‘Doppelganger’: Russia’s Ongoing Attacks on Western Internet Sites

Concerned about the potential use of the internet as a vehicle for interfering with the 2022 French Presidential election process, the French government created VIGINUM, a service for surveillance and protection against foreign digital interference, in July 2021.

Following Russia’s full-scale invasion of Ukraine, the French government agency turned its attention to internet-based disinformation campaigns aimed at discrediting Western support for Ukraine. The agency monitored a wide range of platforms for more than a year and identified a concerted campaign entailing the creation of fake sites and social media accounts that posted pro-Russian content and attacked Ukraine and its leaders.

In a press conference on Tuesday, June 13, French Foreign Minister Catherine Colonna gave details of the results of the defensive actions taken by France to prevent internet attacks and said that this had prevented a digital attack on her ministry’s own website. She said that this was part of a concerted disinformation campaign by Russian figures, which likely included state actors, embassies and cultural centers against media outlets in France and nine other countries in Europe, the Middle East and the Americas.

VIGINUM worked in parallel with and built on the work of the Belgium-based anti-disinformation NGO “EU DisinfoLab,” which had also been working on identifying Russian disinformation campaigns against the media. The NGO coined the term “Doppelganger” after they had found in 2022 that there were attacks on at least 17 media providers, including from France, Germany, the UK and other European countries, using multiple clones of the target sites, with the same designs and with domain names close to the originals.

Other Topics of Interest

Ukraine Fires First Long-Range US Missiles into Russia, Kremlin Vows Response

Russia reacted quickly with angry rhetoric to Ukraine’s first strikes inside the country using American-made long-range weapons after Biden loosened restrictions on their use over the weekend.

VIGINUM found that the strategy went well beyond just the media with similar tactics being used against government websites. The campaign was carried about by “Russian actors” with “state entities or entities affiliated to the Russian state,” such as Russian embassies and cultural centers. They then “actively” participated in amplifying its impact, according to Colonna.

Fake sites assumed the identity of legitimate media, national government, and EU sites, using a technique known as “typosquatting” – by which the hacker establishes a site or sites that replicate the appearance and have domain names similar to the target user, so someone who incorrectly types in the website address is directed to the fake site. The Minister said that, to date, VIGINUM had uncovered a total of 355 such domain names, some of which included links to the actual target site to further convince users of their authenticity.

In addition to this tactic, Russia has set up a number of stand-alone websites responsible for a host of fake stories, some of which had then been picked up by mainstream media thinking them to be real. She named two such sites as being particularly active: “Recent Reliable News (RRN)” and “War on Fakes.” Stories on these sites were further disseminated by Russian State media, by social media bots on Twitter and through at least 160 Facebook accounts.

These fake sites had proclaimed four main themes: Western sanctions against Russia were ineffective and were more damaging to Western prosperity; Western states and their media were motivated by widescale Russophobia; Ukraine was led by neo-Nazis and its armed forces were guilty of barbarism and war crimes; welcoming Ukrainian refugees to European states would negatively affect social and economic cohesion.

Recent stories have included: claims that Paris had been implicated in war crimes in Ukraine; in another that a radioactive cloud was drifting into Europe after Ukrainian forces had fired depleted uranium armor-piercing rounds; a news story that claimed to have uncovered a secret plan by US President Joe Biden “to destroy Europe”; and plans for France to introduce a “security tax” in France to pay for its contributions to the war in Ukraine.

While, for obvious reasons, VIGINUM focused on French sites and Francophone nations in Africa, where the Wagner private military company was active, it found that media sites in other European nations, particularly Germany, the UK, Italy and the Baltics, were being attacked in the same way.

“The campaign is a new illustration of the hybrid strategy that Russia is implementing to undermine the conditions for peaceful democratic debate and therefore undermine our democratic institutions,” Colonna said.

However, she insisted that “no attempt at manipulation will deter France from supporting Ukraine in the face of the Russian war of aggression.”