Executive Summary

The German federal elections, scheduled for February 23, 2025, are the target of malign influence operations linked to Russia and Russia-based actors. As of mid-February 2025, Insikt Group assesses that, despite their persistence, these efforts have very likely not meaningfully altered voter behavior or shaped public opinion in a manner advantageous to Russias broader geopolitical interests, consistent with assessments of Russian meddling attempts in previous German election cycles.

The influence operations and corresponding networks tracked in this report Doppelgnger, Operation Overload, CopyCop, Operation Undercut, and the Russia-based Foundation to Battle Injustice are longstanding and at least partially Kremlin-funded. These operations almost certainly seek to incite and escalate German domestic socio-political conflicts, pollute the German information space by introducing manipulated content, foster criticism of the United States (US) and European Union (EU) and European integration, and undermine North Atlantic Treaty Organization (NATO) cohesion in line with the Kremlins strategic objectives.

The 2025 German election cycle marks a period of evolution for several of these operations, while core narratives remain unchanged. For example, Doppelgnger and Operation Overload have expanded beyond mainstream social media to Bluesky Social (Bluesky), in an attempt to capture migrating audiences. Doppelgnger and CopyCop have launched new brands and websites to project influence and reinforce messaging in the face of intensified scrutiny of their operations. Operation Overload continues to use artificial intelligence (AI)-based tools, including the use of AI-enabled voice cloning technology to create audio deepfakes, while both Operation Overload and Operation Undercut pose as real news organizations to increase their credibility.

Despite limited evidence that these operations have meaningfully influenced voter behavior, they still pose broader risks to media integrity and public trust. Narratives undermining election security or integrity could reduce voter turnout, while media engagement with inauthentic content rather than exposing the tactics behind it may amplify malign messaging. Regarding Operation Overload specifically, we continue to assess that the potential for significant breakout does exist, as evidenced in the viral spread of a recent video attributed to this network that disparaged the United States Agency for International Development (USAID) in social media. To mitigate these risks, media entities, the public sector, and researchers should continue monitoring known influence networks while limiting engagement with operations such as Doppelgnger, Operation Overload, and Operation Undercut. Impersonated organizations should engage takedown services for malicious domains, collaborate with platform trust and safety teams, and proactively detect brand abuse tactics like typosquatting and logo manipulation.

Key Findings

• The German federal elections are the target of malign influence operations attributed to Russia and Russia-based actors.
• Russia-attributed influence operations have promoted and will very likely continue to support German political parties Russia views as beneficial to its own geopolitical interests, particularly Alternative fr Deutschland (AfD).
• Doppelgnger is very likely exerting influence through at least seven new inauthentic news brands, in addition to the operations persistent media impersonation activities, to exacerbate political fissures and inflame political discourse surrounding European integration, immigration, and economic matters.
• Operation Overloads media impersonations aim to sow distrust among German citizens toward the safety and integrity of voting, attack the characters of key political leaders, and present Germany as a rising hotbed of antisemitism and extremism.
• Insikt Group detected at least 94 new inauthentic websites whose creation began in November 2024 after the announcement of upcoming snap elections that we attribute to CopyCop impersonating German-language news websites.
• Following Insikt Groups November 2024 investigation into Operation Undercut, we have observed the network continuing to post German-language content supporting AfD and undermining German Chancellor Olaf Scholz.
• The Foundation to Battle Injustice very likely seeks to undermine the reputations of German political leaders while promoting political platforms aligned with Russian interests through inauthentic investigative articles.

New Doppelgnger Brands Target Key German Election Issues

Insikt Group has detected at least eight new websites acting as original news brands, in addition to continued media impersonation with social media promotion, which we attribute to Doppelgnger, a longstanding Russian influence operation. Doppelgnger is very likely positioning these newly established websites previously not linked to the network to sustain its influence operations targeting European political leadership and to exacerbate political fissures surrounding European integration, immigration, economic matters, and more. Throughout 2024, researchers, government entities, and technology companies continued exposing Doppelgnger's activities across Europe and North America, leading to a US Department of Justice indictment against its operators at the Social Design Agency (SDA), international sanctions on SDA and affiliated entities, and at least partial though often temporary disruptions to its operations through takedowns and seizures. In response, SDA typically attempted to reestablish its operations within hours to days by deploying new infrastructure.

