News
The Kremlin's online network for spreading fake news has begun circulating pseudo-journalistic articles detailing those responsible for the terrorist attack on Moscow’s Crocus City Hall. These articles tell the reader that Ukraine, the U.S., the UK’s Secret Intelligence Service (MI-6), and the so-called “collective West” at large were to blame. The bots are also denouncing claims by the United States government that ISIS was behind the attack, according to analysis carried out by the Bot Blocker / antibot4navalny project (data made available to The Insider).
Who is behind the fakes?
The scheme used to distribute the material indicates that the articles are being spread by the Doppelgänger bot network (also known as “RRN”), previously exposed by The Insider (1, 2, 3, 4). As with Doppelgänger’s previous campaigns, the “media” being used to spread the current disinformation include:
- spiegel.ltd
- grenzezank.com
- hauynescherben.net
- meisterurian.io
- onnam.life
- and many others
A familiar pattern of “two-tier bots” is also being used: some bots post content on their own, while others share it en masse on Twitter (now known as X) in the comments to other people's posts on completely unrelated topics — such as football matches or TV shows. The network also uses intermediate redirects, with the scope limited by the user's geographic location.
According to a report by Facebook parent company Meta Platforms, the spam attack was carried out by the Russian IT companies National Technologies and Social Design Agency (Агентство Социального Проектирования), both of which which fall under EU sanctions. The ultimate owner of National Technologies is Rostec — Russia’s state-owned defense conglomerate, which is headed by former KGB agent Sergey Chemezov, a close friend of Vladimir Putin.
The bots also promoted the EuroBRICS website, which has proven links to the GRU's Special Service Center (Military Unit 54777). In July 2023, the European Union imposed sanctions against those involved in the disinformation campaign, which included the aforementioned National Technologies, Social Design Agency, as well as several officers of the GRU’s Unit 54777.
The disinfo is being distributed in English, German, Arabic, Spanish, French, German, Italian, Polish, Spanish, and Hebrew. Bot Blocker notes that this is the first time the network has been observed using multiple languages, as the Kremlin’s propaganda appears to be expanding its reach across a wider range of Western audiences.
What kind of propaganda are the bots spreading and how?
A clone of the German publication Der Spiegel published a piece titled “Legalized Terrorism. A terrorist attack in Russia raises the question of Ukraine's cooperation with Islamist terrorist groups.”
But the network is not only spreading Kremlin narratives on clones of well-known media outlets — Doppelgänger also has its own sites that look like regular publications. The most notable of these is the Italian-language portal Il Correspondente. An article about the terrorist attack, published there under the headline “Terror returns to Moscow,” claims: “The Kyiv regime bears direct responsibility for the massacre in Crocus. Ukraine has become a global center for recruitment and training of terrorist cells by the United States and Great Britain.”
Article titled “Legalized Terrorism. A terrorist attack in Russia raises the question of Ukraine's cooperation with Islamist terrorist groups” posted on a cloned Der Spiegel website
In another piece, the “author” claims that the U.S. and Ukraine were behind the attack because “the terrorists behaved like trained soldiers and used military tactics typical of mercenaries.” It also noted that the suspects had driven in the direction of Ukraine after the shooting, a piece of information that was previously voiced by Russia’s security forces.
The network's websites also posted that the West was deliberately spreading “fake news” that ISIS was behind the attack: «The most surprising thing is the West's reaction to what is happening. Without expressing condolences, the British authorities almost immediately after the attack said that Ukraine was not involved in the massacre in Crocus. Kyiv, in turn, began actively spreading information about the involvement of ISIS militants in the explosions and shooting of civilians without providing any evidence. The New York Times published a fake statement by ‘Islamic State’ terrorists, in which they claimed to be the organizers of the terrorist attack, but used a template that ‘Islamic State’ has not used for several years.”
On the same night — March 23-24, approximately 24 hours after the incident — when the narrative about the West's responsibility for the terrorist attack was being promoted in various languages, the bot network also spread posts aimed at Ukrainian audiences calling for street protests. The posts urged Ukrainians to demand that the Ukrainian authorities rotate or demobilize soldiers in the AFU (Armed Forces of Ukraine). This is an example of one of these posts, made by a fake account:
Here’s what the Doppelgänger network has spread previously
The Doppelgänger network is frequently active, most often in connection with the war in Ukraine. For example, the network sent out fake quotes from global celebrities, including Beyoncé, Oprah Winfrey, and Cristiano Ronaldo, purportedly voicing their outraged demands to stop Western aid to Kyiv.
In November 2023, the bots circulated photos of buildings in France adorned with Stars of David — symbols painted on Jewish homes as a warning of potential pogroms. Citing data from the Bot Blocker project, The Insider highlighted that the same accounts were responsible for circulating pro-Russian publications, indicating the involvement of an identical bot network in the distribution of these photos.
In addition to its anti-Ukrainian posts, the network has also spread other anti-Semitic content. Masquerading under the guise of expressing “deep concern,” hundreds of bots shared a video allegedly from the Turkish nationalist group Grey Wolves (Bozkurtlar). In the video, terrorists threatened to replicate an attack on Jews at the 2024 Olympics in Paris — one reminiscent of the massacre at the 1972 Munich Olympics, in which 17 people, including 11 members of the Israeli national team, were killed.
After Vladimir Putin’s “re-election” on March 18, Doppelgänger launched an information campaign that was likely intended to create an aura of legitimacy around the presidential election held in Russia. A report by the independent publication Agentstvo (“The Agency” citing Bot Blocker detailed the information campaign. Written in English, French, German and Ukrainian, the tweets involved three theories about the election. The first was that Russia had held a competitive process, with many Russians actually supporting Vladimir Putin as part of Russia’s purported long democratic tradition. The other two were related to Ukraine: the first claimed that the Ukrainian authorities had made a mistake by cancelling their own elections, and the second argued that Ukraine should not “cancel” everything Russian — including Russian culture.