiegel, and Fox News. These impersonations were run through typosquatting on alternative domain names. The operations targeted specifically underrated registrars such as .ltd, .online, or .foo.

The stories, often written in poor language, were all aligned with the narratives described earlier. Content production also included the production of fake videos mimicking the graphic design of original outlets.

b) Clones of government websites

Similarly to what happened with established news organisations, Doppelganger impersonated public authorities and international organisations. The most known examples are an impersonation of the French Ministry of Foreign Affairs, the Interior Ministry of the German federal government or even NATO itself. The tactics to impersonate these stakeholders correspond to those mentioned in the previous section, with the use of typosquatting of legitimate domain names on alternative DNS registrars.

Content-wise, the campaign focused on announcing fake governmental measures, like the establishment of a tax to support Ukraine, the doubling of all military budgets or prevention campaigns against alleged imported Ukrainian criminality.

c) Anti-Ukrainian websites

Another part of the operation consisted of the development of anti-Ukrainian websites. This content specifically targeted Ukrainian President Volodymyr Zelensky through a series of animated cartoons. These cartoons depict the Ukrainian leader, his family and the Ukrainian government as corrupted, blindly obeying a made-up international conspiracy kabbal, and murdering his own citizens.

d) Pro-Russian websites

Additionally, the operation also consisted of the development and maintenance of pro-Russian websites. One of these websites, called ‘War On Fakes’, was established closely after the new invasion of Ukraine. Mimicking fact-checking content, it was designed to counter facts on the Ukrainian defence against this invasion.

Soon after, in the spring of 2022, another website called ‘RRN’ was set up, sharing the same infrastructure. Initially labelled as ‘Reliable Russian News’, it was renamed ‘Recent Reliable News’ without any explanation. This website, still active to this date, aligned with Russian propaganda narratives attacking the West on a regular basis.

This website also hosts content and video interviews of known pro-Russian Western stakeholders. A video interview of French MEP Thierry Mariani was removed from the website after France called out the Russian origin of RRN in June 2023.

e) Potential hybrid operations

Early November 2023,  blue Stars of David – a symbol that could be interpreted as either pro- or anti-Israeli – appeared on buildings in Paris, followed by images spreading fast on social media, fuelling controversy and confusion. The French state’s technical and operational service responsible for protection against foreign digital interference, VIGINUM, detected the involvement of a network of over a thousand bots on X, affiliated with RRN.

In its Q2 2024 Threat report, Meta exposed a distinct CIB network which claims to have been hired by Russian intelligence to “participate” in the Stars of David operation in Paris. This network, attributed to individuals formerly associated with other CIB networks of Russian Information Operations (most notably the Internet Research Agency), did participate in other hybrid operations in Moldova, Poland and France.

2. Distribution of disinformation

a) Amplification through comments of fake personas/accounts on Meta/X

One of the first distribution techniques of the Doppelganger operation has been the use of fake profiles on Meta. One avatar of this technique is what has been called the ‘German Odettes’, a network of profiles all named ‘Odette’ and allegedly working for Netflix. This network systematically pushed the Doppelganger content directly on the comment section of established Facebook pages. The technique was designed to directly engage with regular Facebook users with less exposure than an established asset like a Facebook page itself.

Part of the operation also used inauthentic distribution on X through networks of fake accounts. These accounts, operated in a coordinated way, pushed Doppelganger assets to their audience as well as replying to tweets in a similar modus operandi to the one seen on Meta.

b) Amplification on other platforms

Working documents from Struktura obtained by the Washington Post showed that Doppelganger operators have been weekly reporting on the operation’s performance. Dashboards show that narratives and engagement are monitored across platforms, including Facebook, YouTube, Telegram and TikTok.

Other artifacts/assets are visible on the German Ministry of Foreign Affairs report.

c) Buying ads with networks of fake Facebook pages

A constant tactic used by Doppelganger operators has been the use of the Meta advertisement platform. Through the use of thousands of Facebook pages, Doppelganger operations targeted Facebook users with the content they produced. Such amplification was made through ‘burner’ accounts, which are disposable assets used only for one advertisement and then abandoned.

d) Dissimulation/ OpSec

The operation has implemented specific operational security measures to obfuscate its nature. These included, for instance, geofencing, a setting that allows restricting content visibility for specific users. For instance, a French web user could not see the content restricted to German users.

The operation also used multiple redirection URLs to circumvent the restrictions set up by platforms like Meta on Doppelganger domain names. Part of this obfuscation infrastructure has been exposed.