Russia’s 'Doppelgänger / RRN Network' clones Western media outlets in coordinated influence campaign

Since at least early 2022, a coordinated pro-Russian information operation has cloned the websites of legitimate Western media outlets and government pages to spread disinformation about Ukraine across Europe and beyond. Researchers at EU DisinfoLab, who first exposed the campaign in September 2022, named it Doppelganger for its repeated use of fake clones of authentic websites. A linked content portal, RRN (variously Reliable Recent News or Recent Reliable News), served as a repository for much of the fabricated material.

The operators registered dozens of typosquatted domain names closely resembling those of real publishers and copied their visual designs, then seeded forged articles, videos, and polls. Outlets impersonated included Bild, The Guardian, ANSA, and RBC Ukraine, among at least seventeen media providers, alongside spoofed government pages. The fabricated content pushed narratives demonising the Ukrainian government, alleging Nazism and corruption, claiming Western sanctions had failed, and portraying Ukrainian refugees as a burden, amplified by bot networks on X and other platforms.

In July 2023, France's VIGINUM, the state service countering foreign digital interference, published a detailed report confirming the operation's structure and a network of more than a thousand bots affiliated with RRN, and attributed the activity to two Russian firms, Social Design Agency and Structura National Technologies.

Official assessments by VIGINUM and EU institutions attribute Doppelganger/RRN to Russia-linked actors operating in support of Moscow's war against Ukraine, with two Russian companies, Social Design Agency and Structura, identified as operators. On 28 July 2023 the EU Council imposed sanctions, including asset freezes and travel bans, on seven individuals and five entities tied to the campaign. Direct Kremlin command is assessed rather than independently proven, but the convergence of French and EU findings, Meta's technical attribution, and subsequent US sanctions makes the state-sponsored character of the operation well established.