Executive Summary
Operation Doppelganger also known by Microsoft as Storm-1099 was a Russian information warfare campaign that creates digital clones of legitimate, high-trust Western news outlets and government websites, then populates them with pro-Kremlin content designed to look indistinguishable from original journalism. The operation employs cybersquatting, which is the practice of registering domain names that closely mimic trusted brands (for example, washingtonpost.pm instead of washingtonpost.com) combined with narrative laundering, the process by which false content planted in fake-but-realistic looking outlets gets amplified into mainstream discourse. Doppelganger was attributed in December 2022 by Meta to two Russian companies: Struktura National Technologies and Social Design Agency, both with links to Kremlin information operations. The operation has cloned the homepages of Le Monde, The Washington Post, Fox News, Spiegel, and dozens of other high-circulation outlets, publishing fabricated articles under real journalists’ bylines. In September 2024, the U.S. Department of Justice seized 32 Doppelganger-linked domains and the U.S. Treasury sanctioned Russian individuals and entities — yet the network rebuilt within 24 hours. Doppelganger’s strategic goal is to suppress European and American support for Ukraine, stoke social division, and undermine trust in democratic institutions before major elections.
How It Was Discovered
Doppelganger first attracted systematic attention in late 2022 when Meta’s Quarterly Adversarial Threat Report flagged a large-scale coordinated inauthentic behavior network — meaning a set of fake or manipulated accounts and pages acting together to amplify a shared political agenda — linked to Russian operators. Meta’s initial attribution pointed to Struktura and the Social Design Agency, two firms subsequently sanctioned by the EU and the United States. In June 2023, France’s VIGINUM (the government service dedicated to countering foreign digital interference) published a detailed technical report confirming the cloning of French media outlets including Le Monde, Le Figaro, and 20 Minutes, as well as the French Ministry of Foreign Affairs website.
The Atlantic Council’s Digital Forensic Research Lab (DFRLab) produced several investigations tracking Doppelganger’s pivot toward U.S. audiences ahead of the 2024 presidential election. Correctiv, the German investigative outlet, published a detailed expose in July 2024 revealing how Doppelganger was being operated partly through EU-registered shell companies — a deliberate attempt to exploit EU data protection and corporate registration frameworks to host the operation while evading detection. On September 4, 2024, the U.S. Department of Justice unsealed indictments charging two Russian state media employees with funneling approximately $10 million to a Tennessee-based content creation firm to amplify Doppelganger narratives inside the United States.
The Mechanics: Cloning, Cybersquatting, and Tailored Demographic Targeting
Doppelganger’s technical execution is unusually sophisticated for a state-sponsored influence operation. At its core, the campaign registers domain names in typographic proximity to legitimate media brands and recreates the visual design — including logos, fonts, color palettes, and masthead layouts — of the target publications. The cloned sites publish fabricated articles formatted to match the genuine publication’s editorial style, often using the actual bylines of real journalists to increase credibility.
The operation then distributes links to these cloned pages through social media, sometimes via paid advertising. On platforms like Reddit and 4chan, researchers found Doppelganger-linked accounts seeding fabricated Washington Post and Fox News articles into politically charged discussion threads. The content was specifically tailored to demographic targets: messaging for American Jewish users focused on Israel-Gaza narratives; content for Hispanic Americans emphasized immigration enforcement; material targeting “gamers” and younger male users played on economic grievances and LGBTQ+ anxieties. Beyond cloned masthead sites, Doppelganger also operated original fake properties under names like “Spicy Conspiracy” and “Election Watch” — outlets that did not pretend to be anyone else, but were designed to aggregate and amplify the broader disinformation ecosystem.
A key operational feature was the use of EU-domiciled companies — front firms registered in Germany, France, and other member states — to host infrastructure, purchase advertising, and process payments. This created a legal firewall that slowed attribution and enforcement.
Target Selection: Elections, Ukraine, and Social Fissures
Doppelganger’s primary documented targets have been the 2024 European Parliament elections (June 2024), the French early parliamentary elections (July 2024), and the U.S. presidential election (November 2024). The operation also targeted German audiences ahead of the February 2025 federal election, where it was part of a wider coordinated Russian disinformation effort alongside Storm-1516 and a third operation called Matryoshka (also known as Operation Overload). In all cases, the content themes were consistent: undermining Western support for Ukraine, attacking the credibility of pro-EU political leaders, and amplifying fears about migration, crime, and economic instability.
For French audiences, fabricated Le Monde articles questioned France’s military commitment to Ukraine and alleged financial corruption among Macron-aligned politicians. For German audiences, cloned Spiegel pages pushed narratives about economic damage caused by anti-Russia sanctions. For American audiences, the operation focused on deepening partisan divisions rather than promoting specific policy positions — a strategy aimed at maximizing democratic dysfunction regardless of the election outcome.
Scale and the $10 Million Tennessee Connection
The documented scale of Doppelganger is significant. At its peak, the operation comprised hundreds of cloned and original fake domains, with new sites continuously replacing seized ones. The U.S. government’s September 2024 action seized 32 domains and charged two employees of RT (the Russian state broadcaster formerly known as Russia Today) with channeling approximately $10 million to a Tennessee-based social media content company called Tenet Media, which published pro-Russian content under the guise of independent American commentary. The Tenet Media case represented an important escalation: it demonstrated that Doppelganger-linked operators were not merely creating fake foreign sites but were paying American media personalities to distribute coordinated narratives domestically, blurring the line between foreign influence and domestic media.
Despite the seizures, DFRLab documented twelve new or restored websites that came online within 24 hours of the U.S. government action — demonstrating the operation’s deliberate redundancy and resilience.
Balkans Angle
Doppelganger’s Balkan footprint, while less documented than its Western European operations, has been noted by researchers at the EU DisinfoLab. In 2023 and 2024, cloned or Doppelganger-style fake news pages pushing anti-EU and pro-Russian content were observed circulating in Serbian-language social media communities, particularly around sensitive political moments such as Serbian elections and debates over Kosovo’s EU integration path. The operational logic is consistent with the broader campaign: Balkan EU-candidate states are sites of genuine political contestation over European integration, making them fertile territory for narratives designed to sow doubt about the EU’s reliability as a partner.
Outcome and Current Status
Doppelganger remains one of the most durable and well-resourced Russian disinformation campaigns on record. Despite EU sanctions, U.S. domain seizures, indictments, and takedowns by Meta and other platforms, the operation has demonstrated an ability to reconstitute almost immediately after every interdiction. The U.S. and EU governments have publicly attributed the campaign to Kremlin-linked entities, and France has formally condemned it at the diplomatic level. No criminal prosecution has yet been completed against the principal Russian operators, who remain beyond Western legal reach. As of mid-2026, the EU DisinfoLab continues to track active Doppelganger infrastructure across multiple European language zones.
Leave a Reply