Russia’s continued attempts to manipulate the information environment
The EEAS, Finland, Czechia, Estonia, France, Germany, Latvia, Lithuania, Netherlands, Poland, Romania and Sweden denounce Russia’s continued and systematic attempts to manipulate and interfere in the information space of democratic societies.
EEAS press release 23 January 2025
Foreign Information Manipulation and Interference (FIMI) operations against the European Union and our partners aim to destabilise our societies, sow mistrust in our institutions, and undermine international and public support for Ukraine. We will not let foreign malign actors achieve their objectives. We are well prepared and equipped to detect, expose and counter Russian FIMI operations.
“Foreign information manipulation and interference is a fundamental part of Russian military activities. It aims at creating distrust, sparking domestic divisions, and influencing democratic decision-making. We have to fight it. The best way to counter such malign activities remains the same: expose them, provide facts and the truth and support independent press.” said Kaja Kallas, High Representative for Foreign Affairs and Security Policy.
Russian state and pro-Kremlin affiliated actors are coordinating to conduct foreign information manipulation and interference (FIMI) attacks. These operations are carried out through Russian diplomatic network and security services, state-controlled media, social media channels, private companies and local proxies, used in an integrated manner to multiply and amplify each other.
On the 16th of December 2024, the European Union imposed restrictive measures on two additional individuals behind the “Doppelganger” campaign, under a new framework for restrictive measures in response to Russia’s hybrid activities and destabilising actions abroad. The “doppelganger campaign”, first uncovered by EU Disinfo Lab in September 2022, is a favoured FIMI tactic by the Kremlin, which impersonates reputable media outlets or personas seeking to deceive the public to consume its propaganda.
The EU and its Member States, our international partners and civil society organisations collaborate closely to expose and counter FIMI operations such as the “Doppelganger” campaign. This includes sharing effective measures and experiences in the application of national and EU legal instruments through the Rapid Alert System, conducting scientific research, and educating diverse groups of society about Russian tactics, techniques and procedures (TTPs). We do this to protect the integrity of our open information space and strengthen the resilience of our democracies.
We remain vigilant and aware that this campaign, and others like it, are part of Russia’s long-standing, persistent and systematic efforts to undermine international support for Ukraine and stoke divisions within the EU and with its partners across the world. We stand united with Ukraine and democratic forces globally in our commitment to counter this threat, in full respect and compliance with human rights and fundamental freedoms, making full use of the instruments and means at our disposal.
Background
An example of Russia’s ongoing efforts to deceive and interfere in public debate, the “Doppelganger” operation was launched in the aftermath of Russia’s full-scale invasion of Ukraine in February 2022, first uncovered by EU Disinfo Lab in September 2022. The impact of this effort remains limited. Estimates put the overall number of inauthentic websites over 700 and the number of misleading articles circulated via those websites in the tens of thousands. The Kremlin interference attempts included the 2024 European Parliament elections, though it failed to cause any disruption to the electoral process. Similar techniques were also detected in recent elections in Georgia and Republic of Moldova.
Making full use of the EU FIMI Toolbox, enabled by exchange of information in the EU’s Rapid Alert System, the EU and its Member States have taken a number of actions to respond and mitigate the Doppelganger campaign. These range from information to the media, and systematic exposure to the public via EUvsDisinfo; to EU restrictive measures targeting the Kremlin’s Social Design Agency and the Doppelganger network. National authorities have issued official statements strongly condemning the activities of Russian networks, detection, analysis, and have blocked relevant domain names. Our international partners, media, and civil society organisations from the FIMI defender community expose the attacks and provided public support toward the OSINT community. In addition, international partners such as the UK and US have publicly exposed and sanctioned Russian attempts to interfere via the Doppelganger campaign, imposing increased costs on the perpetrators.
How to spot Russia impersonation?
The “Doppelganger” operation has evolved in terms of scope, targeting several countries in multiple languages. The Kremlin and Russian state-affiliated actors use this sort of operation to create websites – or individual web pages - impersonating renowned news outlets and governmental websites, using a large number of inauthentic accounts or personas on social media platforms to deceive and re-direct the public to the inauthentic media websites.
Individual resilience to these threats requires understanding how to spot Russian impersonation.
Stay vigilant and look out for:
- Content posted on mainstream social media to seed the narrative: inauthentic accounts following specific socio-demographic criteria posting on their feeds. To strengthen their "opinion" and steal legitimacy, the inauthentic accounts include a URL to one of the Doppelganger impersonated media outlets. In turn, this creates the groundwork for even further amplification by the Russian ecosystem.
- Inauthentic webpages disguised as part of official news website: inauthentic accounts on social media spread links to articles created by Doppelganger. To increase the appearance of authenticity, they copy source code of the cloned media, including the design and fonts. However, looking closely at the URL you’ll see it’s disparities with the original, e.g. the URL extension. Browsing further on the website does actually bring readers to the genuine news outlet, as navigation links are copied from the original website in an attempt to further disguise the fake Doppelganger article.
- Amplification via comments and quote posts: a wider group of inauthentic accounts, less sophisticated, heavily share original posts from the first stage in comments section, notably on authentic accounts or pages with a large number of followers, or use quote posts without any modification. This technique artificially boosts the original contents visibility and potentially the impact it has to the audience, as well as make it accessible to authentic followers of popular accounts or pages.
- Dissemination via deceptive URL redirection: to expand the potential reach of fake content and to avoid moderation from the platforms. Inauthentic accounts use successive links to redirect users through several intermediary websites, before reaching the article published on a Doppelganger campaign website.
More information: