Read-In Briefing
·
LD-RIB-021226
TLP:AMBER
Wednesday, 2 December 2026 · 16:00 CET / 10:00 ET · 30 minutes · Online
Briefer: Roman Osadchuk, Head of Research, LetsData
Bottom line
Public attention to Doppelgänger faded after its exposure, but Doppelgänger-style operations did not stop. In 2026, Vantage detected a new wave of incidents with a recognisable digital footprint that can be caught at inception.
Background
Doppelgänger is the name researchers give to a set of influence operations that clone the websites of real news outlets to spread fabricated articles. The activity was first exposed in 2022. In July 2023, the Council of the EU sanctioned the Russian companies Social Design Agency and Structura National Technologies over a campaign it named RRN (Recent Reliable News), which researchers track as part of this activity. The US followed with sanctions in March 2024, and the UK imposed its own.
In this briefing
The digital footprints that identify a new Doppelgänger-style clone site at inception, and how to detect them in your own environment
Our assessment of what this new wave is trying to achieve
What governments, platforms and media have done in response so far, and how the operations adapted
How to judge the significance of an incident, and why reach is a misleading measure
What can be done now: the response options available to security and resilience teams
Who it’s for
Security teams in national-security organisations, and teams responsible for national or corporate resilience.
Access
Places are limited; registration is screened. The session is not recorded, and attendee identities are not visible to other participants. Content is shared under TLP:AMBER. Participants receive the Readout after the session, and cleared participants receive the Known Asset list.
Places are limited; registration is screened. We review every request before confirming