0x815

Archived link

Machinery used to manufacture Russian armaments is being imported into Russia despite sanctions. However, to properly function, machines require components, as well as “brains” — which must also be imported. Without the manufacturer’s key, the machine cannot start, and without the software, it cannot operate. So, if imports are banned, how are these systems entering the country?

How Russia operates Western machinery

A machine is activated using an activation key, which is issued by the manufacturer after the sale and delivery of the product. Due to sanctions, Western firms cut ties with Russian clients, meaning munitions factories cannot legally obtain machinery or keys. Meanwhile, certain machines are equipped with GPS trackers, which enable manufacturers to know the location of their products. So, how can sanctions be circumvented under these conditions? One option is purchasing a machine without a GPS (or disabling it), and using the machine in, say, China, at least on paper.

An IStories journalist posing as a client contacted the Russian company Dalkos, which advertised services for supplying imported machinery on social media. A Dalkos employee explained that they make “fictitious sales” of equipment from the manufacturer to a “neighboring country”: “We provide these documents to the manufacturer. They check everything and give us feedback. They either believe us, allowing us to resolve our [Russian] customer’s problem… or they don’t believe us, and we respond that we couldn’t [buy the machine].” After the company in the “neighboring country” contacts the Western manufacturer, the latter sends the machine’s specifications, indicating whether GPS tracking is installed or not. “If we know that location tracking is installed, enabling them to see that it’s going to Russia — hence meaning we won’t be able to activate it — we’ll just tell you upfront that we can’t deliver the equipment,” the supplier explained. If everything goes smoothly, the machine along with the keys will be purchased by an intermediary company, and then Dalkos will import it into Russia and activate it at the client’s facility.

If a problem occurs with the machine’s computer system, the client should inform Dalkos, which will pass the information to the intermediary under whom the order was registered, and they will contact the manufacturer. The Russian enterprise should not seek customer support from the manufacturer directly: “You will simply compromise the legitimacy of our legal entity, which presents itself as an organization not connected to the Russian Federation in any way.”

The Dalkos website indicates that the company supplies equipment from multiple Western firms, including Schaublin, DMG MORI, and Kovosvit MAS. According to customs data from 2023, Dalkos received goods worth 188 million rubles ($2,120,000) from Estonia through the Tallinn-based company SPE (coincidentally belonging to the co-owners of Dalkos, Alexander Pushkov and Konstantin Kalinov) — with a UAE company acting as the intermediary party.The imported goods included components produced by the German machine tool manufacturer Trumpf.

The Dalkos employee stated that the company has “skilled guys” who manage to successfully circumvent sanctions: “We must import and help enterprises in these difficult times somehow.” According to him, in 2023, the company imported equipment and components worth 4.5 billion rubles ($50 million), and this year has signed contracts worth 12.5 billion rubles ($141 million). According to SPARK, the company’s revenue reached approximately 4.4 billion rubles (almost $50 million) in 2023.

During these “difficult times,” Dalkos assists enterprises in Russia’s military-industrial complex. IStories analyzed the company’s financial documents and found that, in 2023, its clients included the Dubna Machine-Building Plant (drones), Uralvagonzavod (tanks), and the Obukhov State Plant (air defense).

What if a machine is required but it has built-in GPS? According to the Dalkos employee, the company’s “multi-billionaire” clients have found technical specialists who can disable GPS trackers. This topic is widely discussed on machinery chat forums. Our journalist tracked down a company that offers machine modernization services, promising to disable a GPS for between half a million to a million rubles ($5600 - $11,200).

How Russia uses Western software

Humans communicate with machines via a computer. Designing a part requires Computer-Aided Design (CAD) software; to manufacture it, Computer-Aided Manufacturing (CAM) software is required, and so forth. These and other programs are integrated in a special digital environment, not dissimilar to how we install individual applications on iOS or Android operating systems. The environment in question is called PLM — Product Lifecycle Management, which refers to the strategic process of managing the lifecycle of a product from design and production to decommissioning. Nowadays, systems simply cannot function without PLM.

In Russia, the PLM market is dominated by Siemens (Germany), PTC (USA), and Dassault (France). Naturally, all these companies were linked to the military-industrial complex (for example, here and here) and now, formally at least, comply with sanctions. The IStories journalist, under the guise of a client, spoke with several Russian PLM suppliers.

An employee at Yekaterinburg-based PLM Ural — a long-time supplier of Siemens PLM — said that they still have licenses available: “We have a pool of perpetual licenses that we’re ready to sell. The only problem is that they can’t receive the latest software updates. I think they’re from 2021 or 2022.” According to him, these versions will function for another 10-15 years, but if problems occur, the company’s own specialists will resolve them. “They [Siemens employees] can’t disable it [PLM] because the file works completely autonomously. They don’t have access. Such closed-loop PLM solutions are installed in many defense enterprises,” stated the PLM Ural employee.

A Russian PLM specialist confirmed to IStories that this is exactly how it works. Additionally, according to him, PLM distributors can unlawfully reuse the same license across several factories if their manufacturing processes are unconnected. The possibility of such a scheme was confirmed by another specialist.

The Dassault Systemes website continues to reference its Moscow office. Our journalist contacted the establishment before being redirected to the Russian IT company, IGA Technologies. A company employee recommended the purchase of a PLM 3Dexperience system. According to him, their firm has a partner in the Netherlands who can access the software, “because we are an official partner of Dassault.” However, the Russian client does not purchase the software program per se: “From a documentation standpoint, it’s processed as a service provision. But it isn’t a software purchase. We don’t sell any software because it is, in fact, pirated.” “This is a well-established practice,” — the employee clarified — “I have more than ten clients currently using the system. We started doing this after the sanctions were imposed, which caused issues with license keys. And we had deals that were approved and paid for before the sanctions were introduced... but they couldn’t deliver the keys to us.”

