dti.domaintools.com 5/13/2026, 6:51:41 PM · via preferred

Doppelgänger network spreads Russian disinformation via Telegram

CyberSIXT Evidence Panel Source marked as original reporting
Threat Actor
Doppelgänger

ACCORDING to DomainTools Investigations, the Doppelgänger, also known as the SDA or Structura, is a Russian-linked influence operation that combines narrative design with technical infrastructure to publish, distribute, and amplify content across multiple platforms. The campaign uses a feeder website network, Telegram amplification, and coordinated X/Twitter reply activity to push narratives to Western audiences, supported by a layered redirect and tracking system.

Typical narrative waves reach about 1.5 to 2.7 million users, with larger campaigns potentially reaching 3 to 5 million, while individual operations often rely on disposable accounts and rapid domain regeneration to maintain persistence. The architecture separates content creation, hosting, and amplification, enabling rapid replacement of domains and accounts when disrupted, and leveraging Telegram channels such as Readovka and SolovievLive as major amplifiers to maximise reach.

The report notes links to broader state-aligned information activities and highlights the use of pseudo-media sites designed to resemble legitimate outlets, with narratives injected into conversations on X/Twitter to achieve broader discourse uptake.

View full article

Article by CyberSIXT