{ "id": "78843652-f9a6-4093-af0a-2f14d9cf1580", "created_at": "2026-04-06T00:11:23.001852Z", "updated_at": "2026-04-10T03:36:23.290021Z", "deleted_at": null, "sha1_hash": "636cea64409ea9e0d3c44e368618e724ba862be6", "title": "Russian Influence Operations Targeting Germany’s 2025 Elections", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 708847, "plain_text": "Russian Influence Operations Targeting Germany’s 2025 Elections\r\nBy Insikt Group®\r\nArchived: 2026-04-05 18:33:28 UTC\r\nExecutive Summary\r\nThe German federal elections, scheduled for February 23, 2025, are the target of malign influence operations\r\nlinked to Russia and Russia-based actors. As of mid-February 2025, Insikt Group assesses that, despite their\r\npersistence, these efforts have very likely not meaningfully altered voter behavior or shaped public opinion in a\r\nmanner advantageous to Russia’s broader geopolitical interests, consistent with assessments of Russian meddling\r\nattempts in previous German election cycles.\r\nThe influence operations and corresponding networks tracked in this report — Doppelgänger, Operation Overload,\r\nCopyCop, Operation Undercut, and the Russia-based Foundation to Battle Injustice — are longstanding and at\r\nleast partially Kremlin-funded. These operations almost certainly seek to incite and escalate German domestic\r\nsocio-political conflicts, pollute the German information space by introducing manipulated content, foster\r\ncriticism of the United States (US) and European Union (EU) and European integration, and undermine North\r\nAtlantic Treaty Organization (NATO) cohesion in line with the Kremlin’s strategic objectives.\r\nThe 2025 German election cycle marks a period of evolution for several of these operations, while core narratives\r\nremain unchanged. For example, Doppelgänger and Operation Overload have expanded beyond mainstream social\r\nmedia to Bluesky Social (Bluesky), in an attempt to capture migrating audiences. Doppelgänger and CopyCop\r\nhave launched new brands and websites to project influence and reinforce messaging in the face of intensified\r\nscrutiny of their operations. Operation Overload continues to use artificial intelligence (AI)-based tools, including\r\nthe use of AI-enabled voice cloning technology to create audio deepfakes, while both Operation Overload and\r\nOperation Undercut pose as real news organizations to increase their credibility.\r\nDespite limited evidence that these operations have meaningfully influenced voter behavior, they still pose\r\nbroader risks to media integrity and public trust. Narratives undermining election security or integrity could\r\nreduce voter turnout, while media engagement with inauthentic content — rather than exposing the tactics behind\r\nit — may amplify malign messaging. Regarding Operation Overload specifically, we continue to assess that the\r\npotential for significant breakout does exist, as evidenced in the viral spread of a recent video attributed to this\r\nnetwork that disparaged the United States Agency for International Development (USAID) in social media. To\r\nmitigate these risks, media entities, the public sector, and researchers should continue monitoring known influence\r\nnetworks while limiting engagement with operations such as Doppelgänger, Operation Overload, and Operation\r\nUndercut. Impersonated organizations should engage takedown services for malicious domains, collaborate with\r\nhttps://www.recordedfuture.com/research/stimmen-aus-moskau-russian-influence-operations-target-german-elections\r\nPage 1 of 7\n\nplatform trust and safety teams, and proactively detect brand abuse tactics like typosquatting and logo\r\nmanipulation.\r\nKey Findings\r\nThe German federal elections are the target of malign influence operations attributed to Russia and Russia-based actors.\r\nRussia-attributed influence operations have promoted and will very likely continue to support German\r\npolitical parties Russia views as beneficial to its own geopolitical interests, particularly Alternative für\r\nDeutschland (AfD).\r\nDoppelgänger is very likely exerting influence through at least seven new inauthentic news brands, in\r\naddition to the operation’s persistent media impersonation activities, to exacerbate political fissures and\r\ninflame political discourse surrounding European integration, immigration, and economic matters.\r\nOperation Overload’s media impersonations aim to sow distrust among German citizens toward the safety\r\nand integrity of voting, attack the characters of key political leaders, and present Germany as a rising\r\nhotbed of antisemitism and extremism.\r\nInsikt Group detected at least 94 new inauthentic websites –– whose creation began in November 2024\r\nafter the announcement of upcoming snap elections –– that we attribute to CopyCop impersonating\r\nGerman-language news websites.\r\nFollowing Insikt Group’s November 2024 investigation into Operation Undercut, we have observed the\r\nnetwork continuing to post German-language content supporting AfD and undermining German Chancellor\r\nOlaf Scholz.