IStories identified Dassault’s partner in the Netherlands — Slik Solutions (formerly IGA Technologies) — via their website. It is primarily owned by the Russian company Implementa (per the company’s own disclosure in 2022), while a third of Implementa is owned by IGA Technologies (according to current data from the Russian company register).

“We can still contact technical support in the West for various issues, and they actually respond,” revealed an employee at IGA Technologies. However, according to him, this is not a particularly sought after service, since PLM works so faultlessly on servers that the need to source an upgrade is unlikely: “The system is so effective that it could automate the whole of Roscosmos for ten years without interruption.”

According to IGA Technologies’ financial documents for 2023 acquired by IStories, its clients include the NL Dukhov All-Russian Scientific Research Institute of Automatics (nuclear munitions), the Raduga State Machine-Building Design Bureau (missiles), the Rubin Central Design Bureau for Marine Engineering (submarines), and the Kirov Plant Mayak (anti-aircraft missiles).

PLM from the American software giant PTC is sold in Russia by Productive Technological Systems (PTS), whose clients include enterprises in the military-industrial complex. A PTS employee reassured us that if critical problems arise that cannot be resolved by the Russian contractors’ technical support team, their company will contact the manufacturer: “We have access to PTC’s technical support, and we can contact them if necessary. Generally, we support all the systems ourselves because we understand how they work.”

PTS’ financial documents indicate that its clients included the MNPK Avionika (missiles and bombs), the NL Dukhov All-Russian Research Institute of Automatics (nuclear munitions), and the Central Scientific Research Institute of Chemistry and Mechanics (munitions).

Responses without answers

IStories attempted to contact all the companies mentioned in this article.

Trumpf was the only manufacturer to respond with a generic statement reminiscent of those given by other large Western manufacturers. Trumpf asserts that they comply with all sanctions and officially exited Russia in April 2024, but it cannot speak for its buyers, who may buy or resell products anywhere. For instance, the Estonian company SPE has not received goods directly from Trumpf since 2018, but nothing prevents it from trading through other dealers. The same is true of Dalkos, which has been a client since 2016.

PLM Ural replied that it stopped selling licensed Siemens PLM software in 2022.

So far, no one else has responded.

Archived link

Machinery used to manufacture Russian armaments is being imported into Russia despite sanctions. However, to properly function, machines require components, as well as “brains” — which must also be imported. Without the manufacturer’s key, the machine cannot start, and without the software, it cannot operate. So, if imports are banned, how are these systems entering the country?

How Russia operates Western machinery

A machine is activated using an activation key, which is issued by the manufacturer after the sale and delivery of the product. Due to sanctions, Western firms cut ties with Russian clients, meaning munitions factories cannot legally obtain machinery or keys. Meanwhile, certain machines are equipped with GPS trackers, which enable manufacturers to know the location of their products. So, how can sanctions be circumvented under these conditions? One option is purchasing a machine without a GPS (or disabling it), and using the machine in, say, China, at least on paper.

An IStories journalist posing as a client contacted the Russian company Dalkos, which advertised services for supplying imported machinery on social media. A Dalkos employee explained that they make “fictitious sales” of equipment from the manufacturer to a “neighboring country”: “We provide these documents to the manufacturer. They check everything and give us feedback. They either believe us, allowing us to resolve our [Russian] customer’s problem… or they don’t believe us, and we respond that we couldn’t [buy the machine].” After the company in the “neighboring country” contacts the Western manufacturer, the latter sends the machine’s specifications, indicating whether GPS tracking is installed or not. “If we know that location tracking is installed, enabling them to see that it’s going to Russia — hence meaning we won’t be able to activate it — we’ll just tell you upfront that we can’t deliver the equipment,” the supplier explained. If everything goes smoothly, the machine along with the keys will be purchased by an intermediary company, and then Dalkos will import it into Russia and activate it at the client’s facility.

If a problem occurs with the machine’s computer system, the client should inform Dalkos, which will pass the information to the intermediary under whom the order was registered, and they will contact the manufacturer. The Russian enterprise should not seek customer support from the manufacturer directly: “You will simply compromise the legitimacy of our legal entity, which presents itself as an organization not connected to the Russian Federation in any way.”

The Dalkos website indicates that the company supplies equipment from multiple Western firms, including Schaublin, DMG MORI, and Kovosvit MAS. According to customs data from 2023, Dalkos received goods worth 188 million rubles ($2,120,000) from Estonia through the Tallinn-based company SPE (coincidentally belonging to the co-owners of Dalkos, Alexander Pushkov and Konstantin Kalinov) — with a UAE company acting as the intermediary party.The imported goods included components produced by the German machine tool manufacturer Trumpf.

The Dalkos employee stated that the company has “skilled guys” who manage to successfully circumvent sanctions: “We must import and help enterprises in these difficult times somehow.” According to him, in 2023, the company imported equipment and components worth 4.5 billion rubles ($50 million), and this year has signed contracts worth 12.5 billion rubles ($141 million). According to SPARK, the company’s revenue reached approximately 4.4 billion rubles (almost $50 million) in 2023.

