# Doppelgänger NG: Russian influence campaign targeting Israel (fake Walla clone, X amplification, ClearSky low-confidence APT28 link)

> ClearSky and SentinelLabs report 'Doppelgänger NG', a Russian information-warfare campaign that publishes false content on cloned news sites (including a fake Walla and a fake liberal Israeli site) and amplifies it through coordinated X accounts, targeting Israel, the US, Germany, France and Ukraine. ClearSky attributes it with high confidence to a Russian state-aligned actor and with low confidence to APT28.

- **Published:** 2026-10-20T17:30:00Z
- **Last reviewed:** 2026-10-20T17:30:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3973
- **ID:** TL-2026-3973
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** Doppelgänger network (Russia)
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Doppelgänger is a long-running Russia-aligned influence operation that clones legitimate media and government sites and pushes anti-Ukraine and divisive content through fake social media accounts. First exposed in 2022 (EU DisinfoLab), the network was sanctioned by the EU (2023) and the US Treasury (20 March 2024), which named Social Design Agency (SDA) and Company Group Structura and their founders Ilya Gambashidze and Nikolai Tupikin as operating it at the direction of the Russian Presidential Administration.

'Doppelgänger NG' is the name ClearSky and SentinelLabs gave to a new wave tracked since late November 2023 (reported February 2024). ClearSky describes a network of more than 150 domains with news feeds for five countries (US, Israel, France, Germany, Ukraine), including clones of Walla, a liberal Israeli site, Le Parisien, Le Point, Welt and Obozrevatel. Per the research summaries available to this analysis, on the night of 20-21 November 2023 over 2,000 X accounts posted nearly 3,000 links to the Walla and liberal-site clones. ClearSky found similarities in text and code strings between this campaign and an earlier campaign that CERT-UA attributed to APT28, and assessed the APT28 link with low confidence. Ynet, citing the researchers, reports narratives such as Israel's international isolation, criticism of Western support for Ukraine, depicting left-wing activists as dangerous, and alleged Ukraine-Hamas links.

SentinelLabs documents the delivery mechanics (observed against German audiences): X posts link to short-lived first-stage redirector domains, which pass visitors through a second stage to the destination article. Keitaro tracking-system login pages measure campaign performance, some destination servers geofence by country, and the infrastructure uses cheap alternative-TLD typosquats (.ltd, .re, .pm) hosted via providers such as Hostinger and DigitalOcean. Primary-source caveat: ClearSky's own page and PDF could not be extracted, so Israel-specific domain names and the APT28 evidence are not independently verified here; the IOCs below come from the SentinelLabs report on the same network and are related infrastructure, not confirmed Israel-specific Walla-clone domains. No malware or exploitation is involved; the harm is disinformation and public-opinion manipulation.

## MITRE ATT&CK

- T1583.001 Domains
- T1585.001 Social Media Accounts
- T1036 Masquerading
- T1665 Hide Infrastructure
- T1684.001 Impersonation

## Sources

- [ClearSky: Doppelgänger NG report (PDF)](https://www.clearskysec.com/wp-content/uploads/2024/02/DoppelgangerNG_ClearSky.pdf)
- [ClearSky: Doppelgänger NG | Russian Cyberwarfare campaign](https://clearskysec.com/dg)
- [SentinelLabs: Doppelgänger | Russia-Aligned Influence Operation Targets Germany](https://www.sentinelone.com/labs/doppelganger-russia-aligned-influence-operation-targets-germany/)
- [Ynet: From Russia with hate: Online campaign working to foment Israeli division](https://ynetnews.com/business/article/bkf11hgh2p)
- [INSS: A Worldwide Russian Influence Campaign - Implications for Israel](https://www.inss.org.il/publication/russian-influence-campaign/)
- [The Record: US Treasury sanctions Social Design Agency and Structura](https://therecord.media/russians-sanctioned-disinformation-social-design-agency-company-group-structura)
- [EU DisinfoLab: Doppelganger hub](https://www.disinfo.eu/doppelganger-hub)
- [Infosecurity Magazine: Russian-Aligned Network Doppelgänger Targets German Elections](https://www.infosecurity-magazine.com/news/russia-network-doppelganger/)
- [CORRECTIV: Inside Doppelganger - how Russia uses EU companies for its propaganda](https://correctiv.org/en/fact-checking-en/2024/07/22/inside-doppelganger-how-russia-uses-eu-companies-for-its-propaganda/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3973