5 September 2024

US seizes 32 domains linked to Russian Doppelganger influence campaign


US seizes 32 domains linked to Russian Doppelganger influence campaign

US authorities have announced the ongoing seizure of 32 internet domains used in a Russian government-directed foreign influence campaign known as “Doppelganger.” The operation is said to be in violation of US money laundering and criminal trademark laws. The domains, used to disseminate propaganda and mislead international audiences, were seized as part of a broader effort to disrupt Russia’s attempts to interfere in the 2024 US Presidential Election.

According to an FBI affidavit, Russian entities Social Design Agency (SDA), Structura National Technology (Structura), and ANO Dialog, were operating under the directive of the Russian Presidential Administration. These organizations, controlled by First Deputy Chief of Staff Sergei Vladilenovich Kiriyenko, were involved in covertly spreading pro-Russian propaganda, aiming to erode global support for Ukraine, promote Russian policies, and influence elections in the US and abroad.

The Doppelganger campaign involved cybersquatted domains, a tactic where perpetrators registered domains that mimicked legitimate news websites to trick users into consuming Russian government messaging.

In some cases, Doppelganger also created entirely new media brands like "Recent Reliable News" to push their content. The campaign used influencers, social media ads, and fake profiles posing as non-Russian citizens to spread propaganda while concealing its true source.

Although the primary focus of the campaign was US audiences, it also targeted other countries, including Germany, Mexico, and Israel.

As part of a coordinated response, the US Treasury Department designated 10 individuals and two entities involved in the campaign.

Additionally, the US Department of Justice charged two Russian nationals—31-year-old Kostiantyn Kalashnikov and 27-year-old Elena Afanasyeva—with conspiracy to violate the Foreign Agents Registration Act and conspiracy to commit money laundering. Both individuals remain at large.

Kalashnikov and Afanasyeva, allegedly employed by the Russian state media outlet RT (formerly Russia Today), are accused of covertly funding a Tennessee-based content creation business to the tune of $10 million.

This business is believed to have produced over 2,000 English-language videos on topics such as immigration and inflation, which were viewed more than 16 million times on YouTube since November 2023. The creators of these videos did not disclose their connection to RT, and Afanasyeva reportedly played a direct role in editing and distributing the content using fake identities.


Back to the list

Latest Posts

What is Vulnerability Management? A Beginner's Guide

What is Vulnerability Management? A Beginner's Guide

In this article will try to cover basics of vulnerability management process and why it is important to every company.
11 September 2024
Cyber Security Week in Review: September 6, 2024

Cyber Security Week in Review: September 6, 2024

In brief: the US charges Russian GRU hackers for attacks on Ukraine, Apache, Cisco, Zyxel patch high-risk flaws, Google fixes Android zero-day, and more.
6 September 2024
Threat actors using MacroPack Red Team framework to deploy Brute Ratel, Havoc and PhantomCore

Threat actors using MacroPack Red Team framework to deploy Brute Ratel, Havoc and PhantomCore

Some of the documents appeared to be part of legitimate Red Team exercises, while other were intended for malicious purposes.
5 September 2024