U.S. Cyber Command reveals Russian disinformation campaign ‘DoppelGänger’ spreading pro-Russian narratives across European media using cloned fake websites and social media manipulation since May 2022.

Cyber & Information WarfareInformation OperationsPropaganda & disinformation campaigns

Aggressor

Summary

On September 3, 2024, U.S. Cyber Command public affairs disclosed a sophisticated Russian disinformation campaign called 'DoppelGänger,' active since at least May 2022. The campaign, operated by the Russian Social Design Agency and Structura National Technologies, disseminates pro-Russian narratives into Europe’s media landscape by cloning legitimate media outlet websites and generating fake content using AI. At least 17 European media providers, including Bild, 20minutes, Ansa, The Guardian, and RBC Ukraine, have been targeted to spread false news and narratives that undermine European and NATO cohesion. The campaign used mimicked websites such as 'nato[.]ws' to fake NATO press releases falsely claiming NATO agreements to boost military budgets and deploy Ukrainian paramilitary troops in France. Another example includes 'RRN[.]media,' formerly registered as 'russianews[.]com,' a pro-Russian outlet promoting fact-checked misinformation favorable to Russia. Disinformation efforts employed social media bots for multi-stage obfuscation and paid promotions to increase reach, targeting audiences in Germany, Italy, France, Latvia, and the UK with narratives denying the Bucha massacre and fomenting fear that sanctions would ruin lives. This campaign highlights the borderless nature of disinformation and the need for collective transparency and vigilance against media manipulation. The EU Disinformation Lab first exposed DoppelGänger, emphasizing an ongoing hybrid warfare effort to distort democratic discourse and undermine Western unity.

Classification

Confidence: High

The report explicitly attributes the campaign to Russian-linked organizations spreading coordinated pro-Russian disinformation targeting European media and public opinion since May 2022, matching clear hostile hybrid warfare activity in cyberspace. No defense or response measures are described.

Source URL

https://cybercom.mil/Media/News/Article/3895345/russian-disinformation-campaign-doppelgnger-unmasked-a-web-of-deception

