Summary
– On January 17, more than 100 German language Doppelganger accounts become active on Bluesky, replying to posts by authentic users. During the same period, posts in English, Polish, French, and Turkish also appeared with the same pattern of behaviour.
– The influence operation focused on narratives discrediting Ukraine and the German traffic light coalition. It also spreads polarising narratives and gender-based and sexualised hate against Ukrainian women.
– The operation published over 4900 posts between January 17th and 24th, likely having limited impact as their content gained nearly no interactions.
– Doppelgänger’s key TTPs on Bluesky include bulk-creating accounts, posting inauthentic social media comments, using local personas, and concealing Russian sponsorship of their activity.
– The pattern of behaviour of Doppelganger can be used to track it and stop it from operating. This pattern has been provided in this report.
Introduction
This flash report describes the key behaviours of what is likely the Russian influence operation Doppelgänger’s expansion to Bluesky. The report examines the behaviour and characteristics of German-language accounts found to be active on 17 January but ceased to be active on 20 January. This report maps out the behaviours of the influence operation, and some of the narratives they use, and provides recommendations on how to counter it.
It must be acknowledged that this influence operation cannot beyond all doubt be attributed as Doppelgänger without having access to IP addresses and the technical infrastructure used. That said, based on the patterns of behaviours and narratives used, there is a high likelihood that this in fact is an outcropping of Operation Doppelgänger.
During this time, Doppelgänger has been noted to move away from using a large number of accounts, instead switching to using fewer of those accounts to post more frequently per account.
These two phases of the operation’s development have been divided into type one: many accounts that posted few posts, and type two: (few accounts that posted many posts).
When it comes to this second type, this report focuses on two such specific accounts, which together made over 4300 posts in less than five days. Another account, which posted 120 times in less than 4 hours from its re-activation, is also believed to be the same type of account as the two other high-volume accounts. This account started as an English-language account that stopped posting on January 19. Up until then, it only posted 10 replies. On January 22, the account started posting again, publishing around 100 German-language posts in less than 4 hours.
Active accounts were discovered in English, French, Polish, Turkish and German. Given the impetus of the upcoming German elections, this report focuses on the German-language dataset.
At the time of writing this report, no readily available online archiving solutions have been able to capture Bluesky posts. Thus, the offline archiving tool Hunchly has been used to secure the findings in this report. Readers are invited to reach out in case they want access to the dataset underpinning these findings.
Doppelganger on X and Bluesky
Doppelgänger is an influence operation run by the Russian IT and PR company Social Design Agency (1). In September 2024, Alliance4Europe co-published a report on the Russian influence operation Doppelgänger and showed how it is operating on Facebook and X (2). This report also highlighted how it is possible to track Operation Doppelgänger based on its highly recognisable behavioural and sharing patterns.
In parallel, Bluesky grew from being a 12 million-user platform in October 2024 to closing in on a 28 million-user platform by January 2025 (3). One major sign of its success is the expansion of Russian influence operations onto the social media platform. This investigation has shown that Bluesky has been comparatively effective at responding to the threat, taking down around 70% within three days of the account in our small dataset becoming active.
Currently, Doppelgänger’s behaviour is more complex on X than on Bluesky. The influence operation typically uses one account to post the content, may it be a link to a fabricated article mimicking legitimate media, a video, or a simple tweet with an image. Another account then uses that tweet to reply to other users’ tweets.
On Bluesky, a coordinated inauthentic behaviour (CIB) network is directly replying to posts instead of separating the accounts that post the content and the ones that share them. We believe that this change in pattern is due to Bluesky not displaying linked posts as X would do. By linking to a tweet as a reply, the answer appears as a quote tweet and other users can see the tweet’s content. On Bluesky, linking to a post within another does not generate a preview.
The CIB network is also using the same narratives as Doppelgänger. These two indications point towards the influence operation on Bluesky likely being an early iteration of the Doppelganger operation moving to Bluesky.
Doppelganger on Bluesky – a DISARM analysis
On 17 January, more than 100 accounts were identified, systematically replying to regular users’ posts. These replies came from anonymous and recently created accounts. To support Bluesky in tracing these accounts and their activities, and later to also block them, this report analyses the influence operation using the DISARM Red Framework.
DISARM is an open-source taxonomy of influence operation methods. Using this system, the report divides up the influence operation into a planning, preparation, and execution phase. Descriptions of the techniques are hyperlinked in the text below.
Planning Phase
Based on our analysis of the narratives of the posts, the two most likely objectives of the influence operation are:
1. Degrading the image of Ukraine, the Ukrainian people, and the national leaders supporting them;
2. Discouraging the targeted countries from supporting Ukraine.
In their target audience analysis, three distinct techniques are used:
1. Identified Existing Fissures, as shown in the narrative analysis, by trying to pit refugees from the Middle East against refugees from Ukraine.
