The pro-Kremlin Doppelganger campaign continued its copycatting and reality-distorting activities during the European Parliament elections.
Today, the European External Action Service (EEAS) released a report entitled, ‘Doppelganger Strikes Back: FIMI Activities in the Context of the EE24’, as a continuation of our previous coverage of the pro-Kremlin foreign information manipulation and interference (FIMI) ecosystem’s activities.
This latest report provides a comprehensive analysis of the pro-Kremlin FIMI campaign that targeted the 2024 European Parliament elections. The findings uncover the advanced tactics employed by the Doppelganger operation, which we covered earlier here and here, shedding light on the persistent threat posed by foreign actors seeking to undermine democratic processes in Europe.
Our previous features covering the EEAS’s work to counter foreign information manipulation and interference (FIMI) threats include the recent Operation False Façade exposé, the first EEAS report on FIMI threats, and the second FIMI report underlining the need to build a collective response to FIMI.
The Doppelganger campaign: a persistent threat
First reported by EU Disinfo Lab in back in September 2022, the Doppelganger campaign is a multifaceted FIMI operation originating from Russia.
The Doppelganger campaign’s primary objectives are to manipulate public opinion, erode support for Ukraine, sow division among countries that support Ukraine, exploit political and social vulnerabilities, and promote Russian narratives.
The campaign achieves these goals by disseminating disinformation through convincing clones of legitimate media and government websites, along with inauthentic news outlets. This content is then amplified on social media platforms, such as X and Facebook, to maximise its reach and impact.
Over the years, the Doppelganger / RRN Media campaign has demonstrated itself to be a persistent threat, continuously evolving its tactics and expanding its reach.
Impersonation of credible news media and key narratives
The campaign employs domain cloning and typosquatting techniques to create websites that impersonate legitimate European media entities.
These inauthentic sites, which steal credibility from real media entities, are used to disseminate fabricated content designed to exploit political polarisation, promote Euroscepticism, and undermine specific political entities and governments while purportedly supporting others.
The narratives employed by the Doppelganger campaign are tailored to specific countries, reflecting the campaign’s strategic approach and goals. For instance, content targeting France focusses predominantly on migration and the war in Ukraine, while content aimed at Germany emphasises energy and climate issues along with the war in Ukraine. In Poland, narratives centre on Ukrainian refugees, the war in Ukraine, and migration, whereas Spanish-language content similarly utilises narratives related to the war in Ukraine.
Examples of fabricated content on cloned domains.
The Doppelganger campaign’s infrastructure consists of domains mimicking well-known media outlets such as Die Welt, Le Point, Le Parisien, La Stampa, La Repubblica, Polityka, and Polskie Radio. The cloned domains were registered between January and May 2024, just months before the elections in June 2024.
Sophisticated tactics
The Doppelganger campaign utilises a sophisticated, multi-stage approach to amplify its disinformation efforts. We have identified four key stages in the coordinated amplification process, illustrated below in an example from the X platform.
Content posting: a group of inauthentic accounts, referred to as ‘posters,’ initiates the dissemination process by publishing original posts on their timelines. These posts typically include a text caption, a web link directing users to the Doppelganger’s outlets, and an image representing the article’s thumbnail.
Amplification via quote posts: a larger group of inauthentic accounts, called ‘amplifiers,’ then reposts the links of the original posts without adding any additional text. This amplification method, known as 'Invisible Ink', uses standard platform features to inauthentically boost the content’s visibility and potential impact on the target audience.
Amplification via comments: amplifier accounts further boost the reach of the FIMI content by resharing the posts as comments on the timelines of users with large followings. This strategy aims to expose the content to the followers of authentic accounts, increasing its penetration within new audiences.
Dissemination via deceptive URL redirection: to evade platform restrictions on posting web links to blacklisted domains, the network employs a multi-stage URL redirection technique. Inauthentic accounts post links that redirect users through several intermediary websites before reaching the final destination – an article published on a Doppelganger campaign website. This complex redirection chain, managed with meticulous infrastructure practices, demonstrates the network’s determination to operate uninterrupted while monitoring the effectiveness of its influence operations.
An example of an inauthentic post amplified in the comments section by another inauthentic account.
Our democratic processes under fire
The Doppelganger campaign underscores the persistent threat posed by foreign actors who utilise FIMI and inauthentic websites to interfere in democratic processes across Europe.
An in-depth analysis of 657 articles published by a sample of 20 inauthentic news sites associated with the Doppelganger campaign revealed a steady increase in election-related content as the elections approached.
Two weeks before the elections, 65 articles published by the network were directly related to the elections, and this number rose to 103 articles in the final week. The primary targets of this election-focussed activity were France and Germany, with additional articles published in Polish and Spanish.
Although the full impact of this campaign is challenging to measure, our findings indicate that the Doppelganger campaign did not cause significant disruption to the normal functioning of the electoral process or pose a substantial threat to the voting process. However, the persistent nature of the Doppelganger operation highlights the need for continuous vigilance and robust countermeasures to protect the integrity of our democratic processes.
Beyond Doppelganger
Our report on the Doppelganger campaign provides a crucial insight into the advanced tactics employed by foreign actors to manipulate information and interfere with democratic elections. As Europe continues to face evolving threats from disinformation campaigns, the findings underscore the importance of coordinated efforts to detect, expose, and counter these malign activities.
In addition to this exposé on the Doppelganger campaign, we have uncovered the key tactics, techniques, and procedures employed by pro-Kremlin manipulators in our European Elections section and the five-part ‘Elections are battlefields for the Kremlin’ series. In the series, we showed how pro-Kremlin disinformers attempt to smear leaders; sow distrust, doubt, and division; flood social media and information space with falsehoods; drag everyone down into the mud with them, and finally, end up dismissing the results.
The Doppelganger campaign and other pro-Kremlin attempts to interfere with our democratic processes serve as stark reminders of the ongoing battle against FIMI actors and the need to improve our resilience in the face of such threats.
Download the full report on Doppelganger here.
Article and pictures first time published on the EUvsDisinfo web page. Prepared for publication by volunteers from the Res Publica - The Center for Civil Resistance.
