In early April, ClearSky’s team discovered a persistent Yemeni/Houthi influence campaign
operating in Israel and the Gulf states. We first exposed the campaign in 2019. It continues
to operate in a similar manner to what was uncovered in 2019. Between 2019 and 2022,
the campaign mainly focused on Gulf countries, particularly Saudi Arabia and the UAE,
and returned to focus on Israel from late 2024. We did not found any indication that that the
campaign targeted Israel between 2019–2022.

The campaign operators have invested for years in building and maintaining an
infrastructure that includes fake websites, Facebook pages, and social media profiles. The
ongoing maintenance of such a campaign indicates its importance and the resources
allocated to sustain it. These resources include, among other things, dedicated personnel,
funding, and a certain level of proficiency in Hebrew.

The campaign first exposed in 2019 involved the dissemination of false reports by several
social media profiles. These reports focused on gossip-related topics (for example, the
death of an Israeli actress and singer). They were published on pages of Israeli media
outlets and in several marginal Israeli social media groups, mainly on Facebook. The 2019
campaign was based on methodologies used in Iranian influence campaigns that we had
uncovered starting in 2018.

This report focuses on the campaign active in recent months, with an emphasis on the
personas created to disseminate content, the websites established as part of the
infrastructure, and the campaign’s messaging.
The report also addresses differences between the 2019 campaign and the content
published in the current one.

Read the current report:

Read our report from 2019:

ClearSky Cyber Security and SentinelLabs have discovered a new wave of Russian information warfare campaign named Doppelgänger NG. “Doppelgänger” (meaning spirit double, an exact but usually invisible replica) is a global information warfare campaign publishing false information on hundreds of fake websites and social media channels.
Our research revealed that “Doppelgänger NG” is again fully operational in 2024, using new infrastructure. Furthermore, we found a link between the “Doppelgänger NG” Campaign and the Russian cyber espionage group APT28.

Key findings:

• New infrastructure used by “Doppelgänger NG”.
• We discovered a potential link between APT28 to “Doppelgänger NG” campaign.
• The “Doppelgänger NG” campaign has expanded its victims list, including new targets in the US, Germany, Israel, and France.
• The “Doppelgänger NG” network contains more than 150 domains, including news feeds
  relevant to five countries (United State, Israel, France, Germany, Ukraine).

Doppelgänger report

Doppelgänger IoCs file

SentinelLabs report