Loading signal...
Signal
Submitted
Apr 28, 2026, 14:01 UTC
Russian-backed 'Doppelgänger' disinformation campaign uses European firms, including a German hosting company and UK shell companies, to spread fake news targeting Germany, France and others since 2022.
Since 2022, a sophisticated Russian disinformation campaign dubbed 'Doppelgänger' has been spreading fake news via cloned news sites mimicking reputable outlets like Spiegel and Le Monde. The campaign uses thousands of disposable internet domains, primarily hosted and routed through a network of companies in the UK, Russia, Germany, Finland, and the US. Key actors include TNSecurity Ltd, a UK-registered mailbox company involved in forwarding hundreds of propaganda domains dated August 29, 2023, and Aeza, a young Russian St. Petersburg-based hosting provider owning approximately 40,000 servers valued at around 2.4 million euros. Aeza is linked to several affiliate companies and serves as a core forwarding hub for Doppelgänger infrastructure. The German firm Aurologic, operating the Tornado data center near Frankfurt, provides internet backbone services facilitating Doppelgänger’s traffic, despite EU sanctions on related Russian entities. Finnish branch of German hosting giant Hetzner runs critical servers that host the campaign’s core domains capable of geo-targeting visitors, particularly those physically located in Germany, thus ensuring targeting effectiveness while obfuscating traffic origins. The campaign employs complex multi-stage domain redirections with bots on platforms Facebook and X distributing thousands of throwaway URLs leading to intermediate and final fake news sites. Despite detection and reporting to authorities, European and platform responses have so far failed to shut down this infrastructure. The research is based on analysis by Swedish digital forensics NGO Qurium, Canadian cyber intelligence firm Hyas, Spamhaus, and interviews with involved companies. Doppelgänger aims to foment distrust and anti-Ukraine sentiment within EU populations through fake articles falsely claiming, for example, German retirees funding weapons aid at their expense. The article highlights challenges in combatting disinformation networks embedded within legitimate European IT infrastructure and raises questions about the effectiveness of current regulatory and law enforcement actions.
Confidence: High
The article explicitly documents a Russian hybrid warfare disinformation campaign using European infrastructure to disseminate falsified news and influence populations, identifying named Russian companies and EU-based firms facilitating the campaign, including hosting and domain forwarding. This meets criteria for an aggressive signal.
Source URL
https://correctiv.org/faktencheck/russische-desinformation/2024/07/11/doppelgaenger-wie-russland-eu-unternehmen-fuer-desinformation-und-propaganda-nutzt
Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.
{
"id": "e639e1b3-a261-4a5a-8d40-d07302d92fa9",
"url": "https://correctiv.org/faktencheck/russische-desinformation/2024/07/11/doppelgaenger-wie-russland-eu-unternehmen-fuer-desinformation-und-propaganda-nutzt",
"source": "extension",
"status": "approved",
"category": "Cyber & Information Warfare",
"subcategory": "Information Operations",
"incident_type": "Propaganda & disinformation campaigns",
"country": "Unknown",
"source_reliability": "A",
"info_credibility": "3",
"tags": [
"Russian disinformation",
"Doppelgänger campaign",
"Cyber propaganda",
"Fake news",
"European hosting",
"TNSecurity",
"Aeza",
"Aurologic",
"Hetzner",
"sanctions",
"Social Design Agency",
"Struktura",
"Information operations",
"Facebook",
"X (Twitter)",
"Domains hijacking",
"Malware infrastructure"
],
"nodes": [
"Node 1: Borders",
"Node 2: 5th Column"
],
"countries": [],
"where_text": "Cyberspace",
"headline": "How Russia Uses EU Companies for Doppelgänger Propaganda",
"description": "CORRECTIV’s investigation reveals that Russia’s disinformation campaign known as Doppelgänger exploits a complex web of IT infrastructure involving EU companies and UK shell companies to spread falsified news, particularly fake articles mimicking outlets like Spiegel, Le Monde, and the Washington Post. The campaign has been active since 2022, targeting European citizens and aiming to destabilize opinion by spreading pro-Kremlin narratives and anti-Ukraine propaganda. The campaign uses thousands of throwaway internet domains, with a central role played by TNSecurity Ltd, a UK-registered mailbox company hosting hundreds of forwarding domains, some used for spreading malware. Aeza, a young St. Petersburg-based hosting provider owning 40,000 servers worth about 2.4 million euros, forms the backbone of the network, functioning as a Russian hosting provider with a European presence. German IT company Aurologic, operating the Tornado data center near Frankfurt, provides critical network services, unknowingly or knowingly facilitating Doppelgänger traffic. Key internet routing also involves Finnish subsidiary of German hosting giant Hetzner, which hosts four critical domains equipped with Keitaro software to geo-target users