Russia's Operation Doppelganger, discovered in September 2022, aims to undermine support for Ukraine and promote Russian propaganda. Within its framework, propagandists create copies of media sites and government agencies to distribute their content on social networks. In December 2022, Meta linked the campaign to Russian companies Struktura and Social Media Agency, which led to EU sanctions. Subsequent investigations revealed that the fake sites targeted different audiences, including French-speaking, English-speaking and German-speaking social media users. The continuation of this campaign demonstrates a strategy to exploit political and social vulnerabilities at the global level.

The Reset Tech research team monitors current events within the operation on the social network X (formerly Twitter). In June 2024, they noticed an increase in activity, including a new tactic: the use of trending hashtags to promote video content in tune with Russian propaganda. They often use hashtags that are not related to the content being shared, such as those related to the Euro 2024 football championship. This tactic is focused on increasing the organic visibility of the content.

Since June 3, a network of 250 anonymous and inauthentic accounts on X has been activated to amplify Kremlin messages, marking a new phase in a long-running campaign on the platform. These accounts belong to several distinct groups, each of which shows signs of coordinated behavior, such as content similarity, simultaneous activation, and overall similar appearance. Some of these accounts were created recently, others are old accounts that have been modified to suit the needs of the campaign. They publish content in German, French, English, Turkish and Russian. Earlier in 2024, Reset Tech discovered groups of accounts that posted similar content in Hebrew and Arabic.

A new aspect of the operation involves the use of verified accounts. In this phase of the campaign, 119 verified X accounts were identified. This raises serious concerns about the platform's monetization practices and the potential abuse of verified account status to enhance coordinated disinformation efforts. This is particularly relevant in light of the European Commission's preliminary findings that the practice is inconsistent with the EU Digital Services Directive (DSA), indicating that “there is evidence that fraudsters are abusing the status of verified accounts to mislead users”.