How you are being influenced by your “favorite” fake media: the Doppelgänger Operation

If you have read the online news on the Ukrainian conflict this morning, your opinion may have changed on the relevance of the Western economic and military support. Are you sure you read your favorite online media? Was the tweet with a screenshot on the front page of your favorite newspaper true? There is maybe a chance that you saw a false website, and you have been misled by a vast pro-Russian disinformation campaign, the Doppelgänger Operation.

The worst part is that you may never realize that what you are reading is false. You could naturally ask yourself how you could have been fooled? I have asked myself the same question when I first realized that the accounts I was consulting to get instant updates on the Ukrainian conflict on X were relaying fake information. This concerned the capture of intact French and German cannons by the Russians (Caesar 155m and PzH 2000 Howitzer). It later turned out that they were relaying information from a fake article from the Bild newspaper website. This article never existed, and bots amplified the information. We must therefore try to understand how media identity is usurped and how this information is amplified.

How can you be fooled?

The aim of the operation: Since 2022, this Doppelgänger Operation has been launched globally in major European countries by using bots on social media to amplify fake news, creating fake websites and cloning real ones. This operation can be more broadly linked to other campaigns such as RRN (Reliable Russian News). VIGINUM (France’s service of vigilance and protection against foreign digital interference) has identified 4 main objectives of Doppelgänger:

1.     Spread the “ineffectiveness of sanctions targeting Russia narrative, which would above all negatively impact European States and/or their citizens”.

2.    Demonstrate the “alleged Russophobia of Western States”.

3.    Convince people of the “barbaric acts allegedly committed by Ukrainian Armed Forces, and the neo-Nazi ideology that would predominate among Ukrainian leaders”

4.     Show the “negative effects on European States that would allegedly be generated by the hosting of Ukrainian refugees”.

More generally, this strategy is part of the destabilization of the West. Dimitri Minic, a researcher at the IFRI (Institut français des relations internationales) Russia and Eurasia Center, refers to Russia's long-term strategy to strengthen its supporters in European societies. As Europeans, even if we are alert to fake news, in the constant flow of information we may not always detect it. This is normal since you are typically the target of this campaign. But how does it really work, and who wants you to change your mind on specific subjects?

The functioning of the operation

In German, the Doppelgänger term means an evil twin. In early 2022, the operation began by using a specific technic to convince public opinion: typosquatting.  

Typosquatting is a method of misappropriating a real URL belonging to an entity by altering slightly the domain name in order to impersonate that entity. The Guardian saw a copy of its website appear under the URL “theguardian[.]co[.]com” instead of the real one “theguardian.com”. 

VIGICOM has recorded 353 domain names cloning real medias or fake medias created by Russian companies. At the end of 2022, Meta attributed responsibility for this vast operation to two Russian companies: Company Group Structura LLC (Structura) and Social Design Agency (SDA).

Doppelgänger operation then uses a method of amplifying this information on social media by spreading links to fake news sites. These X, TikTok, and Facebook fake accounts are created in different languages (German, French, Italian, Polish, etc.) to make them appear to be national and serious opinions. By massively reposting this false information with hashtags and by relaying it through ads, the information appears on your news feed, and you can therefore be misled. Russian government accounts also relay this information sometimes.

uring the Olympics games in Paris, Doppelgänger affected the website of a French famous media, Le Parisien. By changing the URL into “www.leparisien.wf” instead of “www.leparisien.fr” this pro-Russian operation helped to discredit Emmanuel Macron during the 2024 Olympic Games by highlighting his incompetence and his excessive support for Ukraine, playing on the resentment of the French people during a period that normally calls for unity. The French Foreign Ministry's website was also copied, spreading fake news that a tax would be imposed to support Ukraine's war effort amid social tension and economic stagnation in France.

Typosquatted website of the media Le Parisien (source: www.leparisien.fm)

Official website of the media Le Parisien with a similar article (source: www.leparisien.fr)

Who is really behind this operation?

The US Department of the Treasury concluded that Company Group Structura LLC and Social Design Agency provided services for the Government of the Russian Federation. According to this Department they are responsible for “providing GoR with a variety of services, including the creation of websites designed to impersonate government organizations and legitimate media outlets in Europe”. The EU and Meta are more cautious and only accuse companies.

Explanatory diagram of the links and attributions of doppelganger actions by the U.S Treasury, Council of the European Union, Meta and VIGINUM.

Excerpt from the 5 June 2024, Technical report on an Analysis by the German Federal Foreign Office. [Last seen: 12/17/2025]

Now that you know about this operation, how could you prevent its effects?

The first measure that can be seen as simple but necessary is to increase your awareness of small details when you read something online. Fake news usually appears in small faults like:

• Misspelling in the URL

• or words of a word in an article

• An accusatory and aggressive tone

• Crudes photo montage

• Cyrillic characters due to a bad automatic translation

5 Common Typosquatting Variations Shema, Norton. (n.d.). What is typosquatting and how to avoid it. Norton. [Last seen : 12/17/2025]

If you want to make sure that what you are reading is true, you can dig deeper by noting the exact URLs of your favorite media outlets and retyping them each time you visit the site. And of course, the more important and shocking the information on a subject such as the war in Ukraine is, the more it deserves to be verified by cross-checking sources.

In a context where information is consumed and disseminated as quickly as it is created, it is important to maintain a critical eye on the forms of disinformation that affect our daily lives. Operation Doppelganger reminds us that we are vulnerable to the growing dynamics of disinformation. This is now dynamic that European public authorities and agencies are struggling to counter. Although it would be wrong to make any premature accusations on the real responsible, Catherine Colonna, the former French Minister of Foreign Affairs in 2023, stated that this is part of a form of hybrid warfare waged by Russia. And we, as consumers of online information, are the targets.

About the author:

Gautier Diehl is a student pursuing a bachelor’s degree in Political Science and International Relations at ESPOL, Lille, France (European School of Political and Social Sciences). He is interested in global security and intelligence, especially in the Middle East.