Illegal Doppelganger Operation: Targeting the Polish Elections

Do you like the work we are doing? With your help, we can continue defending European democracy!

Contributors:
Aleksandra Wojtowicz, ISD.
NASK Researcher.

This flash report was made possible through collaborations facilitated through the Counter Disinformation Network. 

Introduction

This report illustrates how the Russian influence operation Doppelganger interferes with the current Polish Presidential Elections. We analyse their pattern of behaviour and activities between March 4th and April 4th 2025, showing how 279 tweets were used to target the elections. The operation spread anti-EU, anti-Ukrainian, and anti-Polish establishment narratives. It also tried to create division in Polish society by engaging with domestic grievances. 

Considering that the influence operation had not been active so far this year in Polish, this was likely the start of their campaign against the Polish elections. 

In 2022, the Qurium Media Foundation and EU DisinfoLab named a Russian coordinated inauthentic behaviour network “Doppelganger”. 

The operation has been extensively covered in previous reports, including in a previous collaborative report by the Counter Disinformation Networks. 

The company behind the Russian influence operation known as the Social Design Agency (SDA) was sanctioned in 2024 by the European Commission.

In response to the Russian invasion of Ukraine, the EU enacted sanctions against several individuals and organisations offering support to the Russian war effort.

On May 14, 2024, the European Commission further clarified that the sanctions prohibit hosting content from these persons or entities or making them available to EU audiences on content-sharing platforms or search engines.

As the SDA is a sanctioned entity, X’s not taking down their content would be a potential violation of sanctions. Science Feedback showed in a report how the content we flagged to X from the influence operation stayed up, meaning X is knowingly not dealing with illegal content. 

Only 4 of the 279 accounts used in the influence operation were suspended by X as of April 5th.

Behaviour 

The primary method we are using to track the operation and attribute social media posts to it is through its posting patterns and account characteristics. We have been tracking the influence operation since June through the same pattern of behaviour.

Since then, the behaviour of the network has evolved. While it initially started by creating inauthentic websites mimicking news outlets, creating fabricated articles promoting Russian interests, and using social media to spread links to them, now the influence operation is also using three other methods. 

The standard Doppelganger pattern was extensively covered in our June report. 

Image 1: Standard Doppelganger behaviour 

While this classical Doppelganger behaviour has continued in 2025, targeting Germany, France, the United States, and Ukraine, we have not observed them use it to target the Polish Presidential Elections. This report will instead focus on one of the other patterns of behaviour used by the Social Design Agency, the actor behind the Doppelganger operation.  

Other than this initial standard behaviour, there are four other types of coordinated inauthentic behaviour being used by the Social Design Agency (SDA).

The first and second types use hashtags, but not the same type of sharing pattern. They spread images and videos promoting Russian narratives. This is challenging to systematically capture and will not be analysed in this report. 

Image 2: Examples of Doppelganger post using hashtags

The third type uses the same sharing pattern as the initial Doppelganger, does not use hashtags, but uses images and videos. 

Image 3: Doppelganger post using classical sharing pattern but spreading videos instead of links.

The fourth type uses the same sharing pattern and profile characteristics as the regular Doppelganger operation, but instead promotes traditional media articles that align with their narratives. This type of behaviour is being used specifically to target the Polish elections, and is hence the focus of this report.

Image 4: Regular amplification pattern spreading links to Polish media.

DISARM Framework Analysis

The DISARM Framework provides us with a common taxonomy to describe tactics and techniques employed by threat actors to manipulate the information space. This section provides an overview of the manipulative techniques and objectives used by the influence operation. 

In the present case, several objectives are observable, indicating a coordinated disinformation effort to manipulate public discourse and sentiment. One prominent objective is to Divide society, to foster conflict between subgroups and deepen divisions within Polish society. This is evidenced by the emotionally charged, highly polarising narratives that specifically target contentious and pressing social issues. The content, as illustrated in the following section, focuses on themes such as the cost of living crisis, contentious social debates, emotionally driven foreign policy topics, and divisive environmental issues. These narratives are deliberately tailored to exploit societal fault lines, inflaming tensions and undermining societal cohesion.

Another objective is likely to Degrade Adversaries, seeking to erode the credibility and effectiveness of political opponents by disseminating damaging or discrediting information. In this case, the disinformation content has been actively propagating negative portrayals of Donald Tusk, key EU figures such as Ursula von der Leyen, and members of the Polish government, aiming to delegitimise their authority and reduce public trust in their leadership.

Lastly, the operation likely aims to Facilitate State Propaganda through the promotion of narratives that strongly mirror the rhetoric and disinformation strategies typical of Russian state propaganda. These narratives often amplify pro-Kremlin viewpoints, indirectly promoting state-sponsored messaging by echoing its framing and tone. In the preparation phase of the operation, it seems that SDA purchased X accounts. While we cannot verify this, it is also an assessment made by the German Federal Foreign Office. Most of the accounts are seemingly bulk-created around the same date in February. While most accounts were newly created assets, some are dated to 2011, strengthening our hypothesis that some of them are purchased accounts. 

To give the accounts more legitimacy, the operation fabricated local personas by posing as Polish citizens. Using the same method, the operation also concealed that they were part of a wider CIB network to persist in the information environment, avoiding immediate detection or suspicion.

The influence operation developed tweets using two components: text and a link. While the text itself seems to be original content, the links were appropriated from Polish media entities. 

