{"id":4422,"date":"2025-12-04T11:07:32","date_gmt":"2025-12-04T08:07:32","guid":{"rendered":"https:\/\/factcheck.lt\/?p=4422"},"modified":"2025-12-10T14:01:45","modified_gmt":"2025-12-10T11:01:45","slug":"day4_doppelganger","status":"publish","type":"post","link":"https:\/\/factcheck.lt\/eng\/news\/day4_doppelganger\/","title":{"rendered":"Day 4: Doppelganger \u2014 Cloning the Media","raw":"Day 4: Doppelganger \u2014 Cloning the Media"},"content":{"rendered":"

When fake news wears a familiar face<\/strong><\/p>\n

In September 2022, researchers at EU DisinfoLab uncovered something unsettling: a network of websites that looked exactly like Europe’s most trusted newspapers \u2014 but weren’t. The sites had the same logos, the same layouts, the same fonts. Only the domain names were slightly different. And the articles they published were pure Kremlin propaganda.<\/p>\n

The researchers called it “Doppelganger” \u2014 German for “double.” It would become one of the most sophisticated and persistent Russian information operations ever documented.<\/p>\n

The mechanics of media cloning<\/strong><\/p>\n

The concept was deceptively simple. Russian operatives purchased domain names that closely resembled legitimate news outlets. Instead of spiegel.de, they registered spiegel.ltd. Instead of washingtonpost.com, they created washingtonpost.pm. The visual design was copied precisely \u2014 same colors, same typography, same navigation menus. Many pages even contained links to real articles on the authentic sites, making the deception harder to detect.<\/p>\n

By the time investigators mapped the operation, at least 17 major media outlets had been impersonated: Germany’s Bild, Der Spiegel, S\u00fcddeutsche Zeitung, Die Welt, Frankfurter Allgemeine Zeitung, and Der Tagesspiegel; France’s Le Monde, Le Figaro, Le Parisien, and 20 Minutes; Italy’s Ansa; the UK’s Guardian; Poland’s Polityka and Polskie Radio; Ukraine’s RBC Ukraine and UNIAN; and in the United States, Fox News and The Washington Post.<\/p>\n

The fake articles weren’t subtle. They depicted Ukraine as corrupt and Nazi-affiliated. They denied the Bucha massacre. They claimed Western military aid was being stolen. They warned that supporting Ukraine would bankrupt European economies. One fake Le Monde article carried the headline: “French Minister supports the murder of Russian soldiers in Ukraine.”<\/p>\n

The operation also targeted government websites. Fake versions of NATO’s website (nato.ws) published fabricated press releases about doubled military budgets. Clones of Germany’s Interior Ministry and France’s Foreign Ministry spread false policy announcements.<\/p>\n

Who was behind it<\/strong><\/p>\n

U.S. and European investigators traced Doppelganger to a constellation of Russian companies operating under Kremlin direction. The Social Design Agency (SDA), led by Ilya Gambashidze, and Structura National Technologies, founded by Nikolai Tupikin, were identified as the primary operators. A nonprofit called ANO Dialog provided AI-enhanced tools for generating content.<\/p>\n

But the chain of command reached higher. According to a 277-page FBI affidavit unsealed in September 2024, the operation was overseen by Sergei Kiriyenko \u2014 First Deputy Chief of Staff of the Russian Presidential Administration and, as the U.S. Treasury described him, “Putin’s right-hand man” and domestic policy curator.<\/p>\n

Internal documents obtained by investigators showed regular communication between the operators and Kremlin representatives. Weekly reports tracked the campaign’s performance across platforms \u2014 Facebook, YouTube, Telegram, TikTok. Dashboards monitored which narratives were gaining traction and which needed adjustment.<\/p>\n

The amplification machine<\/strong><\/p>\n

Creating fake websites was only half the operation. The content needed to reach real audiences. Doppelganger operators deployed several techniques:<\/p>\n

Bot networks.<\/strong> Hundreds of fake social media accounts \u2014 posing as Americans, Germans, French, and others \u2014 shared links to the cloned websites. These accounts posted comments, engaged in debates, and gradually built audiences. On X (formerly Twitter), researchers tracked over 800 accounts dedicated to promoting fake Ukrainian news articles alone.<\/p>\n

Paid advertising.<\/strong> The operators purchased Facebook ads targeting French and German users with messages about Ukraine aid, farmers’ protests, and the Gaza war. AI Forensics, a nonprofit tracking online manipulation, found the ads reached five to ten times more people than initially estimated.<\/p>\n

