A coordinated network linked to Russian actors has spread misinformation about the war in Ukraine for months. A report-led impact operation described as a transparency and media-monitoring effort exposed how fabricated articles, videos, polls, and other content were created to mislead readers and then amplified by a wave of fake accounts on major platforms. The tactic relied on impersonation and the appearance of legitimacy to push a particular narrative.
The operation, reportedly coordinated from Russia, began to amplify its messaging in May of the year. It sought to cast the Ukrainian conflict in terms favorable to Moscow, suggesting that Ukraine or its allies were under wrongfully framed influence. The propagandists used clones that looked like credible outlets, echoing familiar claims and repeating the same false accusations associated with government misuse of power. Narratives portraying Ukraine as a Nazi threat or depicting alleged massacres were recirculated as if they were verified facts.
#DOPELGANGER: How did actors based in Russia clone legitimate media outlets from multiple countries to spread disinformation aimed at weakening support for Ukraine?
Scholarly analysis indicates that the network purchased web domains with names resembling real media outlets and tailored the design of those pages to mimic authentic sites. This approach is a common method in disinformation campaigns and is part of a broader, opaque industry that handles substantial sums. Coordinated accounts on platforms like Facebook and Twitter acted as amplifiers, pushing these narratives to a wider audience. Readers could encounter Russian frauds presented as rigorous, verified journalism.
“Constant Threat”
The campaign surfaced again in late August after reporting by a German media outlet highlighted major media groups in Europe and beyond. Among the outlets named were The Guardian, 20 Minuten, Ansa, and Bild, with the claim that Europe’s leading papers were involved in the manipulation. The investigation, however, did not find evidence that this particular maneuver had affected Spanish media, though it underscored a broader pattern of cross-border influence operations.
EU DisinfoLab did not attribute the operation to a single actor but noted strong indicators pointing to Russian-origin participants. Investigators traced actions such as the purchase of fake domains and the production of propaganda videos to entities based in that country. Nevertheless, the NGO stressed that a false flag operation could not be completely ruled out. The manipulation campaign remains active, described as an ongoing threat to media integrity and public discourse.
The researchers urged authorities to take preventive steps to curb such attacks. After months of alleged privacy and data-usage violations using EU-based servers and software, concerns were raised about the lack of consequences for those responsible. This commentary came from a leading figure at EU DisinfoLab, reflecting a call for stronger oversight and rapid action to halt similar campaigns in the future.