Open source

Provenance

Publisher: csv-import
Submitted: Feb 1, 2026, 00:14 UTC
Last updated: Nov 4, 2026, 08:35 UTC
Event time: Sep 3, 2024, 12:00 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "132a7108-be17-4a9f-a04e-f69812b0cf52",
  "url": "https://cybercom.mil/Media/News/Article/3895345/russian-disinformation-campaign-doppelgnger-unmasked-a-web-of-deception",
  "source": "csv-import",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Information Operations",
  "incident_type": "Propaganda & disinformation campaigns",
  "country": "United States of America",
  "source_reliability": "B",
  "info_credibility": "3",
  "tags": [
    "Russian disinformation",
    "DoppelGänger",
    "EU DisinfoLab",
    "Russian Social Design Agency",
    "Structura National Technologies",
    "propaganda",
    "media manipulation",
    "fake news",
    "social media bots",
    "NATO website spoofing",
    "Ukraine war narratives",
    "european media influence"
  ],
  "nodes": [],
  "countries": [
    "United States of America"
  ],
  "where_text": "Cyberspace",
  "headline": null,
  "description": "The European Union’s Disinformation Lab (EU DisinfoLab) exposed a Russian disinformation campaign named 'DoppelGänger,' operated by the Russian Social Design Agency and Structura National Technologies since May 2022. The campaign uses AI-generated disinformation and purchased domain names mimicking legitimate European media and government websites to promote pro-Russian narratives. It targets at least 17 European media providers, including Bild, 20minutes, Ansa, The Guardian, and RBC Ukraine, spreading false information to influence public opinion and sow discord. Fake websites such as 'nato[.]ws' mimicked NATO’s official site to spread false press releases about NATO military decisions, while 'RRN[.]media' pushed pro-Russian narratives downplaying Western sanctions' effectiveness and criticizing Ukrainian refugees in Europe. Social media bots and paid posts amplify this disinformation across networks like Facebook and Twitter, blending facts with falsehoods. Key narratives include portraying Ukraine negatively, denying the Bucha massacre, spreading Kremlin-approved war narratives, and fearmongering targeted at Germans, Italians, French, Latvians, and British citizens about sanctions. This persistent disinformation threat shows the evolving Russian hybrid warfare tactics in information space, requiring coordinated defense and media literacy to counter.",
  "summary_short": "U.S. Cyber Command reveals Russian disinformation campaign ‘DoppelGänger’ spreading pro-Russian narratives across European media using cloned fake websites and social media manipulation since May 2022.",
  "summary_extended": "On September 3, 2024, U.S. Cyber Command public affairs disclosed a sophisticated Russian disinformation campaign called 'DoppelGänger,' active since at least May 2022. The campaign, operated by the Russian Social Design Agency and Structura National Technologies, disseminates pro-Russian narratives into Europe’s media landscape by cloning legitimate media outlet websites and generating fake content using AI. At least 17 European media providers, including Bild, 20minutes, Ansa, The Guardian, and RBC Ukraine, have been targeted to spread false news and narratives that undermine European and NATO cohesion. The campaign used mimicked websites such as 'nato[.]ws' to fake NATO press releases falsely claiming NATO agreements to boost military budgets and deploy Ukrainian paramilitary troops in France. Another example includes 'RRN[.]media,' formerly registered as 'russianews[.]com,' a pro-Russian outlet promoting fact-checked misinformation favorable to Russia. Disinformation efforts employed social media bots for multi-stage obfuscation and paid promotions to increase reach, targeting audiences in Germany, Italy, France, Latvia, and the UK with narratives denying the Bucha massacre and fomenting fear that sanctions would ruin lives. This campaign highlights the borderless nature of disinformation and the need for collective transparency and vigilance against media manipulation. The EU Disinformation Lab first exposed DoppelGänger, emphasizing an ongoing hybrid warfare effort to distort democratic discourse and undermine Western unity.",
  "actor_primary": "Russian Social Design Agency",
  "target_primary": null,
  "location_text": "United States of America",
  "location_region": null,
  "location_coordinates_lat": 37.09024,
  "location_coordinates_lon": -95.712891,
  "location_precision": "Regional",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The report explicitly attributes the campaign to Russian-linked organizations spreading coordinated pro-Russian disinformation targeting European media and public opinion since May 2022, matching clear hostile hybrid warfare activity in cyberspace. No defense or response measures are described.",
  "event_time_utc": "2024-09-03T12:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "unknown",
  "created_at": "2026-02-01T00:14:24.765Z",
  "updated_at": "2026-11-04T08:35:32.139Z",
  "reliability_band": "strong",
  "location_precision_band": "regional",
  "time_precision_band": "unknown",
  "severity_band": "moderate",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}

Public assessmentReliability: StrongSeverity: ModerateAttribution: HighSingle sourceTime: UnknownLocation: Regional

Source reliability

Info credibility

Event time

Sep 3, 2024, 12:00 UTC

Event time confidence

unknown

Location

United States of America

Primary actor

Russian Social Design Agency

Country

United States of America

Countries

United States of America

Tags

Russian disinformation, DoppelGänger, EU DisinfoLab, Russian Social Design Agency, Structura National Technologies, propaganda, media manipulation, fake news, social media bots, NATO website spoofing, Ukraine war narratives, european media influence

Loading signal...