Cloaking.<\/strong> To evade platform moderation, Doppelganger used a technique borrowed from cybercriminals. Links shared on social media didn’t lead directly to the fake news sites. Instead, users were routed through disposable domains with innocuous names like “radilwanised.shop” or “climzenante.shop.” The system detected which users were likely targets (based on location and other factors) and only then redirected them to the propaganda content. Content moderators at X or Facebook saw only harmless landing pages.<\/p>\n

Celebrity exploitation.<\/strong> In November 2023, researchers found Facebook ads featuring fabricated pro-Russian quotes attributed to Taylor Swift, Beyonc\u00e9, Justin Bieber, and other celebrities. The ads were designed to suggest that popular Western figures secretly supported Russian positions.<\/p>\n

The Paris Stars of David<\/strong><\/p>\n

One Doppelganger operation crossed from the digital realm into physical space. In late October 2023, blue Stars of David began appearing on buildings across Paris \u2014 stenciled graffiti immediately condemned as antisemitic. The imagery evoked Nazi persecution.<\/p>\n

French authorities traced the graffiti to a Moldovan couple recruited by Anatolii Prizenko, a pro-Russian Moldovan businessman. The operation was designed to sow division and inflame tensions \u2014 and then be amplified by Russian media to portray France as hostile to Jews. On November 9, 2023, France officially blamed the Doppelganger network for orchestrating the incident.<\/p>\n

Resilience of the operation<\/strong><\/p>\n

Despite being exposed, Doppelganger refused to die. The EU sanctioned Social Design Agency, Structura, and key individuals in July 2023. The U.S. Treasury added them to its sanctions list in March 2024. In September 2024, the U.S. Justice Department seized 32 domains \u2014 and within days, the operators registered new ones through a German company (1API GmbH), which shut them down only after journalists alerted them.<\/p>\n

The technical infrastructure kept shifting. When German hosting company Hetzner blocked Doppelganger accounts, the operation moved elsewhere. When Estonian software company Apliteni discovered its Keitaro redirect tool was being abused, it revoked the licenses \u2014 but the operators simply found alternatives. A bulletproof hosting provider called AEZA, despite having founders prosecuted for running a darknet drug marketplace, continued providing infrastructure until it was sanctioned by the U.S., UK, and Australia in November 2025.<\/p>\n

Researchers found that IP addresses accessing Doppelganger’s infrastructure included those belonging to Voentelekom \u2014 a telecommunications company founded by the Russian government and operating under the Ministry of Defense. The digital fingerprints led directly to the Russian state.<\/p>\n

The AI evolution<\/strong><\/p>\n

As the operation matured, it incorporated artificial intelligence. In May 2024, OpenAI announced it had removed accounts used by Doppelganger for influence operations. A related network called CopyCop registered over a hundred websites in a single month, all featuring AI-generated journalist personas \u2014 slight variations of real conservative American media personalities.<\/p>\n

The economics were compelling. As one researcher noted, “Prigozhin’s bot farm no longer has to cram rows of desktops in a dusty Saint Petersburg factory when AI can do the work of a full team of trolls from a single device.” The cost-per-influence had dropped dramatically.<\/p>\n

Lessons from Doppelganger<\/strong><\/p>\n

Trust is hackable.<\/strong> Doppelganger exploited the visual language of credibility \u2014 familiar logos, professional design, legitimate-looking domains \u2014 to launder propaganda through the appearance of journalism. Readers who saw “spiegel.ltd” didn’t always notice it wasn’t “spiegel.de.”<\/p>\n

The domain system is vulnerable.<\/strong> Nothing prevented Russian operatives from purchasing domains that mimicked trusted brands. EU DisinfoLab called for better regulation of the domain name industry to protect legitimate actors from impersonation.<\/p>\n

Sanctions have limits.<\/strong> Despite EU and U.S. sanctions, the operation continued for years. Operators simply moved between hosting providers, payment processors, and domain registrars \u2014 often within Europe itself.<\/p>\n

Platform responses remain inadequate.<\/strong> Facebook and X struggled to keep up with cloaking techniques, disposable domains, and bot networks. The operators were consistently one step ahead.<\/p>\n

Attribution doesn’t equal deterrence.<\/strong> Even after Kiriyenko was publicly named as the overseer, even after internal documents were leaked, even after companies and individuals were sanctioned \u2014 Doppelganger adapted and persisted. The Kremlin calculated that the benefits outweighed the costs.<\/p>\n

Doppelganger represents a new category of information warfare: the industrial-scale impersonation of trusted institutions. In an environment where anyone can clone a website in minutes, the authenticity of news itself becomes a casualty.<\/p>\n

Sources:<\/strong><\/p>\n