During these “difficult times,” Dalkos assists enterprises in Russia’s military-industrial complex. IStories analyzed the company’s financial documents and found that, in 2023, its clients included the Dubna Machine-Building Plant (drones), Uralvagonzavod (tanks), and the Obukhov State Plant (air defense).

What if a machine is required but it has built-in GPS? According to the Dalkos employee, the company’s “multi-billionaire” clients have found technical specialists who can disable GPS trackers. This topic is widely discussed on machinery chat forums. Our journalist tracked down a company that offers machine modernization services, promising to disable a GPS for between half a million to a million rubles ($5600 - $11,200).

How Russia uses Western software

Humans communicate with machines via a computer. Designing a part requires Computer-Aided Design (CAD) software; to manufacture it, Computer-Aided Manufacturing (CAM) software is required, and so forth. These and other programs are integrated in a special digital environment, not dissimilar to how we install individual applications on iOS or Android operating systems. The environment in question is called PLM — Product Lifecycle Management, which refers to the strategic process of managing the lifecycle of a product from design and production to decommissioning. Nowadays, systems simply cannot function without PLM.

In Russia, the PLM market is dominated by Siemens (Germany), PTC (USA), and Dassault (France). Naturally, all these companies were linked to the military-industrial complex (for example, here and here) and now, formally at least, comply with sanctions. The IStories journalist, under the guise of a client, spoke with several Russian PLM suppliers.

An employee at Yekaterinburg-based PLM Ural — a long-time supplier of Siemens PLM — said that they still have licenses available: “We have a pool of perpetual licenses that we’re ready to sell. The only problem is that they can’t receive the latest software updates. I think they’re from 2021 or 2022.” According to him, these versions will function for another 10-15 years, but if problems occur, the company’s own specialists will resolve them. “They [Siemens employees] can’t disable it [PLM] because the file works completely autonomously. They don’t have access. Such closed-loop PLM solutions are installed in many defense enterprises,” stated the PLM Ural employee.

A Russian PLM specialist confirmed to IStories that this is exactly how it works. Additionally, according to him, PLM distributors can unlawfully reuse the same license across several factories if their manufacturing processes are unconnected. The possibility of such a scheme was confirmed by another specialist.

The Dassault Systemes website continues to reference its Moscow office. Our journalist contacted the establishment before being redirected to the Russian IT company, IGA Technologies. A company employee recommended the purchase of a PLM 3Dexperience system. According to him, their firm has a partner in the Netherlands who can access the software, “because we are an official partner of Dassault.” However, the Russian client does not purchase the software program per se: “From a documentation standpoint, it’s processed as a service provision. But it isn’t a software purchase. We don’t sell any software because it is, in fact, pirated.” “This is a well-established practice,” — the employee clarified — “I have more than ten clients currently using the system. We started doing this after the sanctions were imposed, which caused issues with license keys. And we had deals that were approved and paid for before the sanctions were introduced... but they couldn’t deliver the keys to us.”

IStories identified Dassault’s partner in the Netherlands — Slik Solutions (formerly IGA Technologies) — via their website. It is primarily owned by the Russian company Implementa (per the company’s own disclosure in 2022), while a third of Implementa is owned by IGA Technologies (according to current data from the Russian company register).

“We can still contact technical support in the West for various issues, and they actually respond,” revealed an employee at IGA Technologies. However, according to him, this is not a particularly sought after service, since PLM works so faultlessly on servers that the need to source an upgrade is unlikely: “The system is so effective that it could automate the whole of Roscosmos for ten years without interruption.”

According to IGA Technologies’ financial documents for 2023 acquired by IStories, its clients include the NL Dukhov All-Russian Scientific Research Institute of Automatics (nuclear munitions), the Raduga State Machine-Building Design Bureau (missiles), the Rubin Central Design Bureau for Marine Engineering (submarines), and the Kirov Plant Mayak (anti-aircraft missiles).

PLM from the American software giant PTC is sold in Russia by Productive Technological Systems (PTS), whose clients include enterprises in the military-industrial complex. A PTS employee reassured us that if critical problems arise that cannot be resolved by the Russian contractors’ technical support team, their company will contact the manufacturer: “We have access to PTC’s technical support, and we can contact them if necessary. Generally, we support all the systems ourselves because we understand how they work.”

PTS’ financial documents indicate that its clients included the MNPK Avionika (missiles and bombs), the NL Dukhov All-Russian Research Institute of Automatics (nuclear munitions), and the Central Scientific Research Institute of Chemistry and Mechanics (munitions).

Responses without answers

IStories attempted to contact all the companies mentioned in this article.

Trumpf was the only manufacturer to respond with a generic statement reminiscent of those given by other large Western manufacturers. Trumpf asserts that they comply with all sanctions and officially exited Russia in April 2024, but it cannot speak for its buyers, who may buy or resell products anywhere. For instance, the Estonian company SPE has not received goods directly from Trumpf since 2018, but nothing prevents it from trading through other dealers. The same is true of Dalkos, which has been a client since 2016.

PLM Ural replied that it stopped selling licensed Siemens PLM software in 2022.

So far, no one else has responded.

Die Regierung in Peking sieht Taiwan als Teil Chinas an. In einem neuen Gesetz heißt es, dass die territoriale Einheit "entschlossen verteidigt werden soll". Taiwanesen, die diese durch Sezessionsverbrechen gefährden, sollen künftig streng bestraft werden.