2. Geographic Segmentation by developing different content for the different languages of the operation.
3. Monitoring Social Media Analytics is also likely leveraged to decide which tweets the operation opts to reply to.
Preparation Phase
Image 1: Example of the first type of Doppelganger account on Bluesky
All the accounts were newly created accounts, all of which are free (Bluesky lacks a monetization model).
Notably, no particular effort is put into developing these accounts. The accounts share the following features:
- They have Bluesky’s default profile pictures,
- They only follow Bluesky’s official account,
- They usually add no descriptions or only add one word to their description.
- Their names tend to not correspond to the country they are targeting.
The second account type started using profile pictures
Image 2: Example of the second type of Doppelganger account on Bluesky.
The profile picture of the example image above also appeared in an ad promoting an account seller (4).
Image 3: Image from the advertisement of account selling.
Considering that researchers noted over 100 accounts being activated on the same day and created within a small time frame (January 12th), it is likely that the accounts are being created automatically or in bulk, potentially using some type of tool.
Looking at the German-language narratives, one can also see that the accounts are trying to portray themselves as local German citizens affected by German Government policies.
Using these accounts, the influence operation is amplifying variations of the same text and the same small number of badly made memes. The content is targeted towards German audiences, both when it comes to the language and the topics covered.
Execution Phase
Image 4: Example of Doppelganger post
With both the content itself and the accounts to spread them prepared, the influence operation needs to make sure that the content reaches its target audience while also avoiding detection.
The influence operation spreads its content by commenting on other users’ posts to reach its target audience. It is still unclear what triggers the comments being posted, but there is a consistent pattern of the content having interactions on them. Meaning, none of the analysed posts are below 10 shares, likes, or comments.
To persist on Bluesky, the influence operation’s account does not reveal any affiliation, hiding that they belong to a network of accounts, and their source of funding.
Content Moderation
Image 5: Bluesky suspending accounts.
Within three days of the accounts in our dataset being activated (17 to 20 January), only 33 of the around 100 accounts remained online. For context, this is a significantly higher degree of moderation than the matrix from our previous investigations of X’s response to Doppelgänger activity. This is despite Bluesky also being a start-up in comparison to incumbent social media giants, with fewer resources at hand to devote to moderation.
Narratives Analysis
Here we proceed to analyse the narratives used: First, we look at a small set of only 14 images used by the influence operation, and then the text used in the Bluesky posts.
It is crucial to note that while these narratives are being promoted by a Russian influence operation, we do not assign truth or falseness to them, as that is not the role of open-source intelligence investigators. Instead, the report seeks to map out the behaviours undertaken.
Narrative – Images
Not all of the posts have images attached to them. Some are pure text posts.
The ones that included images used the same limited set of 14 images. In this section of the report, these images are analysed.
It is worth highlighting that in some cases, the narratives showcased in the images rely on racist and sexist tropes to convey their talking points.
These images can be divided into three different categories.
Undermine Ukraine
These first sets of images attempt to discredit Ukranians and undermine support for Ukraine.
Two of the seven images are painting a negative, sexist image of Ukrainian women, portraying them as gold diggers.
Image 6 Translation: Germans wanted cheap women from Ukraine and Ukraine has pulled one over on Germany.
Image 7 Translation: The only real school for Ukrainian refugee women.
Another image is antisemitic, while another mocks Ukranian and Muslim refugees.
Image 8 translation: Tame and confrontational – peaceful and industrious. Why can’t they feed and defend themselves (or help each other) without German help?
Image 9 translation: It is all very simple. We condemn or support a country’s attack on its neighbours depending on whether its president is Jewish.
Two of the images are trying to discourage Germany from supporting Ukraine, claiming that Russia might retaliate and kill German soldiers if they try to support Ukraine.
Image 10 translation: The key thing is that the Russians didn’t decide to deliver their rockets to us as a consequence of the stationing of Tomahawks by the Americans.
Image 11 translation: Scholz notes that future generations might find old Germanic tombs in Ukraine.
Lastly, one image portrays support for Ukraine as foolish.
Image 12 Translation: “Why is the comedian president in Ukraine and I’m feeling like a clown”. “I worked as a clown to make money, and these guys became clowns to give their money away”
Financial concerns
Financial concerns, such as the cost of power and gas are also a focus of another set of three images.
Two of the images focused on energy.
Translation Image 13: “Are you sure you have warm water and heating at home?”
Translation Image 14: “You have to give up cheap energy for the benefit of the people”
“The German people?” “Really the German?”.
The third image focuses on portraying Germany as becoming poorer and poorer.
Translation image 15: Pawn shop turnover has quintupled over the last 10 years! We are getting ever poorer.
