SentinelLabs and ClearSky Cyber Security's joint investigation unearthed a propaganda and disinformation campaign by a suspected Russia-aligned threat actor called Doppelganger. The initial campaign, which targeted Ukraine in late November 2023, later spread to the USA, Israel, France and Germany.

The firms found that in Germany, the threat actor spread propaganda and disinformation content to influence public opinion about socio-economic and geopolitical issues especially criticising the ruling government coalition's support for Ukraine, before the upcoming elections.

Recent reports from the German Ministry of Foreign Affairs and Der Spiegel have also pointed to similar concerns of election interference in Germany from Russia.

It is alleged that Doppelganger used a network of accounts on social media platforms, especially X (formerly Twitter), to engage and disseminate its activities in a coordinated manner to amplify its messages and increase visibility.

SentinelLabs has stated in its report, 'The majority of the X accounts we discovered as part of our investigation had not been deactivated at the time of writing.' They continued, 'To maximise visibility and audience engagement, these accounts participate in coordinated activities, such as regularly posting and reposting content from highly popular profiles, as well as engaging with posts from other suspected Doppelganger-managed accounts.'

Why does it matter?

The persisting nature of the campaign and the way it is evolving highlights the influence the operation can have. The advisory states, 'We anticipate that Doppelganger's activities, targeting not only Germany but also other Western countries, will persist and evolve, particularly in light of the major elections scheduled across the EU and the USA in the coming years". It also shares that countering the campaign requires a multifaceted approach, which includes enhancing public awareness, media literacy, and coordination with social media platforms and infrastructure operators.