While Doppelgnger is best known for the direct impersonation of legitimate Western media organizations, the influence operation has also managed a multitude of its own original news website brands, each targeting a specific country (such as Germany), with content directly tailored to the key domestic and foreign policy issues of that target audience, such as immigration policy, Germanys ongoing socio-economic challenges, and questions of Germanys place as Europes leader (as seen in Figure 1). Insikt Group has observed Doppelgnger abandoning several of its legacy brand websites with attempts to establish new brands, including multiple websites specific to German politics, likely due to a combination of repeated discovery and disruption of several of these websites.

While we continue to observe Doppelgnger evolve its tactics and attempt to evade defenders, its ability to meaningfully impact public discourse very likely remains limited. Despite continued efforts to expand its network, Doppelgnger remains constrained by low levels of engagement, with minimal views and interactions across its newly launched domains and social media brands.

Using New Infrastructure to Deliver Old Themes

Since October 2024, Insikt Group has tracked a series of new domain registrations, discovering web page infrastructure that overlaps with previously attributed Doppelgnger-controlled domains. As of February 2025, Doppelgnger has registered ten domains that include eight new websites and two parked domains. The active domains reflect seven news brands that target German-speaking audiences:

Figure 1: New Doppelgnger domains specific to Germany and German-speaking audiences (Source: Recorded Future)

Figure 2: The seven new Doppelgnger brands targeting Germany and German-speaking audiences (Source: Recorded Future)

Each of the active websites uses distinct IP addresses, listed below, with the exception of weltwahl[.]com and stolzvolk[.]org, which both share 15.197.130[.]221. Administrators of these domains use web hosting provider resources provided by Hosting Concepts B.V. (d/b/a Registrar.eu), QHoster, NameSilo, Namecheap, or Vicetemple. Stolzvolks newest domain, stolzvolk[.]ac, uses web hosting services provided by Ultahost, Inc.

Table 1: IP Addresses and ASNs associated with new Doppelgnger domains (Source: Recorded Future)

Similar to Doppelgngers legacy brands, these newly observed German-language sites each frame key socio-economic and political topics such as Germanys place in Europe, the state of the German economy, migration, and support to Ukraine in ways that are highly relevant to German voters, reflecting thematic approaches seen in prior campaigns targeting elections in both France and the US. Specific examples include the Doppelgnger brand Kriminal Radar, which is used to provoke German fear over safety and security, and in particular fear toward migrants. Meanwhile, stlicher Wind is an East Germany-oriented publication that promotes feelings of Euroskepticism, distrust toward the US and Ukraine, traditional values, and promotion of right-wing political entities, such as AfD.

Table 2: Each of Doppelgngers new German-language brands thematically focuses on a core election issue for German voters (Source: Recorded Future)

Figures 3 and 4: (Left) New Doppelgnger brand Kriminal Radar. (Right) Doppelgnger brand Tageswirtschaft shares an advertisement for Alternative fr Deutschland. Doppelgnger has incorporated external links and images posing as advertisements to make the ad seem legitimate (Source: Recorded Future)

Impersonating Media Organizations and Leveraging Social Media

In addition to establishing new news brands, Insikt Group identified Doppelgnger activity impersonating German media outlets DER SPIEGEL and Welt via the following domains: spiegel[.]bz, welt[.]cx, welt[.]ink, and welt[.]pm. Doppelgngers flagship influence outlet, Reliable Recent News (RRN), also continues publishing German-focused content via its website rrn[.]com[.]tr, on social media through the @RapidRespNews persona, and via its Telegram channel @reliablerecentnews.

Figures 5 and 6: (Left) Doppelgnger clone of DER SPIEGEL via spiegel[.]bz; (Right) Doppelgnger clone of Welt via welt[.]cx (Source: URLscan.io)

Doppelgnger continues to create and operate mass social media accounts to disseminate its messages using domain obfuscation techniques Insikt Group illustrated in December 2023. Furthermore, Doppelgnger also continues to leverage various branded social media accounts that align with its Germany-oriented websites, including Arbeitspause_1.0, Bayerischer Lwe, and Der Rattenfnger. Many of these personas mirror Doppelgngers historical tactics, using localized narratives, falsified news formats, and networked amplification to increase credibility among target audiences. According to a January 2025 analysis by the German Center for Monitoring, Analysis, and Strategy (CeMAS), over 630 Doppelgnger-attributed social media posts occurred between December 2024 and January 2025, engaging in coordinated inauthentic behavior (CIB) and promoting non-credible narratives on German politics, economics, and immigration.

To read the entire analysis, click here to download the report as a PDF.