#DOPPELGANGER: How Russia-based actors cloned legitimate media outlets from multiple countries (๐ฉ๐ช๐ฌ๐ง๐ซ๐ท๐ฎ๐น๐ฑ๐ป๐บ๐ฆ) to spread disinformation designed to undermine the support for Ukraine.
Our last investigation: doppelganger.ltd
Our last investigation: doppelganger.ltd
This independent investigation is solely based on open-source information and is built upon the first leads from @tonline. We also would also like to thank @AFPfaktencheck for reaching out to us.
t-online.de/nachrichten/deโฆ
t-online.de/nachrichten/deโฆ
The - still ongoing - information operation aims at: 
Digging further into the mediaโs findings, we could confirm that actors based in Russian time zones and using Russian as their working language were behind this operation. However, we couldnโt attribute it to a specific group.
We partnered with the non-profit foundation @Qur1ium to identify +50 domain names impersonating legitimate media, all of them hiding their traces behind Cloudflare.
qurium.org/alerts/russia/โฆ
qurium.org/alerts/russia/โฆ
How did they impersonate authentic media providers? First, they bought and managed domain names similar to the media they cloned. And they copy-pasted their design to trick Internet users.
This campaign targeted social media users with direct links to manipulated articles spreading narratives around "How great life in Siberia is" and "German fridges are empty due to EU sanctions."
For example, a fake Bild article claimed that Ukrainian refugees burnt down their guest's home in Germany after attempting to set fire to a Russian flag. Several fact-checkers debunked this false information.
factuel.afp.com/doc.afp.com.32โฆ
factuel.afp.com/doc.afp.com.32โฆ
The operation also amplified a fake article falsely asserting that there is proof showing that the Ukrainian army staged the Bucha massacre. This fake story was run on clones of ๐ฌ๐ง The Guardian, ๐ฎ๐น Ansa and ๐ซ๐ท 20minutes.
Actors conducting this operation used fake polls, created poorly translated videos, sponsored many Facebook ads with burner pages, and more.
While the set-up of this operation is sophisticated, its impact seems rather low, on the verge of counterproductive, with people openly mocking the campaign on Facebook.
Part of the engagement came from fake accounts using AI-generated profile pics. Another surprise is the very engaged community working in ๐ฉ๐ช Germany but living in Corbeil-Essonnes (Paris suburbs). Our guess is that theyโre engaging with cloned media during their long commute.
The publicly available data raises doubts about the success of #Doppelganger. It is troubling that this operation still goes on after months of breaching EU laws (trademark, GDPR, etc.), likely without consequences for its authors. This is where improvements need to happen.
Last but not least, our feeling working on this investigation was dual: on the one hand, some sadness and feeling of being in the book by @peterpomeranzev, โNothing is true and everything is possible.โ
And on the other hand, the poor content translation into French and some other mistakes reminded us of the laughably low-level of some information operations.
Leading us to merge Peter Pomerantsev with @OfficialHIMYMโs Barney Stinson into: "Nothing is true and everything is possimpible".
The possimpible, i.e. that place where sophisticated IT systems go along with thinking that putting a frog and a castle on your profile will rally French people against sanctions.
Challenge accepted and failed.
Challenge accepted and failed.
.@Facebook also issued its own report on #Doppelganger, you can find it here: about.fb.com/news/2022/09/rโฆ
Want to know more? Have a look at our partner @Qur1um infrastructure analysis on #Doppelganger.
https://twitter.com/Qur1um/status/1574736506316640259?t=VctsLkm0vduzhJ7afY_7MA&s=09
@AFPfaktencheck provides a German version of this story: faktencheck.afp.com/doc.afp.com.32โฆ
โข โข โข
Missing some Tweet in this thread? You can try to
force a refresh
ใ