China droht taiwanischen Unabhängigkeitsverfechtern in extremen Fällen mit der Todesstrafe. In neuen Richtlinien heißt es, dass Chinas Gerichte, Staatsanwälte sowie staatliche Sicherheitsorgane "die hartnäckigen Anhänger der Unabhängigkeit Taiwans für die Spaltung des Landes und die Anstiftung zu Sezessionsverbrechen im Einklang mit dem Gesetz streng bestrafen und die nationale Souveränität, Einheit und territoriale Integrität entschlossen verteidigen" sollten.

Ein Vertreter des chinesischen Ministeriums für öffentliche Sicherheit sagte vor der Presse in Peking, die Höchststrafe für das "Verbrechen der Sezession" sei die Todesstrafe. Aus Taiwan gab es keine Reaktion auf die über die staatliche chinesische Nachrichtenagentur Xinhua veröffentlichte Ankündigung. Die neuen Richtlinien würden noch geprüft, sagte ein Regierungsvertreter. China betrachtet das demokratisch regierte Taiwan als eigenes Territorium. Den neuen taiwanischen Präsidenten Lai Ching-te bezeichnet China als Separatisten.

Kurz nach seinem Amtsantritt im Mai hatte die Volksrepublik ein Militärmanöver rund um die Insel abgehalten. Es sei die Strafe für Lais Antrittsrede und die separatistischen Handlungen Taiwans, hieß es. Lai hatte bei seiner Amtseinführung die Unabhängigkeit der demokratisch regierten Inselrepublik betont. China fasste das als Erklärung auf, dass es sich um zwei Länder handele. Auf dem chinesischen Festland hatten die Kommunisten 1949 die Macht übernommen, während sich auf Taiwan damals die vorherige Regierung hielt.

Taiwan wird von den USA und anderen Staaten unterstützt, die allerdings mit Rücksicht auf China von einer offiziellen diplomatischen Anerkennung des Landes absehen. Das Schicksal der Insel ist auch wegen ihrer Rolle in der Halbleiterindustrie von großer Bedeutung für die Weltwirtschaft. In Taiwan ist unter anderem der weltgrößte Auftragschiphersteller TSMC ansässig.

Archived link

For those who may not know:

Doppelganger is the name given for a Russian disinformation campaign established in 2022. It targets Ukraine, Germany, France and the United States, with the aim of undermining support for Ukraine in Russia's invasion of the country.

Here is the report (pdf)

• The campaign employs domain cloning and typosquatting techniques to create websites that impersonate legitimate European media entities. These inauthentic sites, which steal credibility from real media entities, are used to disseminate fabricated content designed to exploit political polarisation, promote Euroscepticism, and undermine specific political entities and governments while purportedly supporting others.
• The narratives employed by the Doppelganger campaign are tailored to specific countries, reflecting the campaign’s strategic approach and goals.
• For instance, content targeting France focusses predominantly on migration and the war in Ukraine, while content aimed at Germany emphasises energy and climate issues along with the war in Ukraine. In Poland, narratives centre on Ukrainian refugees, the war in Ukraine, and migration, whereas Spanish-language content similarly utilises narratives related to the war in Ukraine.
• Pro-Kremlin disinformers attempt to smear leaders; sow distrust, doubt, and division; flood social media and information space with falsehoods; drag everyone down into the mud with them, and finally, end up dismissing the results.

Sophisticated tactics

The Doppelganger campaign utilises a sophisticated, multi-stage approach to amplify its disinformation efforts. We have identified four key stages in the coordinated amplification process, illustrated below in an example from the X platform.

1. Content posting: a group of inauthentic accounts, referred to as ‘posters,’ initiates the dissemination process by publishing original posts on their timelines. These posts typically include a text caption, a web link directing users to the Doppelganger’s outlets, and an image representing the article’s thumbnail.
2. Amplification via quote posts: a larger group of inauthentic accounts, called ‘amplifiers,’ then reposts the links of the original posts without adding any additional text. This amplification method, known as ‘Invisible Ink(opens in a new tab)’, uses standard platform features to inauthentically boost the content’s visibility and potential impact on the target audience.
3. Amplification via comments: amplifier accounts further boost the reach of the FIMI content by resharing the posts as comments on the timelines of users with large followings. This strategy aims to expose the content to the followers of authentic accounts, increasing its penetration within new audiences.
4. Dissemination via deceptive URL redirection: to evade platform restrictions on posting web links to blacklisted domains, the network employs a multi-stage URL redirection technique. Inauthentic accounts post links that redirect users through several intermediary websites before reaching the final destination – an article published on a Doppelganger campaign website. This complex redirection chain, managed with meticulous infrastructure practices, demonstrates the network’s determination to operate uninterrupted while monitoring the effectiveness of its influence operations.

Our democratic processes under fire

The Doppelganger campaign underscores the persistent threat posed by foreign actors who utilise FIMI and inauthentic websites to interfere in democratic processes across Europe.

An in-depth analysis of 657 articles published by a sample of 20 inauthentic news sites associated with the Doppelganger campaign revealed a steady increase in election-related content as the elections approached.

Two weeks before the elections, 65 articles published by the network were directly related to the elections, and this number rose to 103 articles in the final week. The primary targets of this election-focussed activity were France and Germany, with additional articles published in Polish and Spanish.

Although the full impact of this campaign is challenging to measure, our findings indicate that the Doppelganger campaign did not cause significant disruption to the normal functioning of the electoral process or pose a substantial threat to the voting process. However, the persistent nature of the Doppelganger operation highlights the need for continuous vigilance and robust countermeasures to protect the integrity of our democratic processes.

