2022–present

Doppelganger (also tracked as RRN)

Doppelganger is a long-running operation that publishes fabricated articles on websites built to look like established news outlets, and later like government ministries, using web addresses that differ from the real ones by a few characters. EU DisinfoLab and the Swedish forensics non-profit Qurium named it in September 2022 after German journalists at T-Online and Sueddeutsche Zeitung reported on forged versions of German news sites. The first report counted at least 17 cloned media brands, including Bild, 20 Minutes, ANSA, The Guardian and RBC Ukraine. Meta, reporting the same day, counted more than 60 impersonating sites. The French agency VIGINUM, which calls the campaign RRN after its hub site Reliable Recent News, later recorded 355 impersonating domain names registered between June 2022 and May 2023. The forged pages were promoted through paid advertisements and large numbers of short-lived fake social media accounts. The operation is notable less for what it achieved than for how often it was exposed and kept going anyway.

Attribution

The Russian companies Social Design Agency and Structura National Technologies, together with ANO Dialog, which the US Department of Justice says operated under the direction and control of the Russian Presidential Administration.

Attributed by: Meta (15 December 2022); VIGINUM, the French government agency for foreign digital interference (June 2023); the Council of the EU (sanctions, 28 July 2023); the US Treasury (sanctions, 20 March 2024); the US Department of Justice (seizure affidavit, 4 September 2024). The first public report, by EU DisinfoLab and Qurium (27 September 2022), declined to make a specific attribution.

Confidence, in their words: Graduated, and it hardened over time. EU DisinfoLab wrote that many elements were pointing towards the involvement of Russia-based actors but that it could not make a conclusive and specific attribution. Meta said its investigations linked the network to the two companies. VIGINUM reported several elements pointing to the involvement of Russian or Russian-speaking individuals and several Russian companies, and observed that entities affiliated with the Russian state took part in spreading some content. The US Treasury described a campaign carried out at the direction of the Russian Presidential Administration, and the Justice Department affidavit alleges direction and control by that administration. The affidavit is a sworn allegation supporting a seizure warrant, not a finding after trial.

Objective

According to VIGINUM, to undermine Western support for Ukraine, chiefly by spreading the idea that Western populations side with Russia, and also to persuade a Russian domestic audience that such support exists. EU DisinfoLab described three content goals: portraying Ukraine as failed, corrupt and Nazi; promoting Kremlin narratives about the war, including denial of the Bucha killings; and frightening German, Italian, French, Latvian and British readers about the cost of sanctions. The US Justice Department adds two later aims: bolstering pro-Russian policies and influencing voters in US and foreign elections, including the 2024 US presidential election.

Target audiences

  • Readers in Germany (described by Meta as the primary initial target), France, Italy, Ukraine, the United Kingdom and Latvia
  • From 2023, audiences in the United States and Israel, according to Meta
  • Voters in the United States and other countries ahead of 2024 elections, according to the US Justice Department
  • A domestic Russian audience, shown apparently Western articles as evidence that Western publics support Russia, according to VIGINUM

