Germany targeted by Russian propaganda, claims analyst

A Russian disinformation campaign is targeting the German government and its voters in the run-up to elections to try and erode the country’s financial support of Ukraine, a cybersecurity firm is warning.

The claim by US-based SentinelLabs is based on its observation of so-called news websites that it has linked to Doppelgänger, a Russian-aligned information operation (IO) group that has been tracked in Europe since at least May 2022, shortly after the Kremlin’s invasion of Ukraine began.

Since around November last year, SentinelLabs says it has observed an IO campaign “highly likely orchestrated by Doppelgänger” that aims to undermine domestic support for Germany’s coalition government.

Although it stops short of saying so directly, the analyst seems to believe that Doppelgänger’s objective is to put the coalition led by Chancellor Olaf Schultz out of power so its military support for Ukraine is derailed.

In some cases, the websites controlled by Doppelgänger mimic authentic, established news portals to lend their anti-Ukraine narrative a veneer of legitimacy, SentinelLabs says.

“Doppelgänger has been very active in creating websites that host articles for consumption by targeted audiences,” said SentinelLabs. “Among these sites, there are domains and websites impersonating third-party news outlets, which includes mimicking their design, structure, and domain names.”

For instance, the phony “welt[.]pm” – which closely matches the authentic website version (“welt.de”) of the German national daily Die Welt – has been traced by Sentinel Labs to Doppelgänger.

Cybernews ran a search engine check on the former, but it immediately defaulted to the authentic welt.de news site – when we reached out to SentinelLabs for clarification on the matter it said this merely indicates the dummy website is lying dormant.

“The threat actors tend to ‘activate’ and ‘deactivate’ over time the custom content they host on some domains," it said. "For domains that pose as legitimate news outlets, such as welt[.]pm, the ‘deactivation’ is often done by redirecting visitors to the legitimate counterparts, such as welt[.]de.”

In any case, not all the sites linked to Doppelgänger mimic established news outlets – many others have simply been designed to look like standalone German-language news and editorial portals, says SentinelLabs.

“We assess that the rest of the websites we observed have been created by Doppelgänger with original design and structure and no indications of impersonating established news platforms,” it said.

"Doppelgänger has been very active in creating websites that host articles for consumption by targeted audiences."

SentinelLabs on the Russian-aligned disinformation campaign group that has turned its attention to Germany in the run-up to elections there

Workers striking? Let’s make it about Ukraine…

According to SentinelLabs, the websites appear to be using news coverage of genuine issues in German domestic politics – for instance, strikes by farmers and public transport workers demanding better subsidies and working conditions – to attack the country’s support for Ukraine.

In one example, arbeitspause[.]org – one of the dummy news outlets controlled by Doppelgänger identified by SentinelLabs – has tried to tie the issue of German farming subsidies to the country’s financial support for Ukrainian resistance against Russia.

The analyst claims the Russian-controlled portal focused “on the recent strikes by German farmers, which involved the blockade of major roads and were motivated by rising living costs and the government’s plan to phase out agricultural subsidies.”

“Overlapping at times with the strikes in the public transport sectors, the farmers’ strikes have been disrupting mobility and therefore garnered the attention of the population and mass media,” it added. “Doppelgänger has attempted to capitalize on the momentum by criticizing the government’s plan regarding agricultural subsidies, drawing a connection to the government’s support for Ukraine.”

SentinelLabs cites as evidence a snippet from an arbeitspause[.]org article, which says: “Politicians should reconsider their spending on the state apparatus and support for Ukraine instead of withdrawing social funds. Otherwise, they will face a massive backlash from citizens and a shortage of supplies in stores.”

Cybernews can confirm that a German-language news portal going by the domain name arbeitspause[.]org appears to be active.

“The challenges relating to the state of workers in this sector, such as rising living costs due to inflation and shortage of workers, are a pressing concern in Germany that captures the attention of the broader population,” said SentinelLabs.

Immigration? Still about Ukraine…

Another article cited by the analyst and taken from Doppelgänger-controlled derglaube[.]com similarly seeks to play on German fears over immigration and again ties the issue to that of supporting Ukraine, the analyst says.

“An article at derglaube[.]com focuses on the German immigration policy, which, according to some polls, ranks among the top issues for voters in Germany,” said SentinelLabs. “In addition, the media frequently covers topics relating to the government’s allocation of funds for immigration-related programs and services.”

As such, it claims, Doppelgänger’s IO network “uses this opportunity to cast the government in a negative light and introduce its support for Ukraine into the narrative.”

The cited article refers to Germany’s migration policy as being “viewed by critics as an economic catastrophe” and describes the government as seeming to be “overwhelmed” and “drowning in the chaos of the problems it has created.”

In further criticism of German governmental policy, the article goes on to add: “As Germany faces an internal budget crisis, Chancellor Olaf Schultz is causing a stir by reaffirming his promise to continue supporting Ukraine financially and militarily. This determination raises questions not only about effectiveness but also about the prioritization of national interests.”

This website too appears to be active and, curiously, to have a particular focus on the Abrahamic religions, with a separate tab for Islam, Christianity, and Judaism running across the top of its landing page.

Cybernews asked SentinelLabs for links to the original German-language articles published on arbeitspause[.]org and derglaube[.]com that it cited in the course of its research and was able to verify the accuracy of the citations.

Why Germany matters to Russia

Germany is regarded as one of the key supporters of Ukraine, despite previous criticism of its over-reliance on Russian gas – a problem it has since rectified – and is reported by Statista as having donated nearly €21 billion ($22.5 billion) from the outbreak of war in February 2022 to last October. This makes it the single biggest donor country behind the US.

The bulk of this financial support has been military – a recent German federal government report says that to date, it has supplied Ukraine with dozens of armored personnel carriers, tanks, and drones, as well as rocket launchers, air defense systems, and thousands of rounds of artillery ammunition.

Furthermore, Germany plans to send the embattled nation further materiel, including more than 100 Leopard battle tanks, three Skynex air defense systems, 15 self-propelled anti-aircraft guns, three dozen self-propelled howitzers, and hundreds more reconnaissance drones.

Naturally, these are the kind of supplies Russia will be anxious to derail at a time when US funding for Ukraine has stalled in Congress, and there are fears that the beleaguered country’s fighters could run out of ammunition.

Whilst it cannot explicitly tie the detected Doppelgänger IO campaigns to this objective, SentinelLabs appears convinced that its activities are aimed at indirectly bolstering Russia’s war effort and thus furthering its interests in Europe.

“At a high level, the research details a recent Russia-aligned influence operation targeting Germany,” a spokesperson for SentinelLabs told Cybernews, claiming that its findings aligned with similar recent reports by the German Ministry of Foreign Affairs and national daily Der Spiegel.

She added: “Researchers suspect that the goal is to erode support for [Germany’s] ruling coalition in light of upcoming European Parliament, municipal, and federal state elections, culminating in federal government elections scheduled for 2025.”

Last year, Doppelgänger was spotted running similar disinformation campaigns to stir up conflict, in this case leveraging the Israel-Hamas conflict.

NB: The article was updated on February 23rd to include clarifications from SentinelLabs that allowed Cybernews to verify the authenticity of all the citations mentioned.