Doppelganger: European media clones persist through May 2026
In May 2026, the Doppelganger network continued its European media cloning operation, impersonating Der Spiegel, Le Parisien, Fox News and 24 Heures. The infrastructure came back online within hours of each takedown, indicating hardened operational resilience.
In May 2026, the Doppelganger network (RRN / Ruza Flood, attributed to Russian companies by Viginum and the US Treasury) continues to clone European media, including Der Spiegel, Le Parisien and Fox News, publishing on visually identical domains fabricated articles aligned with Kremlin positions on Ukraine, immigration and European elections.
Executive summary
In May 2026, the Doppelgänger network maintained cloning operations against major European media outlets, demonstrating enhanced operational resilience with rapid restarts following takedowns. This persistence suggests substantial technical and financial resources behind the operation.
What is observed
Between May 2026, domains impersonating Der Spiegel, Le Parisien, Fox News, and 24 Heures were identified and removed by authorities or registrars. Within 6 to 48 hours following each takedown, morphologically similar new domains were registered with duplicated content. SSL certificates were obtained through public providers. Servers used IP addresses outside Western jurisdictions. No substantial content modifications were observed between iterations.
What this does not prove
The speed of restarts does not prove direct state-actor involvement, although it is consistent with state capabilities. Use of public commercial infrastructure does not confirm attribution to SDA Moscow specifically, but could be compatible with deliberate obfuscation. Absence of content changes between cycles does not prove complete automation; it may reflect a highly refined manual process. Geographic targeting (France, Germany, Poland) does not prove coordinated influence strategy, only a selection of targets present on the network.
Confidence level
The technical observation of infrastructure persistence is verifiable and robust, but specific attribution to SDA Moscow relies on historical pattern matching and intelligence chains not fully transparent publicly.
Methodological limits
This brief relies on the analysis of publicly accessible content (OSINT). Attribution is based on converging technical and editorial indicators, without access to the internal communications of designated actors. Volume data reflects content captured by our 567-source pipeline and does not constitute an exhaustive census.
How to cite this investigation
DisInfo Monitor (2026), "Doppelganger: European media clones persist through May 2026", independent publication, disinfo-monitor.com/en/narrative/doppelganger-2026-mai-continuite-europeenne-clones-medias-mor0hhi6, first detected May 4, 2026, last updated May 4, 2026, accessed May 19, 2026.