physically located in Germany to see the fake Spiegel clone. This multi-stage infrastructure chain helps conceal the origin and ensure resilience despite platform censorship. The campaign spreads fake news articles via bot accounts on Facebook and X, including one fake Spiegel article falsely stating that German pension funds have been frozen to finance weapons for Ukraine. Sanctions by the EU and the US target companies like Social Design Agency and Struktura involved in conceptualization. Despite reports to European authorities and internet security groups, the Doppelgänger campaign remains operational, raising concerns about detection and enforcement efficacy. The investigation is based heavily on the forensic analysis by the Swedish NGO Qurium and technical reports by Hyas and Spamhaus, combined with interviews of involved companies and actors.",
"summary_short": "Russian-backed 'Doppelgänger' disinformation campaign uses European firms, including a German hosting company and UK shell companies, to spread fake news targeting Germany, France and others since 2022.",
"summary_extended": "Since 2022, a sophisticated Russian disinformation campaign dubbed 'Doppelgänger' has been spreading fake news via cloned news sites mimicking reputable outlets like Spiegel and Le Monde. The campaign uses thousands of disposable internet domains, primarily hosted and routed through a network of companies in the UK, Russia, Germany, Finland, and the US. Key actors include TNSecurity Ltd, a UK-registered mailbox company involved in forwarding hundreds of propaganda domains dated August 29, 2023, and Aeza, a young Russian St. Petersburg-based hosting provider owning approximately 40,000 servers valued at around 2.4 million euros. Aeza is linked to several affiliate companies and serves as a core forwarding hub for Doppelgänger infrastructure. The German firm Aurologic, operating the Tornado data center near Frankfurt, provides internet backbone services facilitating Doppelgänger’s traffic, despite EU sanctions on related Russian entities. Finnish branch of German hosting giant Hetzner runs critical servers that host the campaign’s core domains capable of geo-targeting visitors, particularly those physically located in Germany, thus ensuring targeting effectiveness while obfuscating traffic origins. The campaign employs complex multi-stage domain redirections with bots on platforms Facebook and X distributing thousands of throwaway URLs leading to intermediate and final fake news sites. Despite detection and reporting to authorities, European and platform responses have so far failed to shut down this infrastructure. The research is based on analysis by Swedish digital forensics NGO Qurium, Canadian cyber intelligence firm Hyas, Spamhaus, and interviews with involved companies. Doppelgänger aims to foment distrust and anti-Ukraine sentiment within EU populations through fake articles falsely claiming, for example, German retirees funding weapons aid at their expense. The article highlights challenges in combatting disinformation networks embedded within legitimate European IT infrastructure and raises questions about the effectiveness of current regulatory and law enforcement actions.",
"actor_primary": "TNSecurity Ltd",
"target_primary": null,
"location_text": "Frankfurt am Main, Germany",
"location_region": null,
"location_coordinates_lat": 50.1109,
"location_coordinates_lon": 8.6821,
"location_precision": "Approximate",
"is_aggressor_signal": true,
"signal_type": "HYBRID_SIGNAL",
"is_hybrid_war_signal": true,
"classification_complete": true,
"hybrid_signal_complete": true,
"classification_confidence": "High",
"classification_rationale": "The article explicitly documents a Russian hybrid warfare disinformation campaign using European infrastructure to disseminate falsified news and influence populations, identifying named Russian companies and EU-based firms facilitating the campaign, including hosting and domain forwarding. This meets criteria for an aggressive signal.",
"event_time_utc": "2024-07-11T06:00:00.000Z",
"end_time_utc": null,
"event_time_confidence": "exact",
"created_at": "2026-04-28T14:01:00.486Z",
"updated_at": "2026-11-04T08:36:03.522Z",
"reliability_band": "strong",
"location_precision_band": "approximate",
"time_precision_band": "exact",
"severity_band": "moderate",
"attribution_confidence_band": "high",
"attribution_basis": "single_source"
}Source reliability
A
Info credibility
3
Event time
Jul 11, 2024, 06:00 UTC
Event time confidence
exact
Location
Frankfurt am Main, Germany
Primary actor
TNSecurity Ltd
Country
Unknown
Tags
Russian disinformation, Doppelgänger campaign, Cyber propaganda, Fake news, European hosting, TNSecurity, Aeza, Aurologic, Hetzner, sanctions, Social Design Agency, Struktura, Information operations, Facebook, X (Twitter), Domains hijacking, Malware infrastructure
Nodes
Node 1: Borders, Node 2: 5th Column
Signal
Submitted
Apr 28, 2026, 14:01 UTC
Russian-backed 'Doppelgänger' disinformation campaign uses European firms, including a German hosting company and UK shell companies, to spread fake news targeting Germany, France and others since 2022.
