Saturday, June 14, 2025
HomeCyber AttackDoppelgänger: Hackers Employ AI to Launch Highly sophistication Attacks

Doppelgänger: Hackers Employ AI to Launch Highly sophistication Attacks

Published on

SIEM as a Service

Follow Us on Google News

It has been observed that threat actors are using AI technology to conduct illicit operations on social media platforms.

These malicious actors employ several tactics and automated bots to achieve their nefarious goals, which can pose a serious threat to online security and privacy.

  • Spread disinformation
  • Manipulate public opinion
  • Escalate isolating content

These AI-driven tactics enable the rapid dissemination of misleading narratives, contributing to the escalation of online misinformation campaigns.

- Advertisement - Google News

Cybersecurity researchers at Insikt Group recently identified “Doppelgänger,” a Russia-linked influence network conducting a sophisticated operation.

Doppelgänger

The operators of this network employ advanced obfuscation techniques and potentially utilize generative AI to craft deceptive news articles, targeting audiences in the following countries via fake news sites and social media accounts:-

  • Ukraine
  • The United States
  • Germany
Doppelgänger articles dated Nov. 10, 2023, impersonating UNIAN (Source – Recordedfuture)

Insikt Group found a campaign hitting Ukraine, using many fake social media accounts for Coordinated Inauthentic Behavior (CIB). 

They shared bogus articles mimicking Ukrainian news, spreading anti-Ukraine narratives on:-

  • Military
  • Politics

Doppelgänger hit the US and Germany with fake copies of 6 legitimate news outlets’  in later campaigns. 

For the US, it fueled divisions before the 2024 election, pushing anti-LGBTQ+ views, criticizing the military, and intensifying political separations over Ukraine.

Doppelgänger influence assets (Source – Recordedfuture)

In Germany, it targeted economic and social problems to deteriorate the trust in leadership and boost the nationalist emotions.

Doppelgänger aimed at the US with three fake news outlets:-

  • Electionwatch[.]live: Generates AI-driven political content.
  • Mypride[.]press: Stirs anti-LGBTQ+ sentiments.
  • warfareinsider[.]us: Critiques US military and foreign policy from a politicized stance.

Campaigns

Here below, we have mentioned all the campaigns identified by the security analysts:-

  • Campaign 1: Doppelgänger Impersonates Ukrainian News Organizations to Influence Ukrainian Audiences
  • Campaign 2: Doppelgänger Seeking to Influence US Audiences with Inauthentic News Outlets Leveraging AI and Divisive Commentary on Social Issues and US Military
  • Campaign 3: Doppelgänger Seeking to Influence German Audiences with Grim Outlook on European Migration Movements, German Economic Outlook

Ongoing collaboration and public reporting are crucial to counter malicious influence. Media should vigilantly monitor brand abuse, issue takedowns, and boost online literacy.

Due to its continued evolution and use of AI, Doppelgänger’s exposed activities hint at lasting societal impacts, like corrupting trust and heightened polarization.

Tushar Subhra
Tushar Subhra
Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Latest articles

Kali Linux 2025.2 Released: New Tools, Smartwatch and Car Hacking Added

Kali Linux, the preferred distribution for security professionals, has launched its second major release...

Arsen Launches AI-Powered Vishing Simulation to Help Organizations Combat Voice Phishing at Scale

Arsen, the cybersecurity startup known for defending organizations against social engineering threats, has announced...

NIST Releases New Guide – 19 Strategies for Building Zero Trust Architectures

The National Institute of Standards and Technology (NIST) has released groundbreaking guidance to help...

Spring Framework Flaw Enables Remote File Disclosure via “Content‑Disposition” Header

A medium-severity reflected file download (RFD) vulnerability (CVE-2025-41234) in VMware's Spring Framework has been...

Credential Abuse: 15-Min Attack Simulation

Credential Abuse Unmasked

Credential abuse is #1 attack vector in web and API breaches today (Verizon DBIR 2025). Join our live, 15-min attack simulation with Karthik Krishnamoorthy (CTO - Indusface) and Phani Deepak Akella (VP of Marketing - Indusface) to see hackers move from first probe to full account takeover.

Discussion points


Username & email enumeration – how a stray status-code reveals valid accounts.
Password spraying – low-and-slow guesses that evade basic lockouts.
Credential stuffing – lightning-fast reuse of breach combos at scale.
MFA / session-token bypass – sliding past second factors with stolen cookies.

More like this

Kali Linux 2025.2 Released: New Tools, Smartwatch and Car Hacking Added

Kali Linux, the preferred distribution for security professionals, has launched its second major release...

NIST Releases New Guide – 19 Strategies for Building Zero Trust Architectures

The National Institute of Standards and Technology (NIST) has released groundbreaking guidance to help...

Spring Framework Flaw Enables Remote File Disclosure via “Content‑Disposition” Header

A medium-severity reflected file download (RFD) vulnerability (CVE-2025-41234) in VMware's Spring Framework has been...