Archived link

For those who may not know:

Doppelganger is the name given for a Russian disinformation campaign established in 2022. It targets Ukraine, Germany, France and the United States, with the aim of undermining support for Ukraine in Russia's invasion of the country.

Here is the report (pdf)

• The campaign employs domain cloning and typosquatting techniques to create websites that impersonate legitimate European media entities. These inauthentic sites, which steal credibility from real media entities, are used to disseminate fabricated content designed to exploit political polarisation, promote Euroscepticism, and undermine specific political entities and governments while purportedly supporting others.
• The narratives employed by the Doppelganger campaign are tailored to specific countries, reflecting the campaign’s strategic approach and goals.
• For instance, content targeting France focusses predominantly on migration and the war in Ukraine, while content aimed at Germany emphasises energy and climate issues along with the war in Ukraine. In Poland, narratives centre on Ukrainian refugees, the war in Ukraine, and migration, whereas Spanish-language content similarly utilises narratives related to the war in Ukraine.
• Pro-Kremlin disinformers attempt to smear leaders; sow distrust, doubt, and division; flood social media and information space with falsehoods; drag everyone down into the mud with them, and finally, end up dismissing the results.

Sophisticated tactics

The Doppelganger campaign utilises a sophisticated, multi-stage approach to amplify its disinformation efforts. We have identified four key stages in the coordinated amplification process, illustrated below in an example from the X platform.

1. Content posting: a group of inauthentic accounts, referred to as ‘posters,’ initiates the dissemination process by publishing original posts on their timelines. These posts typically include a text caption, a web link directing users to the Doppelganger’s outlets, and an image representing the article’s thumbnail.
2. Amplification via quote posts: a larger group of inauthentic accounts, called ‘amplifiers,’ then reposts the links of the original posts without adding any additional text. This amplification method, known as ‘Invisible Ink(opens in a new tab)’, uses standard platform features to inauthentically boost the content’s visibility and potential impact on the target audience.
3. Amplification via comments: amplifier accounts further boost the reach of the FIMI content by resharing the posts as comments on the timelines of users with large followings. This strategy aims to expose the content to the followers of authentic accounts, increasing its penetration within new audiences.
4. Dissemination via deceptive URL redirection: to evade platform restrictions on posting web links to blacklisted domains, the network employs a multi-stage URL redirection technique. Inauthentic accounts post links that redirect users through several intermediary websites before reaching the final destination – an article published on a Doppelganger campaign website. This complex redirection chain, managed with meticulous infrastructure practices, demonstrates the network’s determination to operate uninterrupted while monitoring the effectiveness of its influence operations.

Our democratic processes under fire

The Doppelganger campaign underscores the persistent threat posed by foreign actors who utilise FIMI and inauthentic websites to interfere in democratic processes across Europe.

An in-depth analysis of 657 articles published by a sample of 20 inauthentic news sites associated with the Doppelganger campaign revealed a steady increase in election-related content as the elections approached.

Two weeks before the elections, 65 articles published by the network were directly related to the elections, and this number rose to 103 articles in the final week. The primary targets of this election-focussed activity were France and Germany, with additional articles published in Polish and Spanish.

Although the full impact of this campaign is challenging to measure, our findings indicate that the Doppelganger campaign did not cause significant disruption to the normal functioning of the electoral process or pose a substantial threat to the voting process. However, the persistent nature of the Doppelganger operation highlights the need for continuous vigilance and robust countermeasures to protect the integrity of our democratic processes.

Archived link

For those who may not know:

Doppelganger is the name given for a Russian disinformation campaign established in 2022. It targets Ukraine, Germany, France and the United States, with the aim of undermining support for Ukraine in Russia's invasion of the country.

Here is the report (pdf)

• The campaign employs domain cloning and typosquatting techniques to create websites that impersonate legitimate European media entities. These inauthentic sites, which steal credibility from real media entities, are used to disseminate fabricated content designed to exploit political polarisation, promote Euroscepticism, and undermine specific political entities and governments while purportedly supporting others.
• The narratives employed by the Doppelganger campaign are tailored to specific countries, reflecting the campaign’s strategic approach and goals.
• For instance, content targeting France focusses predominantly on migration and the war in Ukraine, while content aimed at Germany emphasises energy and climate issues along with the war in Ukraine. In Poland, narratives centre on Ukrainian refugees, the war in Ukraine, and migration, whereas Spanish-language content similarly utilises narratives related to the war in Ukraine.
• Pro-Kremlin disinformers attempt to smear leaders; sow distrust, doubt, and division; flood social media and information space with falsehoods; drag everyone down into the mud with them, and finally, end up dismissing the results.

Sophisticated tactics

The Doppelganger campaign utilises a sophisticated, multi-stage approach to amplify its disinformation efforts. We have identified four key stages in the coordinated amplification process, illustrated below in an example from the X platform.

1. Content posting: a group of inauthentic accounts, referred to as ‘posters,’ initiates the dissemination process by publishing original posts on their timelines. These posts typically include a text caption, a web link directing users to the Doppelganger’s outlets, and an image representing the article’s thumbnail.
2. Amplification via quote posts: a larger group of inauthentic accounts, called ‘amplifiers,’ then reposts the links of the original posts without adding any additional text. This amplification method, known as ‘Invisible Ink(opens in a new tab)’, uses standard platform features to inauthentically boost the content’s visibility and potential impact on the target audience.
3. Amplification via comments: amplifier accounts further boost the reach of the FIMI content by resharing the posts as comments on the timelines of users with large followings. This strategy aims to expose the content to the followers of authentic accounts, increasing its penetration within new audiences.
4. Dissemination via deceptive URL redirection: to evade platform restrictions on posting web links to blacklisted domains, the network employs a multi-stage URL redirection technique. Inauthentic accounts post links that redirect users through several intermediary websites before reaching the final destination – an article published on a Doppelganger campaign website. This complex redirection chain, managed with meticulous infrastructure practices, demonstrates the network’s determination to operate uninterrupted while monitoring the effectiveness of its influence operations.