In order to maximise exposure of the content, the operation is using two types of accounts. One type publishes the tweet with a link. The second type seems to be bots that automatically comment the tweets with a link hundreds of times on the tweets of regular users. The operation uses this type of inauthentic social media comments to spread its operational content to regular users. 

Content Analysis

The influence operation uses one type of content in its activities. It relies on X posts that contain text expressing a narrative and a link to an article. The narrative of the tweet relates to the content of the article.

Narrative Analysis

An analysis of the tweets in the dataset revealed several recurring narratives, both major and minor, shaping the discourse. Tweets often contain more than one narrative, so the frequency counts for individual themes may exceed the number of total tweets analysed.

Major Narratives Identified

Anti-European Union (EU) – 116 instances;

The most dominant narrative is criticism or attacks on the EU. Tweets in this category expressed strong opposition to the EU, particularly criticising its climate policies, Ukraine-related foreign policy, and perceived overreach into Polish sovereignty. Calls for Poland to leave the EU were common, emphasising the need for national independence, especially in regulatory matters related to energy and environmental issues. The coal industry and agricultural concerns were frequently cited, with EU climate compliance fines and high fuel prices igniting discontent. Criticism of the restriction on energy trade with Russia also featured as a point of criticism.

Anti-Ukraine – 65 instances;

This narrative questioned the financial support allocated to Ukraine and the EU’s broader defence spending. It promoted a stance of national self-reliance and non-interventionism, suggesting Poland should focus on strengthening its own defences rather than engaging with the Ukraine conflict. Some posts were urging the reader to completely disengage from the conflict. A significant portion of the discourse also opposed Ukraine’s potential EU membership, citing failure to meet necessary admission criteria.

Anti-Establishment – 48 instances;

Tweets in this category were critical of the current Polish government, particularly in relation to economic management, inflation, and taxation. There were direct attacks on political figures, especially Donald Tusk, with accusations ranging from incompetence to financial misconduct. Discontent also focused on the effectiveness of social programs and a push to end economic hostilities with Russia.

Secondary Narratives

Social and Economic Issues – 44 instances;
This broad category captured grievances about domestic social policies and services:

• 18 tweets criticised the healthcare system as outdated or underfunded.
• 9 addressed concerns about education reforms.
• 6 criticised fuel prices.
• 6 focused on migration.
• 5 mentioned issues related to information and cyber warfare.
  
  

Additional Narratives

• Pro-PiS (Law and Justice Party) – 9 instances
• Anti-US Sentiment – 4 instances
• Pro-Russian Trade – 7 instances
• Miscellaneous Themes – 10 instances

The Miscellaneous themes included general calls for peace, negotiation, and diplomacy.

General Observations

• The historical Wołyń massacre was referenced as a tool to discourage support for Ukraine, echoing themes common in pro-Russian rhetoric.
• Phrases like “Euro-bureaucrats” or “European Bureaucracy” were frequently repeated, suggesting coded language or dog-whistling.
• Anti-German sentiment often accompanied anti-EU rhetoric.
• A small number of tweets (notably in rows 9, 85, and 131) were written using a Russian keyboard or Cyrillic script, possibly indicating origin or alignment. 

Amplified Media Entities

To amplify the narratives expressed by the tweets, making them seem anchored in Polish discourse and expressed from a regular Polish citizen, the influence operation shares articles from legitimate media. The operation used 43 articles from 13 different Polish publications.

List of Polish Publications

Impact

Assessing the precise impact of Doppelganger is difficult. Russian influence operators are incentivised to expand their social media metrics to fulfil their KPIs and market their services. Also, X’s API, which we are accessing through the social listening tool Meltwater, does not show us accurate “like” metrics. When checking manually, the data we are seeing on X via our browser does not match what the API is telling us.

X API is claiming that the influence operation’s content gained a total of 1,547,221 views and 256,549 shares. These shares are known to be inauthentic, as we described in a previous report, meaning that around 256,549 of the views are not real. The API also shows that the tweets gained 4856 likes, but we cannot verify this when we check the individual tweets. 

We have identified what seems to be a handful of authentic Polish users interacting with the influence operations’ tweets, but these are limited. 

We have reason to believe that the operation’s impact remains contains at the time of writing. Nevertheless, major breakouts and contagions are possible at any moment.

As seen in previous cases, influence operations with limited initial reach can quickly gain traction in the broader information space when amplified by high-profile figures. A notable example is Operation Overload, which gained significant visibility after being promoted by Elon Musk and Donald Trump Jr. Similarly, Operation Doppelganger functions as a persistent testing ground and incubator for inauthentic, manipulative, and malicious content, posing a continuous threat of rapid and widespread information contagion.

As such, there is a broader societal risk that these foreign information operations pose, and X must not allow it to continue on its platform.

Nevertheless, we believe that X should not allow this operation, which we can so easily track, to operate on their platform. 

Actions Taken and Recommendations

The Doppelganger posts have been reported to X using their DSA-mandated reporting tool.

We have observed that posts on X remained live and public for significant periods of time, and most remain so. By the time of reporting, 13th and 14th of April, 54 accounts had been taken down. These accounts were left up for over 30 days before being taken down, far after they had done their damage. 

We were unable to report 130 of the accounts as the X reporting tool was redirecting us to an X help centre article on “Appeal a locked or suspended account”. This seems to be some type of bug. We were unable to re-create it on other accounts. 

X replied to the flagging of the remaining 95 tweets, saying that they did not find the content to be “subject to removal under the legal grounds of DSA Law in the EU”.