Background

Doppelganger is an active Russian influence operation that was first recorded in 2022. It is delivered for the benefit of the Kremlin by the Moscow-based organisation “Social Design Agency”, which is subject to sanctions by the European Union. Their activities have been tracked by open source intelligence (OSINT) researchers affiliated with the Counter Disinformation Network (CDN) since July 2024, leading to four previous reports and alerts. Alliance4Europe is continuously tracking its activity together with CeMAS (title) Lea Früwirth.

In January 2025, Alliance4Europe published a report showing that Doppelganger had expanded its operations to BlueSky, mapping out the tactics and techniques employed by the operation on that platform. That report led to an exchange with BlueSky’s Trust and Safety department, which took action to ensure that Doppelganger would cease its operations on the platform.

In April 2025, Alliance4Europe and Debunk.org published a report showing that the illegal Doppelganger influence operation had begun engaging with the Polish presidential elections on the social media platform X (previously known as Twitter) during the period between March 4 and April 4. Representatives of X acknowledged receipt of this report via email, and Polish media widely covered the research findings (E.g. examples 1, 2, 3, 4)

In spite of this, the operation has remained active throughout the first round of the Polish presidential elections. Indeed, Doppelganger has not been seen changing its behavioural patterns since the original report on the operation was published in September 2024 by Alliance4Europe, CeMAS, and other members of the Counter Disinformation Network. Since then, the operation has interfered with the German elections, and now in the Polish elections.

Operation Doppelganger, X and EU Law

Given that the operators behind the influence operation are subject to EU sanctions, X has a legally binding obligation to geofence their content from EU audiences, as outlined by Alliance4Europe’s December 2024 Doppelganger report. It is possible that X’s failure to geofence or remove flagged tweets might constitute a violation of the EU sanctions against the Social Design Agency.

Furthermore, the Digital Services Act (DSA) stipulates in Articles 34 and 35 that Very Large Online Platforms (VLOPs), such as X, have a responsibility to mitigate systemic risks towards electoral processes. It can be argued that X has failed to meet this responsibility given this apparent omission. Given that a significantly smaller competitor platform, such as BlueSky, has proven able to take effective action against Operation Doppelanger, it stands to reason that X could plausibly do the same.

Doppelganger Activity in April–May 2025

Between April 11 and May 21, 321 Polish-language tweets were traced to originate from the Doppelganger operation. Their relation to Doppelganger is inferred by their exhibition of the same behavioural patterns as those previously identified as characteristic of Doppelganger. They are made by inauthentic X accounts posting tweets that position them as Polish citizens, who have less than 10 followers. Despite the low following, the accounts get their content quote-tweeted by other inauthentic accounts onto authentic users’ posts hundreds of times. The tweets contain articles which align with or support Russian narratives. At times, articles which in fact do not necessarily support Kremlin talking points are reframed in the tweets to twist their meaning into a  Russian-aligned message.

The 321 tweets were quote-tweeted over 271,000 times onto other users’ content. Considering these inauthentic interactions, which also translates into over 271,000 inauthentic views, it seems like the content gained around 1,229,000 views. The operation also gained 3879 likes. It is unknown how many of these are authentic or inauthentic.

Electoral Silence Violation

Poland has a two-day electoral silence period, as defined by the Polish Election Code, and violations can carry fines.

At least four of the Doppelganger tweets in our dataset mentioned a political candidate and were published on May 17, 2025, one day before the first round of elections, which is during the electoral silence period.

As per the Digital Services Act Articles 34 and 35, the social media companies are obliged to implement measures against and address illegal content on their platforms. In this case,  it would seem plausible that X has not lived up to this responsibility, both in regard to the electoral silence and the violation of sanctions, as the operation operated during the silence period.

Articles Amplified

Doppelganger’s modus operandi includes resharing articles and presenting them with posts and captions that align with Kremlin narratives. The following outlets were amplified by the tweets contained in this report’s data set:

Amplified Media

Media	Number of posts with articles	Description
Bankier.pl	91	Financial Publication
wpolityce.pl	83	Right-wing Outlet
fronda.pl	46	Right-wing Outlet
nczas.info	23	Right-wing Outlet with a history of republishing RT
money.pl	20	Economic portal
rp.pl	8	Economic daily
rmf24.pl	8	Conservative-leaning Radio Station

Russicisms, Grammar Issues and Repetitive Phrasing

The posts of the dataset contain several phrases repeated across ostensibly unrelated accounts. This includes phrases such as “nie możemy pozwolić”, which translated to “we cannot allow…” Given that authentic posters tend to naturally vary their language, express themselves in personally distinct ways and adapt phrases to individual context, verbatim repetitions of complex political statements such as the example above across 16 accounts from several different listed countries of origin is statistically improbable.

Another repeat feature of the data set is the recurring nicknaming of Nawrocki as “Nawo”, which is not a common nickname for Nawrocki in Polish discourse. The repeated usage of this might be theorised as a shared autocorrect feature, or some type of difficulty to spell the Polish surname.

Additionally, out of a random sample of 50 posts, 26 posts were found to include Russicisms, poorly-translated phrases or assorted grammatical and linguistic errors. The frequency of this occurrence (52%) within the limited random sample serves as an additional indication that the posts found in the data set were authored by non-native speakers of the Polish language.

Examples of incorrectly written Polish includes:

• “Nie możemy być już uciszką w rękach UE!
• “Niemcy eksportują do nas swoje problemy, a my mamy tość skrupów, aby przyjąć je z otwartymi ramionami?”
• “Musimy myśleć o naszej przyszłości i nie pozwolić, aby decyzje podejmowane w Brukseli nasz badlywały.”

Some accounts used words that either don’t exist in the Polish language, or which indicate some level of linguistic influence from Russian, both in vocabulary and in syntax. For example:

• The word “kompromity”  seems to be used as a Polish version of the Russian term “компромат”, which refers to compromising materials, but the noun does not exist in proper Polish.
• Tweets use “ES” instead of “EU”, which is reminiscent of the Russian abbreviation EC (from “Европейский союз”),
• The phrase “wciągnąć w konflikty nie na naszej płycie” is a literal translation of a Russian expression, “не на нашей площадке”, which translates to “not on our playing field”, and which reads as inauthentic Polish.
• Similarly, “dziesięcioinkomowiec” is a malformed plural based on Russian grammar (десятиинкомовцев).
• The sentence “We can no longer be uciszka in the hands of the EU!” uses a fabricated word – uciszka – which mimics Russian-sounding diminutives like игрушка (toy).
• The claim that “Germans export their problems to us, and we have enough skrupy to accept them with open arms?” contains skrupy, a word that does not exist in polish, but which might derive from a mistranslation of “scruples” or “burdens.”
• The phrase “nasz badlywały” appears to be an unsuccessful formulation pretending to be Polish and taken from the English phrase “treat us badly”, which is not a natural polish statement.

Image 1: Tweet using “dziesięcioinkomowiec”