Researchers have tracked more activity by an influence campaign linked to Russia that spreads disinformation and propaganda in the US, Germany and Ukraine through a vast network of social media accounts and fake websites.
The campaign, attributed to the Russia-linked influence operation network called Doppelgänger, has been active since at least May 2022. The US tech company Meta previously referred to Doppelgänger as the “largest” and “most aggressively persistent” malign network sponsored by Russia.[1]
Researchers are currently tracking over 2,000 inauthentic social media accounts associated with Dopplegänger, but say the actual number could be even higher. According to Insikt, the impact of Doppelgänger's activity on users in Germany, Ukraine, and the US is limited. “Despite the campaign’s high volume, we did not identify any significant engagement from authentic social media users,” researchers said in a report published earlier this week. “Viewership and other engagement metrics reshares, likes, and replies were negligible across the network.”
And yet, Doppelgänger’s activity is worth paying attention to, researchers said, as its operators are constantly improving their tools and tactics and are “willing to invest in extra measures to evade detection.” Meta warned last week that foreign groups are looking to expand their influence operations as 2024 is an important year for elections around the world. Insikt did not specify which social media networks the Doppelgänger operation used.
Fake tales of decline - In the campaign analyzed by Insikt, Doppelgänger focused on three targets: Ukraine, Germany and the US. In an operation against Ukraine, a Russia-linked threat actor created over 800 social media accounts that shared links to fake articles impersonating multiple reputable Ukrainian news organizations. These articles “spread narratives undermining Ukraine’s military strength, political stability, and international relationships with Ukraine’s Western allies.” For example, some of them suggested that the US prioritizes the war in Israel more than the one in Ukraine or sowed doubts about Ukraine’s ability to win the war.
In a campaign that targeted Germany and the US, a Russian network operator created fake news outlets producing propaganda content, which was then shared on social media, the researchers said.
Unlike impersonating existing Western news sources, as commonly seen with Doppelgänger so far, these outlets appear to be an attempt to create seemingly new and original sources, researchers said. “This evolving approach likely aims to establish a long-term influence network by evading detection efforts to identify inauthentic impersonators.”
The campaign’s goal in Germany was to share fake narratives of “Germany’s domestic decline due to migration, economic policies, and continued support for Ukraine,” Insikt said.
In the US, the threat actor promoted hostile articles criticizing the LGBTQ+ movement (which was recently outlawed in Russia) and raised doubts about U.S. military competence. One of the fake websites linked to Doppelgänger produced election-related content, which was likely generated by artificial intelligence (AI). “This campaign likely intends to exploit US societal and political divisions ahead of the 2024 US election,” researchers said.
Kremlin-approved tactics - Influence operations like Doppelgänger are common tactics used by Russia as part of its information warfare.
Doppelgänger was previously linked to two Russian companies: Structura National Technologies and Social Design Agency, whose clients include several Russian government agencies, local government entities, state-owned enterprises and private companies. Both companies were sanctioned by the European Union in August for their involvement in Doppelgänger.
In November, the US government also linked these two entities to a disinformation campaign across Latin America aimed at undermining support for Ukraine and discrediting the US and NATO.
In its previous campaigns, Doppelgänger also targeted the US and seven European countries, with a specific focus on Germany and France. The network’s most common tactic is the impersonation of media outlets or political organizations, such as the French Ministry of Public Affairs, the German Ministry of the Interior, and the North Atlantic Treaty Organization (NATO).
The network’s evolution indicates that it can “have long-term societal impacts,” while the likely use of generative AI to create written content demonstrates “the evolving use of AI in Russian information warfare campaigns. As the popularity of generative AI grows, malign influence actors, including Doppelgänger, will very likely increasingly leverage AI to produce scalable influence content,” researchers said.
This article is presented at no charge for educational and informational purposes only.
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. We can help provide cyber insurance through Cysurance. Call for assistance. For questions, comments, a demo or assistance, please contact the office directly at 1-844-492-7225, or feedback@redskyalliance.com
Weekly Cyber Intelligence Briefings:
Reporting: https://www.redskyalliance.org/
Website: https://www.redskyalliance.com/
LinkedIn: https://www.linkedin.com/company/64265941
Weekly Cyber Intelligence Briefings:
REDSHORTS - Weekly Cyber Intelligence Briefings
https://attendee.gotowebinar.com/register/5993554863383553632
[1] https://therecord.media/doppelganger-influence-operation-new-activity/
Comments