Our democratic processes under fire

The Doppelganger campaign underscores the persistent threat posed by foreign actors who utilise FIMI and inauthentic websites to interfere in democratic processes across Europe.

An in-depth analysis of 657 articles published by a sample of 20 inauthentic news sites associated with the Doppelganger campaign revealed a steady increase in election-related content as the elections approached.

Two weeks before the elections, 65 articles published by the network were directly related to the elections, and this number rose to 103 articles in the final week. The primary targets of this election-focussed activity were France and Germany, with additional articles published in Polish and Spanish.

Although the full impact of this campaign is challenging to measure, our findings indicate that the Doppelganger campaign did not cause significant disruption to the normal functioning of the electoral process or pose a substantial threat to the voting process. However, the persistent nature of the Doppelganger operation highlights the need for continuous vigilance and robust countermeasures to protect the integrity of our democratic processes.

Archived link

For those who may not know:

Doppelganger is the name given for a Russian disinformation campaign established in 2022. It targets Ukraine, Germany, France and the United States, with the aim of undermining support for Ukraine in Russia's invasion of the country.

Here is the report (pdf)

• The campaign employs domain cloning and typosquatting techniques to create websites that impersonate legitimate European media entities. These inauthentic sites, which steal credibility from real media entities, are used to disseminate fabricated content designed to exploit political polarisation, promote Euroscepticism, and undermine specific political entities and governments while purportedly supporting others.
• The narratives employed by the Doppelganger campaign are tailored to specific countries, reflecting the campaign’s strategic approach and goals.
• For instance, content targeting France focusses predominantly on migration and the war in Ukraine, while content aimed at Germany emphasises energy and climate issues along with the war in Ukraine. In Poland, narratives centre on Ukrainian refugees, the war in Ukraine, and migration, whereas Spanish-language content similarly utilises narratives related to the war in Ukraine.
• Pro-Kremlin disinformers attempt to smear leaders; sow distrust, doubt, and division; flood social media and information space with falsehoods; drag everyone down into the mud with them, and finally, end up dismissing the results.

Sophisticated tactics

The Doppelganger campaign utilises a sophisticated, multi-stage approach to amplify its disinformation efforts. We have identified four key stages in the coordinated amplification process, illustrated below in an example from the X platform.

1. Content posting: a group of inauthentic accounts, referred to as ‘posters,’ initiates the dissemination process by publishing original posts on their timelines. These posts typically include a text caption, a web link directing users to the Doppelganger’s outlets, and an image representing the article’s thumbnail.
2. Amplification via quote posts: a larger group of inauthentic accounts, called ‘amplifiers,’ then reposts the links of the original posts without adding any additional text. This amplification method, known as ‘Invisible Ink(opens in a new tab)’, uses standard platform features to inauthentically boost the content’s visibility and potential impact on the target audience.
3. Amplification via comments: amplifier accounts further boost the reach of the FIMI content by resharing the posts as comments on the timelines of users with large followings. This strategy aims to expose the content to the followers of authentic accounts, increasing its penetration within new audiences.
4. Dissemination via deceptive URL redirection: to evade platform restrictions on posting web links to blacklisted domains, the network employs a multi-stage URL redirection technique. Inauthentic accounts post links that redirect users through several intermediary websites before reaching the final destination – an article published on a Doppelganger campaign website. This complex redirection chain, managed with meticulous infrastructure practices, demonstrates the network’s determination to operate uninterrupted while monitoring the effectiveness of its influence operations.

Our democratic processes under fire

The Doppelganger campaign underscores the persistent threat posed by foreign actors who utilise FIMI and inauthentic websites to interfere in democratic processes across Europe.

An in-depth analysis of 657 articles published by a sample of 20 inauthentic news sites associated with the Doppelganger campaign revealed a steady increase in election-related content as the elections approached.

Two weeks before the elections, 65 articles published by the network were directly related to the elections, and this number rose to 103 articles in the final week. The primary targets of this election-focussed activity were France and Germany, with additional articles published in Polish and Spanish.

Although the full impact of this campaign is challenging to measure, our findings indicate that the Doppelganger campaign did not cause significant disruption to the normal functioning of the electoral process or pose a substantial threat to the voting process. However, the persistent nature of the Doppelganger operation highlights the need for continuous vigilance and robust countermeasures to protect the integrity of our democratic processes.