\r\nThe Foundation to Battle Injustice very likely seeks to undermine the reputations of German political\r\nleaders while promoting political platforms aligned with Russian interests through inauthentic investigative\r\narticles.\r\nNew Doppelgänger “Brands” Target Key German Election Issues\r\nInsikt Group has detected at least eight new websites acting as original news brands, in addition to continued\r\nmedia impersonation with social media promotion, which we attribute to Doppelgänger, a longstanding Russian\r\ninfluence operation. Doppelgänger is very likely positioning these newly established websites — previously not\r\nlinked to the network — to sustain its influence operations targeting European political leadership and to\r\nexacerbate political fissures surrounding European integration, immigration, economic matters, and more.\r\nThroughout 2024, researchers, government entities, and technology companies continued exposing\r\nDoppelgänger's activities across Europe and North America, leading to a US Department of Justice indictment\r\nagainst its operators at the Social Design Agency (SDA), international sanctions on SDA and affiliated entities,\r\nand at least partial — though often temporary — disruptions to its operations through takedowns and seizures. In\r\nresponse, SDA typically attempted to reestablish its operations within hours to days by deploying new\r\ninfrastructure.\r\nWhile Doppelgänger is best known for the direct impersonation of legitimate Western media organizations, the\r\ninfluence operation has also managed a multitude of its own original news website “brands”, each targeting a\r\nspecific country (such as Germany), with content directly tailored to the key domestic and foreign policy issues of\r\nhttps://www.recordedfuture.com/research/stimmen-aus-moskau-russian-influence-operations-target-german-elections\r\nPage 2 of 7\n\nthat target audience, such as immigration policy, Germany’s ongoing socio-economic challenges, and questions of\r\nGermany’s place as Europe’s leader (as seen in Figure 1). Insikt Group has observed Doppelgänger abandoning\r\nseveral of its “legacy” brand websites with attempts to establish new brands, including multiple websites specific\r\nto German politics, likely due to a combination of repeated discovery and disruption of several of these websites.\r\nWhile we continue to observe Doppelgänger evolve its tactics and attempt to evade defenders, its ability to\r\nmeaningfully impact public discourse very likely remains limited. Despite continued efforts to expand its network,\r\nDoppelgänger remains constrained by low levels of engagement, with minimal views and interactions across its\r\nnewly launched domains and social media brands.\r\nUsing New Infrastructure to Deliver Old Themes\r\nSince October 2024, Insikt Group has tracked a series of new domain registrations, discovering web page\r\ninfrastructure that overlaps with previously attributed Doppelgänger-controlled domains. As of February 2025,\r\nDoppelgänger has registered ten domains that include eight new websites and two “parked” domains. The active\r\ndomains reflect seven news brands that target German-speaking audiences:\r\nherzheim[.]org\r\nkriminalradar[.]com\r\nmilitarblatt[.]net\r\nostlicherwind[.]com\r\nstolzvolk[.]ac\r\nstolzvolk[.]org (currently offline)\r\ntageswirtschaft[.]org\r\nweltwahl[.]com (currently offline)\r\ndetechplus[.]com (parked)\r\nsportbericht[.]net (parked)\r\nFigure 1: New Doppelgänger domains specific to Germany and German-speaking audiences (Source: Recorded\r\nFuture)\r\nhttps://www.recordedfuture.com/research/stimmen-aus-moskau-russian-influence-operations-target-german-elections\r\nPage 3 of 7\n\nFigure 2: The seven new Doppelgänger brands targeting Germany and German-speaking audiences (Source:\r\nRecorded Future)\r\nEach of the active websites uses distinct IP addresses, listed below, with the exception of weltwahl[.]com and\r\nstolzvolk[.]org, which both share 15.197.130[.]221. Administrators of these domains use web hosting provider\r\nresources provided by Hosting Concepts B.V. (d/b/a Registrar.eu), QHoster, NameSilo, Namecheap, or\r\nVicetemple. Stolzvolk’s newest domain, stolzvolk[.]ac, uses web hosting services provided by Ultahost, Inc.\r\nIP Address ASN Organization Name\r\n15.197.130[.]221 AS16509 Amazon Technologies, Inc.\r\n162.255.118[.]67 AS22612 Namecheap, Inc.\r\n162.255.118[.]68 AS22612 Namecheap, Inc.\r\n179.43.183[.]46 AS51852 Private Layer, Inc.\r\n185.224.81[.]168 AS204196 AbleoHost B.V.\r\nhttps://www.recordedfuture.com/research/stimmen-aus-moskau-russian-influence-operations-target-german-elections\r\nPage 4 of 7\n\nIP Address ASN Organization Name\r\n185.224.81[.]75 AS204196 AbleoHost B.V.