CyberSIXT Search
Original

dti.domaintools.comdti.domaintools.com

Doppelgänger network spreads Russian disinformation via Telegram

According to DomainTools Investigations, the Doppelgänger, also known as the SDA or Structura, is a Russian-linked influence operation that combines narrative design with technical infrastructure to publish, distribute, and amplify content across multiple platforms. The campaign uses a feeder website network, Telegram amplification, and coordinated X/Twitter reply activity to push narratives to Western audiences, supported by a layered redirect and tracking system.

Typical narrative waves reach about 1.5 to 2.7 million users, with larger campaigns potentially reaching 3 to 5 million, while individual operations often rely on disposable accounts and rapid domain regeneration to maintain persistence. The architecture separates content creation, hosting, and amplification, enabling rapid replacement of domains and accounts when disrupted, and leveraging Telegram channels such as Readovka and SolovievLive as major amplifiers to maximise reach.

The report notes links to broader state-aligned information activities and highlights the use of pseudo-media sites designed to resemble legitimate outlets, with narratives injected into conversations on X/Twitter to achieve broader discourse uptake.

Sources

On this device

Following

Intel

VendorsThreat actorsResearch reports

Settings

CyberSIXT summarises security news every 30 minutes.

↑↓ move↵ open⌘C copy CVE IDEsc close

Keyboard shortcuts

Everything works with a mouse or touch. Shortcuts are a faster path.

Search ⌘K
Search /
Next item J
Previous item K
Go to Today GT
Go to News GN
Go to CVEs GC
Go to Briefing GB
Reduce motion on this device