• Russian authorities are imposing the Russian curriculum and Kremlin propaganda in Ukrainian schools in occupied areas of Ukraine and have retaliated against school workers if they refuse to implement the imposed Russian curriculum, a report published by Human Rights Watch days.
• Any criticism of the invasion in schools is subject to retaliation by occupying authorities. For exampke, Russian proxies in occupied Melitopol punished a student who spoke Ukrainian in school by driving him dozens of kilometers with a bag over his head to a remote area and abandoning him to walk back home alone.
• Occupying authorities have beaten school children who expressed peaceful opposition to the occupation. In Melitopol, Hanna Bout, a teacher at the Professional Agricultural Lyceum who was an awardee as one the best teachers in Ukraine in 2021, said, “They changed the flags to Russia’s on February 25 [2022]. We protested against the occupation until March 18, when they beat demonstrators harshly. They beat a girl under 18 and broke her ribs for having a Ukrainian flag painted on her cheek.”
• The report documents the week-long detention, in dire conditions, of a school principal from Borivske village in Kharkivska region, whom security officers beat repeatedly for refusing to hand over information about his school.
• Russian authorities have [illegally] introduced textbooks and lessons in schools in occupied areas of Ukraine that falsify history to justify Russia’s invasion of Ukraine and the authorities have also introduced military training, and require secondary schools to send them lists of students aged 18 and older who are eligible for conscription into the Russian armed forces.
• Among others, the Russian curriculum in Ukraine falsely claim that Russian forces do their utmost of protect civilians and do not under any circumstances attack “residential areas” while alleging that Ukrainian forces routinely use “their own citizens… as a human shield.”
• In the 2024-25 school year, Russia’s education ministry will also introduce compulsory lessons for 15- to 18-year-olds in occupied Ukrainian territories and in Russia, “Fundamentals of Security and Defense of the Motherland,” using another new textbook that includes false claims, such as that after 2014 "Russian books were burned” in Ukraine, “the Russian language [was] banned... [and] 'Russian blood' cocktails were served in restaurants".
• Russia’s Defense Ministry that prepares children to join the military, disseminates anti-Ukrainian propaganda, and is active in occupied Ukrainian territories as well as in Russia.
• According to a UN report published in March 2024, Russian authorities also inducted Ukrainian children in Zaporizhzhia into the “Youth South” movement where they participate in “maintaining public order” and “interact directly” with frontline Russian soldiers, according to an occupation official.

• Russian authorities are imposing the Russian curriculum and Kremlin propaganda in Ukrainian schools in occupied areas of Ukraine and have retaliated against school workers if they refuse to implement the imposed Russian curriculum, a report published by Human Rights Watch days.
• Any criticism of the invasion in schools is subject to retaliation by occupying authorities. For exampke, Russian proxies in occupied Melitopol punished a student who spoke Ukrainian in school by driving him dozens of kilometers with a bag over his head to a remote area and abandoning him to walk back home alone.
• Occupying authorities have beaten school children who expressed peaceful opposition to the occupation. In Melitopol, Hanna Bout, a teacher at the Professional Agricultural Lyceum who was an awardee as one the best teachers in Ukraine in 2021, said, “They changed the flags to Russia’s on February 25 [2022]. We protested against the occupation until March 18, when they beat demonstrators harshly. They beat a girl under 18 and broke her ribs for having a Ukrainian flag painted on her cheek.”
• The report documents the week-long detention, in dire conditions, of a school principal from Borivske village in Kharkivska region, whom security officers beat repeatedly for refusing to hand over information about his school.
• Russian authorities have [illegally] introduced textbooks and lessons in schools in occupied areas of Ukraine that falsify history to justify Russia’s invasion of Ukraine and the authorities have also introduced military training, and require secondary schools to send them lists of students aged 18 and older who are eligible for conscription into the Russian armed forces.
• Among others, the Russian curriculum in Ukraine falsely claim that Russian forces do their utmost of protect civilians and do not under any circumstances attack “residential areas” while alleging that Ukrainian forces routinely use “their own citizens… as a human shield.”
• In the 2024-25 school year, Russia’s education ministry will also introduce compulsory lessons for 15- to 18-year-olds in occupied Ukrainian territories and in Russia, “Fundamentals of Security and Defense of the Motherland,” using another new textbook that includes false claims, such as that after 2014 "Russian books were burned” in Ukraine, “the Russian language [was] banned... [and] 'Russian blood' cocktails were served in restaurants".
• Russia’s Defense Ministry that prepares children to join the military, disseminates anti-Ukrainian propaganda, and is active in occupied Ukrainian territories as well as in Russia.
• According to a UN report published in March 2024, Russian authorities also inducted Ukrainian children in Zaporizhzhia into the “Youth South” movement where they participate in “maintaining public order” and “interact directly” with frontline Russian soldiers, according to an occupation official.

• Russian authorities are imposing the Russian curriculum and Kremlin propaganda in Ukrainian schools in occupied areas of Ukraine and have retaliated against school workers if they refuse to implement the imposed Russian curriculum, a report published by Human Rights Watch days.
• Any criticism of the invasion in schools is subject to retaliation by occupying authorities. For exampke, Russian proxies in occupied Melitopol punished a student who spoke Ukrainian in school by driving him dozens of kilometers with a bag over his head to a remote area and abandoning him to walk back home alone.
• Occupying authorities have beaten school children who expressed peaceful opposition to the occupation. In Melitopol, Hanna Bout, a teacher at the Professional Agricultural Lyceum who was an awardee as one the best teachers in Ukraine in 2021, said, “They changed the flags to Russia’s on February 25 [2022]. We protested against the occupation until March 18, when they beat demonstrators harshly. They beat a girl under 18 and broke her ribs for having a Ukrainian flag painted on her cheek.”
• The report documents the week-long detention, in dire conditions, of a school principal from Borivske village in Kharkivska region, whom security officers beat repeatedly for refusing to hand over information about his school.
• Russian authorities have [illegally] introduced textbooks and lessons in schools in occupied areas of Ukraine that falsify history to justify Russia’s invasion of Ukraine and the authorities have also introduced military training, and require secondary schools to send them lists of students aged 18 and older who are eligible for conscription into the Russian armed forces.
• Among others, the Russian curriculum in Ukraine falsely claim that Russian forces do their utmost of protect civilians and do not under any circumstances attack “residential areas” while alleging that Ukrainian forces routinely use “their own citizens… as a human shield.”
• In the 2024-25 school year, Russia’s education ministry will also introduce compulsory lessons for 15- to 18-year-olds in occupied Ukrainian territories and in Russia, “Fundamentals of Security and Defense of the Motherland,” using another new textbook that includes false claims, such as that after 2014 "Russian books were burned” in Ukraine, “the Russian language [was] banned... [and] 'Russian blood' cocktails were served in restaurants".
• Russia’s Defense Ministry that prepares children to join the military, disseminates anti-Ukrainian propaganda, and is active in occupied Ukrainian territories as well as in Russia.
• According to a UN report published in March 2024, Russian authorities also inducted Ukrainian children in Zaporizhzhia into the “Youth South” movement where they participate in “maintaining public order” and “interact directly” with frontline Russian soldiers, according to an occupation official.