\r\n185.38.151[.]11 AS25369 Hydra Communications Ltd\r\n79.133.41[.]61 AS44066 firstcolo GmbH\r\nTable 1: IP Addresses and ASNs associated with new Doppelgänger domains (Source: Recorded Future)\r\nSimilar to Doppelgänger’s legacy brands, these newly observed German-language sites each frame key socio-economic and political topics — such as Germany’s place in Europe, the state of the German economy, migration,\r\nand support to Ukraine — in ways that are highly relevant to German voters, reflecting thematic approaches seen\r\nin prior campaigns targeting elections in both France and the US. Specific examples include the Doppelgänger\r\nbrand “Kriminal Radar”, which is used to provoke German fear over safety and security, and in particular fear\r\ntoward migrants. Meanwhile, Östlicher Wind is an East Germany-oriented publication that promotes feelings of\r\nEuroskepticism, distrust toward the US and Ukraine, “traditional” values, and promotion of right-wing political\r\nentities, such as AfD.\r\nElection Issue\r\nDoppelgänger-Aligned Branded\r\nWebsite\r\nTranslation\r\nCrime, Immigration, Law Enforcement Kriminal Radar “Crime Radar”\r\nMilitary and Security Militärblatt\r\n“Military\r\nBulletin”\r\nEast/West Germany, Conservative Views Östlicher Wind “Easterly Wind”\r\nGerman Economy Tageswirtschaft “Daily Economy”\r\nGerman Pride Stolzvolk “Proud People”\r\nhttps://www.recordedfuture.com/research/stimmen-aus-moskau-russian-influence-operations-target-german-elections\r\nPage 5 of 7\n\nElection Issue\r\nDoppelgänger-Aligned Branded\r\nWebsite\r\nTranslation\r\nSocial Values HerzHeim “Heart Home”\r\nWorld News and Germany’s Global\r\nPosition\r\nWeltWahl “World Choice”\r\nTable 2: Each of Doppelgänger’s new German-language “brands” thematically focuses on a core election issue\r\nfor German voters (Source: Recorded Future)\r\nFigures 3 and 4: (Left) New Doppelgänger brand “Kriminal Radar”. (Right) Doppelgänger brand\r\nTageswirtschaft shares an “advertisement” for Alternative für Deutschland. Doppelgänger has incorporated\r\nexternal links and images posing as advertisements to make the ad seem legitimate (Source: Recorded Future)\r\nImpersonating Media Organizations and Leveraging Social Media\r\nIn addition to establishing new news brands, Insikt Group identified Doppelgänger activity impersonating German\r\nmedia outlets DER SPIEGEL and Welt via the following domains: spiegel[.]bz, welt[.]cx, welt[.]ink, and\r\nwelt[.]pm. Doppelgänger’s flagship influence outlet, Reliable Recent News (RRN), also continues publishing\r\nGerman-focused content via its website rrn[.]com[.]tr, on social media through the @RapidRespNews persona,\r\nand via its Telegram channel @reliablerecentnews.\r\nhttps://www.recordedfuture.com/research/stimmen-aus-moskau-russian-influence-operations-target-german-elections\r\nPage 6 of 7\n\nFigures 5 and 6: (Left) Doppelgänger clone of DER SPIEGEL via spiegel[.]bz; (Right) Doppelgänger clone of\r\nWelt via welt[.]cx (Source: URLscan.io)\r\nDoppelgänger continues to create and operate mass social media accounts to disseminate its messages using\r\ndomain obfuscation techniques Insikt Group illustrated in December 2023. Furthermore, Doppelgänger also\r\ncontinues to leverage various branded social media accounts that align with its Germany-oriented websites,\r\nincluding “Arbeitspause_1.0”, “Bayerischer Löwe”, and “Der Rattenfänger”. Many of these personas mirror\r\nDoppelgänger’s historical tactics, using localized narratives, falsified news formats, and networked amplification\r\nto increase credibility among target audiences. According to a January 2025 analysis by the German Center for\r\nMonitoring, Analysis, and Strategy (CeMAS), over 630 Doppelgänger-attributed social media posts occurred\r\nbetween December 2024 and January 2025, engaging in coordinated inauthentic behavior (CIB) and promoting\r\nnon-credible narratives on German politics, economics, and immigration.\r\nTo read the entire analysis, click here to download the report as a PDF.\r\nSource: https://www.recordedfuture.com/research/stimmen-aus-moskau-russian-influence-operations-target-german-elections\r\nhttps://www.recordedfuture.com/research/stimmen-aus-moskau-russian-influence-operations-target-german-elections\r\nPage 7 of 7", "extraction_quality": 1, "language": "EN", "sources": [ "MISPGALAXY", "Malpedia" ], "references": [ "https://www.recordedfuture.com/research/stimmen-aus-moskau-russian-influence-operations-target-german-elections" ], "report_names": [ "stimmen-aus-moskau-russian-influence-operations-target-german-elections" ], "threat_actors": [ { "id": "8d4b4b62-c221-412d-bf8e-243cddc728cd", "created_at": "2026-02-04T02:00:03.7163Z", "updated_at": "2026-04-10T02:00:03.956172Z", "deleted_at": null, "main_name": "Storm-1516", "aliases": [ "CopyCop" ], "source_name": "MISPGALAXY:Storm-1516", "tools": [], "source_id": "MISPGALAXY", "reports": null } ], "ts_created_at": 1775434283, "ts_updated_at": 1775792183, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/636cea64409ea9e0d3c44e368618e724ba862be6.pdf", "text": "https://archive.orkl.eu/636cea64409ea9e0d3c44e368618e724ba862be6.txt", "img": "https://archive.orkl.eu/636cea64409ea9e0d3c44e368618e724ba862be6.jpg" } }