Mirror Maze
Doppelganger Network Analysis

Doppelganger is a Russian state-sponsored influence operation that began in May 2022, shortly after Russia's invasion of Ukraine.1 The campaign represents one of the most sophisticated media impersonation efforts ever documented, creating counterfeit websites that closely mimic legitimate Western news outlets including The Washington Post, Fox News, Der Spiegel, and The Guardian.2 According to Meta, it is the "largest" and "most aggressively persistent" Russian-origin malign influence network the company has ever encountered.3

The operation is attributed to the Social Design Agency (SDA) and Structura National Technologies, two Russian companies operating under the direction of the Kremlin's Presidential Administration, specifically First Deputy Chief of Staff Sergei Kiriyenko.4 Internal documents obtained by investigators reveal the campaign's stated objective was "International Conflict Incitement"—escalating tensions in U.S.-allied nations while promoting Russian interests.1 The operation employed AI tools including ChatGPT to generate and translate content at scale, with OpenAI eventually removing accounts linked to the campaign in May 2024.5

On September 4, 2024, the U.S. Department of Justice announced the seizure of 32 internet domains used by Doppelganger and charged two Russian nationals—Kostiantyn Kalashnikov and Elena Afanasyeva—with conspiracy to commit money laundering and violating the Foreign Agents Registration Act.4 The DOJ affidavit revealed a $10 million scheme to pay American social media influencers to distribute Russian propaganda without disclosing foreign funding, with content receiving over 16 million YouTube views.4 The operation specifically targeted swing state voters, as well as niche communities including LGBTQ+ individuals, agricultural workers, and Jewish Americans with tailored divisive messaging.1

Despite extensive law enforcement action, researchers at Recorded Future continue tracking over 2,000 active inauthentic social media accounts linked to the network.2 In December 2024, the U.S. Treasury Department imposed sanctions on SDA, Structura, and associated individuals for attempted interference in the 2024 presidential election.6 Analysis by the Centre for Eastern Studies notes that while engagement from authentic users has been limited, the operation represents a persistent, evolving threat that increasingly leverages generative AI and creates entirely fabricated news outlets rather than simply impersonating existing media—a tactical shift designed to evade detection and establish long-term influence networks.25