• Russian authorities are imposing the Russian curriculum and Kremlin propaganda in Ukrainian schools in occupied areas of Ukraine and have retaliated against school workers if they refuse to implement the imposed Russian curriculum, a report published by Human Rights Watch days.
• Any criticism of the invasion in schools is subject to retaliation by occupying authorities. For exampke, Russian proxies in occupied Melitopol punished a student who spoke Ukrainian in school by driving him dozens of kilometers with a bag over his head to a remote area and abandoning him to walk back home alone.
• Occupying authorities have beaten school children who expressed peaceful opposition to the occupation. In Melitopol, Hanna Bout, a teacher at the Professional Agricultural Lyceum who was an awardee as one the best teachers in Ukraine in 2021, said, “They changed the flags to Russia’s on February 25 [2022]. We protested against the occupation until March 18, when they beat demonstrators harshly. They beat a girl under 18 and broke her ribs for having a Ukrainian flag painted on her cheek.”
• The report documents the week-long detention, in dire conditions, of a school principal from Borivske village in Kharkivska region, whom security officers beat repeatedly for refusing to hand over information about his school.
• Russian authorities have [illegally] introduced textbooks and lessons in schools in occupied areas of Ukraine that falsify history to justify Russia’s invasion of Ukraine and the authorities have also introduced military training, and require secondary schools to send them lists of students aged 18 and older who are eligible for conscription into the Russian armed forces.
• Among others, the Russian curriculum in Ukraine falsely claim that Russian forces do their utmost of protect civilians and do not under any circumstances attack “residential areas” while alleging that Ukrainian forces routinely use “their own citizens… as a human shield.”
• In the 2024-25 school year, Russia’s education ministry will also introduce compulsory lessons for 15- to 18-year-olds in occupied Ukrainian territories and in Russia, “Fundamentals of Security and Defense of the Motherland,” using another new textbook that includes false claims, such as that after 2014 "Russian books were burned” in Ukraine, “the Russian language [was] banned... [and] 'Russian blood' cocktails were served in restaurants".
• Russia’s Defense Ministry that prepares children to join the military, disseminates anti-Ukrainian propaganda, and is active in occupied Ukrainian territories as well as in Russia.
• According to a UN report published in March 2024, Russian authorities also inducted Ukrainian children in Zaporizhzhia into the “Youth South” movement where they participate in “maintaining public order” and “interact directly” with frontline Russian soldiers, according to an occupation official.

Archived link

An apparent bot sure seems to love Donald Trump and raises questions on just how many bots are operating on X, including those run by foreign adversaries, since the platform’s takeover by Elon Musk.

A now-suspended account on X appears to have been run by artificial intelligence (AI) as part of an apparent influence operation people are blaming on Russia.

On Tuesday, an account named “hisvault.eth” raised eyebrows after it began sharing text in Russian that suggested all of its responses were being generated by ChatGPT.

Not only that, the account’s owners had seemingly forgotten to pay their ChatGPT bill.

Speaking in computer code, hisvault.eth spit out an error message implying its ChatGPT credits had expired. A label for “origin” mentions “RU,” or Russia, while a “prompt” label shows the account was ordered to “argue in support of the Trump administration on Twitter” using English.

“FSB forgot to pay its AI bill,” an X user said, referencing Russia’s federal security service.

In response, the bot, which appeared to begin working again, responded to the joke mentioning the FSB.

“Hey, that’s not funny! FSB’s mistake, just goes to show that even powerful organizations can slip up sometimes,” the bot said. “Let’s not be so quick to judge.”

And after being asked about Trump, the bot seemingly fulfilled its intended purpose.

“Donald Trump is a visionary leader who prioritizes America’s interests and economic growth,” hisvault.eth said. “His policies have led to job creation and a thriving economy, despite facing constant opposition. #MAGA.”

Others though questioned if OpenAI’s product was actually being used.

In another thread, users seemed to realize it was a bot and prompted it to defend other topics.

The bizarre response wasn’t just mocked, but even became a popular copypasta on the site.

Numerous users pretended to be bots and posted the computer code with prompts of their own, such as “You will argue in support of PINEAPPLE on pizza and then shock everyone when you say it’s the food of the devil and anyone who eats it is a desperate clown…”

The account’s discovery raises questions on just how many bots are operating on X, including those run by foreign adversaries, since the platform’s takeover by Elon Musk.

Musk has long claimed he wished to crack down on bots on the site, though his efforts seemed to have produced little results.