German Domestic Politics
The third category contains four images and touches on German domestic politics, excluding financial issues.
Two of the images look to discredit President of the European Commission Ursula von der Leyen, one of which seemingly uses racist discourse against Arabs to do so.
Translation Image 16: “Europe is being led by a gynaecologist, but why is she doing this as a pathologist”
Translation Image 17: “Where is that assimilation and cultural uniformity that VDL is talking about?”
One of the other images portrays the government coalition as being hypocritical on the topic of the environment. The second image mocks Federal Chancellor Olaf Scholz for the setbacks for his party in the recent local elections in Saxony and Thuringia.
Translation Image 18: “Forests near Berlin – The traffic light coalition fights for the environment”
“Before Tesla” – “After Tesla.”
Translation Image 19: “The chair underneath me is shaking. Is it an earthquake?” No. It’s the results of the local elections”
Narrative – Text
The text of the posts published on Bluesky is very similar to the Doppelgänger posts seen on X and Meta’s platforms.
Economic and Political Decline in Germany and Europe
Narrative: Germany and Europe are suffering economically due to misguided policies, particularly regarding their support of Ukraine.
The influence operation claims that the economic consequences of sanctions against Russia, inflation, and rising energy costs are hitting citizens and industries hard. It further claims that these policies benefit other global powers like the US and Russia, while Europe bears the cost.
The operation also promotes the idea that rising energy prices and inflation disproportionately affect the weakest in society, such as children and low-income families.
It also claims that economic cooperation with Russia could revitalize Germany’s export-driven economy.
Criticism of Political Leadership and Systems
Narrative: People should not trust established political leaders and parties.
The influence operation portrays leaders such as Olaf Scholz and Friedrich Merz as representatives of a failed system. It further claims that citizens feel abandoned, unheard, and misrepresented, signalling a demand for political change.
The operation promotes the idea that the upcoming elections are pivotal, with allegedly a significant portion of the population seeking alternatives outside the established political parties.
The influence operation also claims that the government’s handling of crises, such as the energy crisis, is allegedly perceived as inept and dismissive of citizens’ concerns.
The media is criticized by the operation for presenting an alleged one-sided view of Russia and its invasion of Ukraine, allegedly fueling unnecessary hysteria.
The influence operation also claims that public opinion is at odds with government policies, allegedly reflecting a disconnect between citizens and leadership.
Opposition to Current Foreign Policy
Narrative: An anti-Russian stance and military support for Ukraine are misguided and detrimental.
The influence operation advocates for a shift from confrontation to diplomacy with Russia, emphasizing the need for economic cooperation and stability.
The influence operation promotes the idea that Germany should prioritize diplomacy with Russia over military support for Ukraine.
US Influence and Exploitation
Narrative: The US is exploiting the Ukraine conflict to its advantage at Europe’s expense.
The influence operation questions the transatlantic partnership, with claims that US-driven policies undermine European sovereignty and interests.
Impact Assessment
We have identified two different clusters of Doppelganger accounts.
The first cluster only posted a few replies per day before stopping their activity.
The second cluster, of which only 3 examples have been noted so far, consistently posts throughout the day. The content is identical between these two account clusters.
The first cluster of around 33 accounts that remained online until January 20 published 667 posts, rarely garnering more than a single like or reply. In total, 1047 posts were found, including posts from accounts that were taken down before they were reported.
The second account cluster posted around 2600 and 1700 tweets, having the same issue of not gaining any interactions. There seems to be a third account belonging to the second cluster that was converted from the first cluster to the second cluster on the 22nd of January. This account has published over 120 posts.
It is unknown how many views the content received as Bluesky does not show those metrics.
With these few data points in mind, it is likely that the influence operation has had a limited impact on the German population. With that said, this can be theorised to be a trial run on the platform- Hence, it is possible that more sophisticated operations from the Social Design Agency can be expected in the future on Bluesky.
Recommendations and Conclusions
This investigation has analysed what is likely the early stages of the Doppelgänger influence operation’s expansion to Bluesky. The mapped-out behaviour shows significant alignment with the known characteristics of the operation. Hopefully, this can help Bluesky, as well as other researchers, who aim to track it.
By understanding these techniques and the technical infrastructure used by Doppelgänger, Bluesky can block their activity before they reach authentic users. Thus, it is advisable that Bluesky further develops its automated content moderation system to take down coordinated inauthentic behaviour networks based on the technical infrastructure as well as tactics and techniques that these networks employ.
Future investigations should look into how the accounts are being created to be able to stop these types of activities.
Bluesky has overall been responsive and has been taking down accounts while this report was being written before we could warn Bluesky about them.
Considering the relatively small number of original memes used by Doppelgänger on Bluesky, it should be possible to block the accounts when they are used.