{ "id": "132a7108-be17-4a9f-a04e-f69812b0cf52", "url": "https://cybercom.mil/Media/News/Article/3895345/russian-disinformation-campaign-doppelgnger-unmasked-a-web-of-deception", "source": "csv-import", "status": "approved", "category": "Cyber & Information Warfare", "subcategory": "Information Operations", "incident_type": "Propaganda & disinformation campaigns", "country": "United States of America", "source_reliability": "B", "info_credibility": "3", "tags": [ "Russian disinformation", "DoppelGänger", "EU DisinfoLab", "Russian Social Design Agency", "Structura National Technologies", "propaganda", "media manipulation", "fake news", "social media bots", "NATO website spoofing", "Ukraine war narratives", "european media influence" ], "nodes": [], "countries": [ "United States of America" ], "where_text": "Cyberspace", "headline": null, "description": "The European Union’s Disinformation Lab (EU DisinfoLab) exposed a Russian disinformation campaign named 'DoppelGänger,' operated by the Russian Social Design Agency and Structura National Technologies since May 2022. The campaign uses AI-generated disinformation and purchased domain names mimicking legitimate European media and government websites to promote pro-Russian narratives. It targets at least 17 European media providers, including Bild, 20minutes, Ansa, The Guardian, and RBC Ukraine, spreading false information to influence public opinion and sow discord. Fake websites such as 'nato[.]ws' mimicked NATO’s official site to spread false press releases about NATO military decisions, while 'RRN[.]media' pushed pro-Russian narratives downplaying Western sanctions' effectiveness and criticizing Ukrainian refugees in Europe. Social media bots and paid posts amplify this disinformation across networks like Facebook and Twitter, blending facts with falsehoods. Key narratives include portraying Ukraine negatively, denying the Bucha massacre, spreading Kremlin-approved war narratives, and fearmongering targeted at Germans, Italians, French, Latvians, and British citizens about sanctions. This persistent disinformation threat shows the evolving Russian hybrid warfare tactics in information space, requiring coordinated defense and media literacy to counter.", "summary_short": "U.S. Cyber Command reveals Russian disinformation campaign ‘DoppelGänger’ spreading pro-Russian narratives across European media using cloned fake websites and social media manipulation since May 2022.", "summary_extended": "On September 3, 2024, U.S. Cyber Command public affairs disclosed a sophisticated Russian disinformation campaign called 'DoppelGänger,' active since at least May 2022. The campaign, operated by the Russian Social Design Agency and Structura National Technologies, disseminates pro-Russian narratives into Europe’s media landscape by cloning legitimate media outlet websites and generating fake content using AI. At least 17 European media providers, including Bild, 20minutes, Ansa, The Guardian, and RBC Ukraine, have been targeted to spread false news and narratives that undermine European and NATO cohesion. The campaign used mimicked websites such as 'nato[.]ws' to fake NATO press releases falsely claiming NATO agreements to boost military budgets and deploy Ukrainian paramilitary troops in France. Another example includes 'RRN[.]media,' formerly registered as 'russianews[.]com,' a pro-Russian outlet promoting fact-checked misinformation favorable to Russia. Disinformation efforts employed social media bots for multi-stage obfuscation and paid promotions to increase reach, targeting audiences in Germany, Italy, France, Latvia, and the UK with narratives denying the Bucha massacre and fomenting fear that sanctions would ruin lives. This campaign highlights the borderless nature of disinformation and the need for collective transparency and vigilance against media manipulation. The EU Disinformation Lab first exposed DoppelGänger, emphasizing an ongoing hybrid warfare effort to distort democratic discourse and undermine Western unity.", "actor_primary": "Russian Social Design Agency", "target_primary": null, "location_text": "United States of America", "location_region": null, "location_coordinates_lat": 37.09024, "location_coordinates_lon": -95.712891, "location_precision": "Regional", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The report explicitly attributes the campaign to Russian-linked organizations spreading coordinated pro-Russian disinformation targeting European media and public opinion since May 2022, matching clear hostile hybrid warfare activity in cyberspace. No defense or response measures are described.", "event_time_utc": "2024-09-03T12:00:00.000Z", "end_time_utc": null, "event_time_confidence": "unknown", "created_at": "2026-02-01T00:14:24.765Z", "updated_at": "2026-11-04T08:35:32.139Z", "reliability_band": "strong", "location_precision_band": "regional", "time_precision_band": "unknown", "severity_band": "moderate", "attribution_confidence_band": "high", "attribution_basis": "single_source" }