Justice Department Disrupts Covert Russian Government-Sponsored Foreign Malign Influence Operation Targeting Audiences in the United States and Elsewhere

Press Release

Operation Relied on Influencers, AI-Generated Content, Paid Social Media Advertisements, and Social Media Accounts to Drive Internet Traffic to Cybersquatted and Other Domains

PHILADELPHIA - United States Attorney Jacqueline C. Romero and the Justice Department today announced the ongoing seizure of 32 internet domains used in Russian government-directed foreign malign influence campaigns colloquially referred to as "Doppelganger," in violation of U.S. money laundering and criminal trademark laws.

As alleged in an unsealed FBI affidavit filed in the Eastern District of Pennsylvania, the Russian companies Social Design Agency (SDA), Structura National Technology (Structura), and ANO Dialog, operating under the direction and control of the Russian Presidential Administration, and in particular First Deputy Chief of Staff of the Presidential Executive Office Sergei Vladilenovich Kiriyenko, used these domains, among others, to covertly spread Russian government propaganda with the aim of reducing international support for Ukraine, bolstering pro-Russian policies and interests, and influencing voters in U.S. and foreign elections, including the U.S. 2024 Presidential Election.

The propaganda did not identify, and in fact purposefully obfuscated, the Russian government or its agents as the source of the content. The perpetrators extensively utilized "cybersquatted" domains, a method of registering a domain intended to mimic another person or company's website (e.g., registering washingtonpost.pm to mimic washingtonpost.com), to publish Russian government messaging falsely presented as content from legitimate news media organizations. In other instances, the perpetrators sought to create their own unique media brands to promote Doppelganger content (e.g., Recent Reliable News). Among the methods Doppelganger used to drive viewership to the cybersquatted and unique media domains was the deployment of "influencers" worldwide, paid social media advertisements (in some cases created using artificial intelligence tools), and the creation of social media profiles posing as U.S. (or other non-Russian) citizens to post comments on social media platforms with links to the cybersquatted domains, all of which attempted to trick viewers into believing they were being directed to a legitimate news media outlet's website.

"Protecting our democratic processes from foreign malign influence is paramount to ensure enduring public trust," said U.S. Attorney Romero. "As America's adversaries continue to spew propaganda and disinformation towards the American electorate, we'll use every tool at our disposal to expose and dismantle their insidious foreign influence campaigns."

"Today's disruption sends a clear message to our adversaries: we will not tolerate foreign efforts to influence our elections," said Wayne A. Jacobs, Special Agent in Charge of FBI Philadelphia. "Our office and our partners at the U.S. Attorney's Office are committed to identifying, investigating, and counteracting malign foreign influence operations targeting the United States."

Overview

The affidavit describes the perpetrators' own internal strategy meeting notes, project proposals, and other records obtained during the course of the investigation. Several notable propaganda project proposals directed against the United States included:

• Good Old USA Project: Attachments 8A, 8B
• The Guerilla Media Campaign: Attachments 9A, 9B
• U.S. Social Media Influencers Network Project: Attachments 10A, 10B

Doppelganger's foreign malign influence efforts were not directed solely against audiences in the United States. Other targets of the perpetrators' propaganda included Germany, Mexico, and Israel, among others. Doppelganger's influence campaigns sought to influence the citizenry of those countries to support Russian government objectives, including by undermining the United States' relationship with those countries.

Doppelganger's use of the U.S.-based domain names at the direction and control of, and for the benefit of, sanctioned persons, including Sergei Vladilenovich Kiriyenko, SDA, and Structura, violates the International Emergency Economic Powers Act (IEEPA). As a result, the accompanying payments for Doppelganger's online infrastructure violate federal money laundering laws. In addition, Doppelganger's publication of content on cybersquatted domains with names and content that mimic legitimate media outlets violates federal criminal trademark laws because those domains feature trademarks registered on the Principal Register maintained by the U.S. Patent and Trademark Office.

The FBI Philadelphia Field Office is investigating the case.

The U.S. Attorney's Office for the Eastern District of Pennsylvania, the National Security Division's Counterintelligence and Export Control Section and National Security Cyber Section are prosecuting the case, with valuable assistance from the Criminal Division's Computer Crime and Intellectual Property Section.

In conjunction with the domain seizures, the U.S. Treasury Department announced the designation of 10 individuals and two entities as part of a coordinated response to Russia's malign influence efforts targeting the 2024 U.S. presidential election. This announcement follows the designation of actors involved in Doppelganger announced by the Treasury Department in March.

Contact

Updated September 4, 2024