According to a recent report by the Counter Disinformation Network (CDN) and the Qurium Media Foundation, this operation uses an advanced technological infrastructure and manipulation techniques to spread pro-Russian narratives on digital platforms such as X (formerly Twitter) and Facebook. Between 4 and 28 June 2024, 1,366 posts were observed in six languages (Italian, English, French, German, Polish and Ukrainian), amplified through suspicious accounts in automated responses to third-party content. These posts reached over 4.66 million views, exploiting polarising themes to criticise Western governments, discredit Ukraine and undermine Western alliances. The activities appeared coordinated, with simultaneous postings by several accounts and the use of mostly unique but repeated content in some iterations. Amplifying accounts, often with few followers, exhibited automated behaviour, publishing and republishing content until suspended by the platforms.
Doppelganger’s technical infrastructure follows the FI-KE-D model, which includes front domains to attract users, intermediate domains for redirection via obfuscated JavaScript, and end domains that imitate legitimate information sources. Analyses have linked these structures to hosting providers already known to support disinformation operations. The platforms used include the Keitaro advertising software, capable of filtering users and redirecting them to specific content or dummy sites. The end domains identified mimic genuine newspapers, spreading manipulated content to feed disinformation. Analyses show that the main strategic goals of the operation are to degrade Ukraine’s image, discourage Western support for the conflict, and polarise public opinion in the target countries, while strengthening support for Russia.
Digital platforms, despite warnings from the European Commission and monitoring organisations, have shown an insufficient response. In July 2024, out of 623 posts reported to X, only one account was suspended, while Meta removed some pages associated with misleading advertisements, but the threat persists. This situation raises questions about the effectiveness of measures under the European Union’s Digital Services Act, which requires platforms to take action against information manipulation. According to the report, the operation exploits technological and social vulnerabilities, such as insufficient media literacy and the lack of transparency of the platforms’ algorithms. The CDN network, which brings together over 130 experts and organisations, has a crucial role in documenting and countering this threat, but success requires a joint effort by governments, civil society and platforms to improve detection, educate the public and promote a safer media environment. Operation Doppelganger demonstrates how disinformation is a powerful weapon to influence public debate and destabilise democracies, requiring urgent and coordinated action to protect truth and social stability.
Technical infrastructure: the FI-KE-D model
The Qurium Media Foundation identified the technical structure of the operation, describing it as a ‘FI-KE-D’ redirection system:Front Domains (F): Used to attract users to the redirection chain, often registered with providers associated with the Doppelganger infrastructure.
-Intermediary Domains (I): With obfuscated JavaScripts directing traffic to successful domains
-Keitaro Domains (KE): Advertising software used to filter users based on IP and redirect them to fake sites or the final destination of Doppelgangers.
-Final Domains (D): Pages imitating genuine newspapers, designed to spread propaganda and disinformation.
This infrastructure was used to create manipulative content with narratives aimed at discrediting Ukraine, polarising public opinion in European countries and strengthening support for Russia.