Since 2022, a sophisticated Russian disinformation campaign dubbed 'Doppelgänger' has been spreading fake news via cloned news sites mimicking reputable outlets like Spiegel and Le Monde. The campaign uses thousands of disposable internet domains, primarily hosted and routed through a network of companies in the UK, Russia, Germany, Finland, and the US. Key actors include TNSecurity Ltd, a UK-registered mailbox company involved in forwarding hundreds of propaganda domains dated August 29, 2023, and Aeza, a young Russian St. Petersburg-based hosting provider owning approximately 40,000 servers valued at around 2.4 million euros. Aeza is linked to several affiliate companies and serves as a core forwarding hub for Doppelgänger infrastructure. The German firm Aurologic, operating the Tornado data center near Frankfurt, provides internet backbone services facilitating Doppelgänger’s traffic, despite EU sanctions on related Russian entities. Finnish branch of German hosting giant Hetzner runs critical servers that host the campaign’s core domains capable of geo-targeting visitors, particularly those physically located in Germany, thus ensuring targeting effectiveness while obfuscating traffic origins. The campaign employs complex multi-stage domain redirections with bots on platforms Facebook and X distributing thousands of throwaway URLs leading to intermediate and final fake news sites. Despite detection and reporting to authorities, European and platform responses have so far failed to shut down this infrastructure. The research is based on analysis by Swedish digital forensics NGO Qurium, Canadian cyber intelligence firm Hyas, Spamhaus, and interviews with involved companies. Doppelgänger aims to foment distrust and anti-Ukraine sentiment within EU populations through fake articles falsely claiming, for example, German retirees funding weapons aid at their expense. The article highlights challenges in combatting disinformation networks embedded within legitimate European IT infrastructure and raises questions about the effectiveness of current regulatory and law enforcement actions.
Confidence: High
The article explicitly documents a Russian hybrid warfare disinformation campaign using European infrastructure to disseminate falsified news and influence populations, identifying named Russian companies and EU-based firms facilitating the campaign, including hosting and domain forwarding. This meets criteria for an aggressive signal.
Source URL
https://correctiv.org/faktencheck/russische-desinformation/2024/07/11/doppelgaenger-wie-russland-eu-unternehmen-fuer-desinformation-und-propaganda-nutzt
Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.
{
"id": "e639e1b3-a261-4a5a-8d40-d07302d92fa9",
"url": "https://correctiv.org/faktencheck/russische-desinformation/2024/07/11/doppelgaenger-wie-russland-eu-unternehmen-fuer-desinformation-und-propaganda-nutzt",
"source": "extension",
"status": "approved",
"category": "Cyber & Information Warfare",
"subcategory": "Information Operations",
"incident_type": "Propaganda & disinformation campaigns",
"country": "Unknown",
"source_reliability": "A",
"info_credibility": "3",
"tags": [
"Russian disinformation",
"Doppelgänger campaign",
"Cyber propaganda",
"Fake news",
"European hosting",
"TNSecurity",
"Aeza",
"Aurologic",
"Hetzner",
"sanctions",
"Social Design Agency",
"Struktura",
"Information operations",
"Facebook",
"X (Twitter)",
"Domains hijacking",
"Malware infrastructure"
],
"nodes": [
"Node 1: Borders",
"Node 2: 5th Column"
],
"countries": [],
"where_text": "Cyberspace",
"headline": "How Russia Uses EU Companies for Doppelgänger Propaganda",
"description": "CORRECTIV’s investigation reveals that Russia’s disinformation campaign known as Doppelgänger exploits a complex web of IT infrastructure involving EU companies and UK shell companies to spread falsified news, particularly fake articles mimicking outlets like Spiegel, Le Monde, and the Washington Post. The campaign has been active since 2022, targeting European citizens and aiming to destabilize opinion by spreading pro-Kremlin narratives and anti-Ukraine propaganda. The campaign uses thousands of throwaway internet domains, with a central role played by TNSecurity Ltd, a UK-registered mailbox company hosting hundreds of forwarding domains, some used for spreading malware. Aeza, a young St. Petersburg-based hosting provider owning 40,000 servers worth about 2.4 million euros, forms the backbone of the network, functioning as a Russian hosting provider with a European presence. German IT company Aurologic, operating the Tornado data center near Frankfurt, provides critical network services, unknowingly or knowingly facilitating Doppelgänger traffic. Key internet routing also involves Finnish subsidiary of German hosting giant Hetzner, which hosts four critical domains equipped with Keitaro software to geo-target users physically