Timeline

  1. 24 February – April 2022
    VIGINUM dates the wider ecosystem to the first weeks of the full-scale invasion of Ukraine: the self-described fact-checking site War on Fakes launched on 24 February, the hub site Reliable Recent News was created on 10 March, and a related multilingual site was registered on 6 April. VIGINUM reports technical links between the hub and War on Fakes.
  2. May – August 2022
    Meta dates the start of the cloned-news activity on its platforms to May 2022. German outlets T-Online and Sueddeutsche Zeitung publish the first reporting on forged copies of German news sites, which becomes the lead for both EU DisinfoLab and Meta.
  3. 27 September 2022
    EU DisinfoLab and Qurium publish the report that gives the operation its name. The same day Meta announces the removal of 1,633 accounts, 703 Pages, one Group and 29 Instagram accounts, calling it the largest and most complex Russian-origin operation it had disrupted since the war began.
  4. 15 December 2022
    Meta updates its report to link the network to two Russian companies, Structura National Technologies and Social Design Agency. This is the first public attribution to named entities.
  5. Early 2023 – June 2023
    VIGINUM observes the campaign changing its behaviour on Facebook after the takedowns, and detects more than 160 Pages carrying more than 600 sponsored items. From late May 2023 the operation impersonates the French foreign ministry website to publish a forged document announcing a supposed security tax for Ukraine. VIGINUM releases its technical report in June.
  6. 28 July 2023
    The Council of the EU imposes sanctions on seven individuals and five entities over the campaign, including Social Design Agency, Structura and ANO Dialog.
  7. August 2023
    Meta reports that it has blocked thousands of the operation's domains, describes Doppelganger as the largest and most aggressively persistent Russian-origin operation it has taken down since 2017, and says targeting has widened to the United States and Israel.
  8. 20 March 2024
    The US Treasury sanctions Social Design Agency, Structura, and the two men who run them, describing a network of over 60 websites impersonating legitimate news organisations.
  9. 4 September 2024
    The US Justice Department announces the seizure of 32 internet domains, relying on US money laundering and criminal trademark law, and releases an affidavit that reproduces internal planning documents attributed to the operators.
  10. September 2024
    A separate leak of internal Social Design Agency files reaches Sueddeutsche Zeitung and partner newsrooms. Thomas Rid's analysis of the files in Foreign Affairs argues that the company inflated its results to its paymasters and treated Western press coverage of itself as a success.

Channels

  • Look-alike web domains copying the design of real news outlets and, later, government ministries
  • Purpose-built sites with no real-world counterpart, including the hub site Reliable Recent News and French-language sites with French-sounding names
  • Paid advertisements on Facebook and Instagram
  • Single-use fake Facebook accounts and Pages
  • Automated accounts posting links in replies on Twitter (now X)
  • A Telegram channel and a website supplying political cartoons
  • Official Russian diplomatic and cultural accounts, which VIGINUM observed sharing some of the material

Techniques

Typosquatting Domains

The core of the operation. VIGINUM recorded 355 domain names registered between June 2022 and May 2023 that imitated media outlets in France and nine other states. In France the affected titles were 20 Minutes, Le Monde, Le Parisien and Le Figaro, with at least 49 forged articles presented as coming from Le Parisien alone.

Halo Effect

The forged pages reproduced the mastheads, layout and bylines of trusted outlets so that a reader's existing trust in the brand transferred to text the brand never published. The argument on the page mattered less than the logo above it.

Leak Forgery

From late May 2023 the operators imitated the French foreign ministry's web address to publish a false official document stating that France had introduced a security tax to fund Ukraine. VIGINUM reports the same approach was used against another country's interior ministry, with a forged announcement of compulsory refugee hosting.

Coordinated Inauthentic Behavior

Meta removed 1,633 accounts and 703 Pages in the first takedown. VIGINUM describes a group of almost 200 Facebook accounts created to publish a single sponsored post each, many named Open Opinion and using outlet logos or AI-generated faces as profile pictures.

Bot Amplification

From the end of May 2023 VIGINUM observed a network of automated Twitter accounts posting links to campaign sites in the replies beneath posts by European media outlets and political figures.

Fear Mongering

A large share of the content warned European readers that sanctions on Russia would wreck their own living standards. VIGINUM also documents a false claim that a radioactive cloud was heading for France because the United Kingdom had supplied depleted-uranium shells to Ukraine.

Wedge Issues

Two of the four themes VIGINUM identifies were chosen for their capacity to divide host societies: the domestic cost of sanctions and the supposed harms of hosting Ukrainian refugees. The French-named sites created in February 2023 published polarising articles about French and European politics rather than about Russia.

Bandwagon Effect

VIGINUM identifies the central narrative as the claim that Western populations already support Russia. Forged articles under Western mastheads served as the apparent proof, including for readers inside Russia, where state media re-shared some of the items.

Fake Fact-Check

VIGINUM found technical links between the campaign's hub site and War on Fakes, a multilingual site that presents itself as a fact-checker and is used to deny accusations of Russian war crimes. VIGINUM notes it was promoted by the Russian diplomatic network.

