Security researchers have uncovered a sophisticated Russian disinformation campaign that has been actively challenging the credibility of journalists and fact-checkers since May 2022. This campaign, leveraging X (formerly Twitter), disseminates disinformation articles while engaging in commenting and sharing activities to provoke further investigation.

This is the latest in a series of cyber influence campaigns dubbed “DoppelGänger” attributed to Russian entities Structura National Technologies (Structura) and the Social Design Agency (SDA). This campaign is part of a long history of Russian cyber influence efforts, including InfoRos (2000-2014), Secondary Infektion (since 2014), DoppelGänger/RRN (since 2022), and more recently, Portal Kombat (2023).

The primary objective of the DoppelGänger campaign is to lessen support for Ukraine amidst Russian aggression and to foster divisions within nations that support Ukraine. The campaign has targeted audiences in France, Germany, Ukraine, the United States, and several other countries including the United Kingdom, Lithuania, Switzerland, Slovakia, and Italy. In recent months, disinformation narratives have also targeted Israel, primarily aiming to undermine the United States due to its alliance with Tel Aviv.

Operating under the alias “Recent Reliable News”" (RRN), the DoppelGänger campaign utilizes a variety of content formats, including articles, videos, and caricatures in multiple languages such as English, German, French, Hebrew, and Ukrainian. The narratives promoted by this campaign are designed to sow doubts among Western populations about supporting Ukraine, emphasizing the potential negative impacts on their own living conditions. Additionally, the campaign aims to erode confidence in institutions by amplifying criticism of government decisions and exploiting political, societal, and religious divisions.

The DoppelGänger campaign employs a network of websites, including typosquatted legitimate media outlets and independent news sites, to publish disinformation articles. These articles are then disseminated and amplified through inauthentic social media accounts across various platforms, particularly video-hosting sites like Instagram, TikTok, Cameo, and YouTube.

Despite the significant resources invested, the impact of the campaign has been limited, with minimal engagement from authentic users on social media and disinformation articles, the Sekoia researchers noted in their report.

Researchers have identified a correlation between the number of articles published per country and significant events such as domestic protests, decisions on Ukraine military aid, Russian sanctions, and national budget voting periods. The disinformation dissemination process involves a three-stage redirection mechanism, utilizing thumbnail metadata, an obfuscated JavaScript script, and a monitoring tool called Keitaro to track campaign effectiveness.

Sekoia analysts said they uncovered a new cluster associated with this campaign, managed through a control panel that oversees multiple disinformation websites, primarily publishing content in Russian. This indicates a potential shift in objectives, suggesting that Structura and SDA may also be responsible for Russian-speaking propaganda missions on behalf of the Russian government.