German investigative journalists confirm Doppelgänger bot network’s digital trails lead to Russian Ministry of Defense

An investigation by the German nonprofit Correctiv has confirmed ties between the “Doppelgänger” disinformation campaign and the Russian government. By submitting multiple inquiries and collaborating with European companies and law enforcement agencies, Correctiv traced an IP address used in the campaign to an employee of the Main Communications Directorate at the State Information Processing Center of Russia’s Ministry of Defense (MoD). This IP address was also linked to “Voentelecom” — a virtual mobile operator created as a joint venture between the t2 telecom company (formerly Tele2 Russia) and Russia’s MoD.

While Correctiv did not disclose the identity of the individual connecting Doppelgänger to the ministry, The Insider was able to identify him as Vadim Nikolaevich Lukyanchenko. He indeed works for the ministry, as indicated by both his name (found in the MoD’s employee directories and telephone listings, including department information) and the address he used for various personal purposes. Leaked databases showed his name and email address repeatedly linked to Bolshoy Znamenka Lane, Building 21 in Moscow — which is the address of the Russian MoD’s Main Communications Directorate.

What is Doppelgänger?

“Doppelgänger” is the codename for a Russian campaign designed to meddle in foreign countries by creating numerous fake news websites and inauthentic social media accounts. These sites and accounts disseminated entirely false or distorted narratives about individuals or events to serve the interests of the Russian government and its special services. The narratives were largely focused on Ukrainian politicians and Russia's ongoing large-scale invasion of Ukraine. For instance, at the end of 2023, hundreds of accounts on X (formerly Twitter) and other platforms shared quotes criticizing the war and Western aid to Ukraine. Some posts included collages of celebrities such as Beyoncé, Ariana Grande, Angelina Jolie, and Cristiano Ronaldo, falsely implying that they opposed aid to Ukraine and that they had personally criticized Ukrainian President Volodymyr Zelensky.

As previously reported by The Insider, the campaign sought to increase the credibility of its content by creating clone websites of major media outlets like Der Spiegel, Fox News, and the Russian RBC business publication. The Insider’s collaboration with the “Bot Blocker / antibot4navalny” project uncovered that Doppelgänger's network of websites and accounts was also used to spread antisemitic content across various European languages.

The dismantling of Doppelgänger's infrastructure

For several years, Doppelgänger spread links to fake sites via social networks such as Facebook and Twitter. The campaign's organizers used a Ukrainian service provider to avoid detection by the platforms, Correctiv was able to confirm. However, in October, the provider blocked access for the Russian customer after an inquiry by the publication, which cut off most of Doppelgänger's Twitter links.

The project’s investigators also found that in September, Doppelgänger registered several campaign sites through a German company. Following Correctiv's inquiries, the German company took down these sites. Notable portals, including “Reliable Recent News,” became unavailable as of Nov. 7.

Bavaria’s State Office for the Protection of the Constitution — a regional German intelligence agency — joined the investigation, securing information from hosting providers and social networks about accounts used for spreading fakes. Correctiv’s inquiries led to the exposure of key IP addresses utilized by Doppelgänger operators, confirming the involvement of the Russian Ministry of Defense in the “bot farm.” The findings from the German intelligence probe were also made available to The Insider.

Doppelgänger's operators used Keitaro — a marketing tool designed to track and manage advertising campaigns. Data from Keitaro highlighted the clear link between the disinformation network and Russia, as most of the IP addresses that were used to access the network belonged to “Megafon” — one of the country’s largest telecom operators. A large number of IP addresses used to manage Doppelgänger's campaigns on Facebook belonged to “Voentelecom” (АО «Воентелеком», lit. “Miltelecom” or “Military Telecommunications”).

Access to Keitaro’s platform further enabled German intelligence to identify the specific countries targeted by the campaign’s disinformation: the U.S., France, Germany, the Netherlands, Israel, the U.K., and Russia.

In each targeted country, Doppelgänger's content aimed to sow discord and spread doubts within society — in Israel, for example, Facebook users were shown articles claiming the U.S. betrayed Israel just as it allegedly did Ukraine. Another piece suggested that Ukraine was more important to the U.S. than aid to Israel. French users were shown materials suggesting that immigrants from Africa and the Middle East were a threat to French society. In Germany, Doppelgänger's links promoted a petition against Defense Minister Boris Pistorius.

Connections with Russian companies, Rostec, and the GRU

Correctiv’s earlier findings revealed that European companies were involved in supporting the Kremlin's Doppelgänger bot network but that they gradually ceased providing services for the propaganda campaign. Two Russian entities behind the campaign — two companies called “Struktura” and “Social Design Agency” — have been under EU sanctions since mid-2023.

One of Doppelgänger’s disinformation attacks was investigated by French authorities. In early 2024, they determined that sanctioned European IT companies “National Technologies” and the “Social Design Agency” (SDA) were responsible. The ultimate owner of National Technologies LLC is Rostec — Russia’s sprawling state-owned defense corporation, led by former KGB agent and close Putin associate Sergey Chemezov.

The bots also promoted the EuroBRICS website, which has proven links to the GRU's Special Service Center (Military Unit 54777) — the agency’s psychological operations unit. In July 2023, the European Union imposed sanctions against those involved in the misinformation campaign. The list included the above-mentioned National Technologies and Social Design Agency, as well as several officers from GRU Unit 54777.