Meme Warfare

VIGINUM reports constant use of satirical cartoons hostile to Western governments, sourced mainly from one Telegram channel created in April 2022 and a Russian-hosted website. Nine official Russian Houses pages on Facebook distributed cartoons from one of the campaign sites.

Actors, behaviors, content

Actors. Commercial contractors rather than intelligence officers at the keyboard: a political consultancy and an IT firm in Moscow, which VIGINUM notes provide services to Russian government institutions, plus the non-profit ANO Dialog. The US Treasury and Justice Department place them under the direction of the Russian Presidential Administration. VIGINUM separately observed official Russian embassy and cultural-centre accounts amplifying some material.

Behaviors. Impersonation at scale: look-alike domains, fake accounts built to be used once and discarded, paid advertising, and links that redirect several times before reaching their destination, which VIGINUM says was designed to conceal the wider infrastructure. The defining behaviour is persistence. The operators rebuilt after each takedown rather than trying to avoid detection.

Content. Fabricated news articles, forged government documents, videos, polls and cartoons in English, French, German, Italian, Spanish, Russian and Ukrainian. VIGINUM groups the material into four themes: sanctions hurt Europe more than Russia; the West is Russophobic; Ukrainian forces are barbaric and Ukrainian leaders neo-Nazi; and Ukrainian refugees harm host countries.

Did it work? What is actually known

The best available evidence points to large output and small authentic uptake. In its first takedown Meta reported about 4,000 accounts following one or more of the 703 Pages, fewer than ten accounts in the Group, about 1,500 followers across the Instagram accounts, and roughly 105,000 US dollars in advertising spend. Meta also said most of the accounts, Pages and ads were caught by automated systems before its investigation began. EU DisinfoLab wrote that publicly available data raised doubts about the success of the operation. Those figures cover one platform at one moment and say nothing about how many people saw an advertisement, clicked through, or believed what they read. Nobody has published a study measuring any change in public attitudes toward Ukraine attributable to Doppelganger, so its effect on opinion is unknown. Thomas Rid's reading of the leaked company files is that the operators overstated their impact to their funders and that the biggest boost they received came from alarmed Western coverage. The documented costs are of a different kind: real newsrooms and ministries had their identities misused, platforms and governments spent years on removal, and VIGINUM judged the campaign a threat to the fundamental interests of the nation on the basis of its methods and aims rather than any measured outcome.

How it was caught

Journalists caught it first. Reporters at T-Online and Sueddeutsche Zeitung noticed forged copies of German news sites in mid-2022. EU DisinfoLab and Qurium then mapped the network using open sources: Meta's public Ad Library, the CrowdTangle tool and domain registration and hosting data. Meta says it opened its own investigation after reading the German reporting, and credits the Digital Forensic Research Lab with further insight. VIGINUM traced domain registrations to named Russian individuals and companies through open-source research. The 2024 US affidavit added what outside researchers could not see: records obtained through legal process and internal planning documents. At each stage the tell was mundane. A web address was slightly wrong, the same advertisement template recurred, or accounts existed for a single post.

Lessons

  • »Read the address bar before the masthead. Every forged article in this operation sat on a domain that differed from the real outlet's by a few characters or an unusual ending. A familiar logo proves nothing about who published a page.
  • »If a surprising story appears to come from a major outlet, go to that outlet directly by typing its address or using a saved bookmark. If the story is not there, it was not published by them.
  • »Paid reach is not popularity. An advertisement in a feed says only that someone paid to put it there. The same applies to official-looking documents that arrive through a sponsored post rather than through the institution's own site.
  • »Exposure does not end an operation. Doppelganger was publicly named in September 2022 and was still the subject of enforcement action two years later. Removal of accounts is maintenance, not a cure, and should be judged that way.
  • »Coverage can be the payload. Analysts who read the leaked company files argue that the operators counted Western alarm as a result. Reporting an operation's output without reporting its meagre engagement can do its publicity work for it.
  • »Open tools made the first exposure possible. The initial investigation relied on a public advertising archive and a public engagement-tracking tool. When platforms withdraw such tools, this kind of independent detection becomes harder.

