Threat reportThreat IntelligenceTL-2026-3973
Doppelgänger NG: Russian influence campaign targeting Israel (fake Walla clone, X amplification, ClearSky low-confidence APT28 link)
Doppelgänger NG (TL-2026-3973), also tracked as Doppelganger NG, is a medium-severity tracked intrusion set, first published 2026-10-20. It is attributed to Doppelgänger network (Russia) with medium confidence, affects Walla (Israeli news portal) Brand and website impersonated by cloned, maps to 5 MITRE ATT&CK techniques (T1036, T1583.001, T1585.001), and is covered by 9 detection rules and 28 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 5MITRE ATT&CK
- Actors
- 1Doppelgänger network
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 28Indicators of compromise
Key facts for TL-2026-3973
- Threat ID
- TL-2026-3973
- Also known as
- Doppelganger NG, Operation Doppelgänger, Recent Reliable News (RRN) network
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution
- Doppelgänger network
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Russia
- Motivation
- UNKNOWN
- Target sectors
- news - media, government administration, general-public, political
- Target regions
- israel, united states of america, germany, france, ukraine
- Detection rules
- 9
- Indicators of compromise
- 28
Malware and tooling in Doppelgänger NG
Malware and tooling: Keitaro Tracking System
How Doppelgänger NG works
ClearSky and SentinelLabs report 'Doppelgänger NG', a Russian information-warfare campaign that publishes false content on cloned news sites (including a fake Walla and a fake liberal Israeli site) and amplifies it through coordinated X accounts, targeting Israel, the US, Germany, France and Ukraine. ClearSky attributes it with high confidence to a Russian state-aligned actor and with low confidence to APT28.
Doppelgänger is a long-running Russia-aligned influence operation that clones legitimate media and government sites and pushes anti-Ukraine and divisive content through fake social media accounts. First exposed in 2022 (EU DisinfoLab), the network was sanctioned by the EU (2023) and the US Treasury (20 March 2024), which named Social Design Agency (SDA) and Company Group Structura and their founders Ilya Gambashidze and Nikolai Tupikin as operating it at the direction of the Russian Presidential Administration.
'Doppelgänger NG' is the name ClearSky and SentinelLabs gave to a new wave tracked since late November 2023 (reported February 2024). ClearSky describes a network of more than 150 domains with news feeds for five countries (US, Israel, France, Germany, Ukraine), including clones of Walla, a liberal Israeli site, Le Parisien, Le Point, Welt and Obozrevatel. Per the research summaries available to this analysis, on the night of 20-21 November 2023 over 2,000 X accounts posted nearly 3,000 links to the Walla and liberal-site clones. ClearSky found similarities in text and code strings between this campaign and an earlier campaign that CERT-UA attributed to APT28, and assessed the APT28 link with low confidence. Ynet, citing the researchers, reports narratives such as Israel's international isolation, criticism of Western support for Ukraine, depicting left-wing activists as dangerous, and alleged Ukraine-Hamas links.
SentinelLabs documents the delivery mechanics (observed against German audiences): X posts link to short-lived first-stage redirector domains, which pass visitors through a second stage to the destination article. Keitaro tracking-system login pages measure campaign performance, some destination servers geofence by country, and the infrastructure uses cheap alternative-TLD typosquats (.ltd, .re, .pm) hosted via providers such as Hostinger and DigitalOcean. Primary-source caveat: ClearSky's own page and PDF could not be extracted, so Israel-specific domain names and the APT28 evidence are not independently verified here; the IOCs below come from the SentinelLabs report on the same network and are related infrastructure, not confirmed Israel-specific Walla-clone domains. No malware or exploitation is involved; the harm is disinformation and public-opinion manipulation.
MITRE ATT&CK techniques used in TL-2026-3973
Defense Evasion
Resource Development
T1583.001 Domains; T1585.001 Social Media Accounts
command-and-control
stealth
Affected products and versions in Doppelgänger NG
- Walla (Israeli news portal) — Brand and website impersonated by cloned site
- European and Ukrainian media outlets — Le Parisien, Le Point, Welt, Obozrevatel (brand impersonation)
- X Corp — X (Twitter) accounts used for amplification
Remediation for Doppelgänger NG
Immediate actions
- Block or sinkhole the listed Doppelgänger destination, tracker and redirector domains at DNS and web proxy
- Alert media-relations and communications teams to the cloned outlets (Walla, Le Parisien, Welt, Le Point, Obozrevatel)
- Report cloned sites and coordinated X accounts to the platform and the impersonated outlet
Workarounds
- Filter newly registered domains on alternative TLDs (.ltd, .re, .pm, .buzz, .site, .space) for high-risk users where operationally acceptable
Longer-term hardening
- Monitor for typosquats and look-alike domains of your brand and national media using certificate-transparency and newly-registered-domain feeds
- Train staff and executives to verify news links before sharing, especially links that arrive via X posts and redirect chains
- Subscribe to EU DisinfoLab, SentinelLabs and ClearSky reporting for domain and account updates
Timeline of Doppelgänger NG
- Doppelgänger network formally exposed by EU DisinfoLab (identified from approximately February 2022; day of month approximate).
- EU sanctions Social Design Agency and its founder over Doppelgänger disinformation (search summaries say July 2023, The Record says August; day approximate).
- Night of 20-21 November 2023: over 2,000 X accounts post nearly 3,000 links to Walla and liberal-site clones (per search summaries of ClearSky/SentinelLabs reporting; not independently verified).
- ClearSky and SentinelLabs begin tracking the new Doppelgänger NG wave ('late November 2023'; day approximate).
- ClearSky publishes the Doppelgänger NG report with SentinelLabs, citing 150+ domains across five countries and a low-confidence APT28 link (February 2024; day approximate).
- US Treasury sanctions Ilya Gambashidze, Nikolai Tupikin, Social Design Agency and Company Group Structura.
- US DOJ announces seizure of 32 domains used in Doppelgänger and names SDA, Structura and ANO Dialog.
- SentinelLabs report on Doppelgänger activity targeting Germany shows an update dated 11 April 2025.
Sources cited for Doppelgänger NG
- ClearSky: Doppelgänger NG report (PDF)
- ClearSky: Doppelgänger NG | Russian Cyberwarfare campaign
- SentinelLabs: Doppelgänger | Russia-Aligned Influence Operation Targets Germany
- Ynet: From Russia with hate: Online campaign working to foment Israeli division
- INSS: A Worldwide Russian Influence Campaign - Implications for Israel
- The Record: US Treasury sanctions Social Design Agency and Structura
- EU DisinfoLab: Doppelganger hub
- Infosecurity Magazine: Russian-Aligned Network Doppelgänger Targets German Elections
- CORRECTIV: Inside Doppelganger - how Russia uses EU companies for its propaganda
Detection coverage for TL-2026-3973
As of 2026-10-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3973 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.