located in Germany to see the fake Spiegel clone. This multi-stage infrastructure chain helps conceal the origin and ensure resilience despite platform censorship. The campaign spreads fake news articles via bot accounts on Facebook and X, including one fake Spiegel article falsely stating that German pension funds have been frozen to finance weapons for Ukraine. Sanctions by the EU and the US target companies like Social Design Agency and Struktura involved in conceptualization. Despite reports to European authorities and internet security groups, the Doppelgänger campaign remains operational, raising concerns about detection and enforcement efficacy. The investigation is based heavily on the forensic analysis by the Swedish NGO Qurium and technical reports by Hyas and Spamhaus, combined with interviews of involved companies and actors.",
"summary_short": "Russian-backed 'Doppelgänger' disinformation campaign uses European firms, including a German hosting company and UK shell companies, to spread fake news targeting Germany, France and others since 2022.",
"summary_extended": "Since 2022, a sophisticated Russian disinformation campaign dubbed 'Doppelgänger' has been spreading fake news via cloned news sites mimicking reputable outlets like Spiegel and Le Monde. The campaign uses thousands of disposable internet domains, primarily hosted and routed through a network of companies in the UK, Russia, Germany, Finland, and the US. Key actors include TNSecurity Ltd, a UK-registered mailbox company involved in forwarding hundreds of propaganda domains dated August 29, 2023, and Aeza, a young Russian St. Petersburg-based hosting provider owning approximately 40,000 servers valued at around 2.4 million euros. Aeza is linked to several affiliate companies and serves as a core forwarding hub for Doppelgänger infrastructure. The German firm Aurologic, operating the Tornado data center near Frankfurt, provides internet backbone services facilitating Doppelgänger’s traffic, despite EU sanctions on related Russian entities. Finnish branch of German hosting giant Hetzner runs critical servers that host the campaign’s core domains capable of geo-targeting visitors, particularly those physically located in Germany, thus ensuring targeting effectiveness while obfuscating traffic origins. The campaign employs complex multi-stage domain redirections with bots on platforms Facebook and X distributing thousands of throwaway URLs leading to intermediate and final fake news sites. Despite detection and reporting to authorities, European and platform responses have so far failed to shut down this infrastructure. The research is based on analysis by Swedish digital forensics NGO Qurium, Canadian cyber intelligence firm Hyas, Spamhaus, and interviews with involved companies. Doppelgänger aims to foment distrust and anti-Ukraine sentiment within EU populations through fake articles falsely claiming, for example, German retirees funding weapons aid at their expense. The article highlights challenges in combatting disinformation networks embedded within legitimate European IT infrastructure and raises questions about the effectiveness of current regulatory and law enforcement actions.",
"actor_primary": "TNSecurity Ltd",
"target_primary": null,
"location_text": "Frankfurt am Main, Germany",
"location_region": null,
"location_coordinates_lat": 50.1109,
"location_coordinates_lon": 8.6821,
"location_precision": "Approximate",
"is_aggressor_signal": true,
"signal_type": "HYBRID_SIGNAL",
"is_hybrid_war_signal": true,
"classification_complete": true,
"hybrid_signal_complete": true,
"classification_confidence": "High",
"classification_rationale": "The article explicitly documents a Russian hybrid warfare disinformation campaign using European infrastructure to disseminate falsified news and influence populations, identifying named Russian companies and EU-based firms facilitating the campaign, including hosting and domain forwarding. This meets criteria for an aggressive signal.",
"event_time_utc": "2024-07-11T06:00:00.000Z",
"end_time_utc": null,
"event_time_confidence": "exact",
"created_at": "2026-04-28T14:01:00.486Z",
"updated_at": "2026-11-04T08:36:03.522Z",
"reliability_band": "strong",
"location_precision_band": "approximate",
"time_precision_band": "exact",
"severity_band": "moderate",
"attribution_confidence_band": "high",
"attribution_basis": "single_source"
}Source reliability
A
Info credibility
3
Event time
Jul 11, 2024, 06:00 UTC
Event time confidence
exact
Location
Frankfurt am Main, Germany
Primary actor
TNSecurity Ltd
Country
Unknown
Tags
Russian disinformation, Doppelgänger campaign, Cyber propaganda, Fake news, European hosting, TNSecurity, Aeza, Aurologic, Hetzner, sanctions, Social Design Agency, Struktura, Information operations, Facebook, X (Twitter), Domains hijacking, Malware infrastructure
Nodes
Node 1: Borders, Node 2: 5th Column