Still contested

  • How much it mattered. Platform engagement data and the leaked internal files both suggest limited authentic reach, while several governments have treated the campaign as a serious threat warranting sanctions. These positions are not strictly contradictory, since one is about measured outcomes and the other about intent and method, but they lead to different views on how much public attention the operation deserves.
  • Whether publicity helps or harms. Rid argues that anxious coverage was the campaign's greatest gain. Others, including the agencies that published detailed reports, hold that public attribution is necessary for sanctions, domain seizures and public awareness. There is no agreed way to weigh the two.
  • The degree of state direction. EU DisinfoLab would not attribute at all in 2022 and said it could not entirely exclude a false-flag explanation. Meta attributed to two companies, not to a government. The US government alleges direction by the Russian Presidential Administration, relying partly on documents that have been described in an affidavit but not tested in an adversarial trial.
  • Where Doppelganger ends. VIGINUM's RRN label covers cloned sites, original sites, cartoons and a self-described fact-checker. Other researchers use Doppelganger only for the cloned domains. Counts of sites and accounts differ between reports partly for this reason and should not be compared directly.
  • The legal route. The 2024 seizures rested on trademark and money laundering law rather than on any offence of spreading falsehoods. Whether that is a durable tool or a one-off fit to this operation's reliance on cloned brands is an open question.

Sources

  1. EU DisinfoLab and Qurium, Doppelganger: Media clones serving Russian propaganda (27 September 2022)
    The name, the first public description, at least 17 cloned media brands, the three content goals, the German press leads, the open-source methods, the refusal to make a conclusive attribution, and the doubt about the operation's success.
  2. Meta, Removing Coordinated Inauthentic Behavior From China and Russia (27 September 2022)
    Start date of May 2022, more than 60 impersonating websites, the languages used, the target countries, the role of German investigative reporting and DFRLab, automated removal of most assets, and (in the attached report) follower counts and advertising spend.
  3. Meta, Adversarial Threat Report, Third Quarter 2022 (with 15 December 2022 update)
    Counts of removed accounts and Pages and the attribution to Structura National Technologies and Social Design Agency.
  4. NPR, Facebook takes down Russian network impersonating European news outlets (27 September 2022)
    Independent press account of the first takedown, the outlets impersonated and Meta's characterisation of the network.
  5. VIGINUM (SGDSN, French government), RRN: A complex and persistent information manipulation campaign, summary (June 2023; English edition 19 July 2023)
    The 355 domains, the French outlets affected and forged-article counts, the forged foreign ministry document, single-use accounts, 160 Pages and 600 sponsored items, Twitter reply bots, the four themes, the dual foreign and domestic objective, links to War on Fakes, cartoons, amplification by Russian diplomatic accounts, and the attribution language.
  6. Meta, Raising Online Defenses Through Transparency and Collaboration (Q2 2023 Adversarial Threat Report, 29 August 2023)
    Thousands of domains blocked, the description as the largest and most aggressively persistent Russian-origin operation since 2017, and expansion to the United States and Israel.
  7. Council of the EU, Information manipulation in Russia's war of aggression against Ukraine: EU lists seven individuals and five entities (28 July 2023)
    EU sanctions over the RRN campaign, including on Social Design Agency, Structura and ANO Dialog.
  8. US Department of the Treasury, Treasury Sanctions Actors Supporting Kremlin-Directed Malign Influence Efforts (20 March 2024)
    US sanctions on Social Design Agency, Structura and the two men who run them, and the statement that the campaign was carried out at the direction of the Russian Presidential Administration.
  9. US Department of Justice, Justice Department Disrupts Covert Russian Government-Sponsored Foreign Malign Influence Operation (4 September 2024), with linked affidavit
    Seizure of 32 domains, the legal basis in money laundering and trademark law, the allegation of direction and control by the Russian Presidential Administration, the aims concerning Ukraine and elections, and the use of influencers, paid and AI-assisted advertisements and fake profiles.
  10. Thomas Rid, The Lies Russia Tells Itself, Foreign Affairs (30 September 2024)
    Analysis of the leaked Social Design Agency files: inflated internal claims of impact and the argument that Western coverage was the campaign's largest gain.
Last reviewed Suggest a correction