Russian Influence Operations Targeting Germany’s 2025 Elections

Executive Summary

The German federal elections, scheduled for February 23, 2025, are the target of malign influence operations linked to Russia and Russia-based actors. As of mid-February 2025, Insikt Group assesses that, despite their persistence, these efforts have very likely not meaningfully altered voter behavior or shaped public opinion in a manner advantageous to Russia’s broader geopolitical interests, consistent with assessments of Russian meddling attempts in previous German election cycles.

The influence operations and corresponding networks tracked in this report — Doppelgänger, Operation Overload, CopyCop, Operation Undercut, and the Russia-based Foundation to Battle Injustice — are longstanding and at least partially Kremlin-funded. These operations almost certainly seek to incite and escalate German domestic socio-political conflicts, pollute the German information space by introducing manipulated content, foster criticism of the United States (US) and European Union (EU) and European integration, and undermine North Atlantic Treaty Organization (NATO) cohesion in line with the Kremlin’s strategic objectives.

The 2025 German election cycle marks a period of evolution for several of these operations, while core narratives remain unchanged. For example, Doppelgänger and Operation Overload have expanded beyond mainstream social media to Bluesky Social (Bluesky), in an attempt to capture migrating audiences. Doppelgänger and CopyCop have launched new brands and websites to project influence and reinforce messaging in the face of intensified scrutiny of their operations. Operation Overload continues to use artificial intelligence (AI)-based tools, including the use of AI-enabled voice cloning technology to create audio deepfakes, while both Operation Overload and Operation Undercut pose as real news organizations to increase their credibility.

Despite limited evidence that these operations have meaningfully influenced voter behavior, they still pose broader risks to media integrity and public trust. Narratives undermining election security or integrity could reduce voter turnout, while media engagement with inauthentic content — rather than exposing the tactics behind it — may amplify malign messaging. Regarding Operation Overload specifically, we continue to assess that the potential for significant breakout does exist, as evidenced in the viral spread of a recent video attributed to this network that disparaged the United States Agency for International Development (USAID) in social media. To mitigate these risks, media entities, the public sector, and researchers should continue monitoring known influence networks while limiting engagement with operations such as Doppelgänger, Operation Overload, and Operation Undercut. Impersonated organizations should engage takedown services for malicious domains, collaborate with platform trust and safety teams, and proactively detect brand abuse tactics like typosquatting and logo manipulation.

Key Findings

• The German federal elections are the target of malign influence operations attributed to Russia and Russia-based actors.
• Russia-attributed influence operations have promoted and will very likely continue to support German political parties Russia views as beneficial to its own geopolitical interests, particularly Alternative für Deutschland (AfD).
• Doppelgänger is very likely exerting influence through at least seven new inauthentic news brands, in addition to the operation’s persistent media impersonation activities, to exacerbate political fissures and inflame political discourse surrounding European integration, immigration, and economic matters.
• Operation Overload’s media impersonations aim to sow distrust among German citizens toward the safety and integrity of voting, attack the characters of key political leaders, and present Germany as a rising hotbed of antisemitism and extremism.
• Insikt Group detected at least 94 new inauthentic websites –– whose creation began in November 2024 after the announcement of upcoming snap elections –– that we attribute to CopyCop impersonating German-language news websites.
• Following Insikt Group’s November 2024 investigation into Operation Undercut, we have observed the network continuing to post German-language content supporting AfD and undermining German Chancellor Olaf Scholz.
• The Foundation to Battle Injustice very likely seeks to undermine the reputations of German political leaders while promoting political platforms aligned with Russian interests through inauthentic investigative articles.

New Doppelgänger “Brands” Target Key German Election Issues

Insikt Group has detected at least eight new websites acting as original news brands, in addition to continued media impersonation with social media promotion, which we attribute to Doppelgänger, a longstanding Russian influence operation. Doppelgänger is very likely positioning these newly established websites — previously not linked to the network — to sustain its influence operations targeting European political leadership and to exacerbate political fissures surrounding European integration, immigration, economic matters, and more. Throughout 2024, researchers, government entities, and technology companies continued exposing Doppelgänger’s activities across Europe and North America, leading to a US Department of Justice indictment against its operators at the Social Design Agency (SDA), international sanctions on SDA and affiliated entities, and at least partial — though often temporary — disruptions to its operations through takedowns and seizures. In response, SDA typically attempted to reestablish its operations within hours to days by deploying new infrastructure.

While Doppelgänger is best known for the direct impersonation of legitimate Western media organizations, the influence operation has also managed a multitude of its own original news website “brands”, each targeting a specific country (such as Germany), with content directly tailored to the key domestic and foreign policy issues of that target audience, such as immigration policy, Germany’s ongoing socio-economic challenges, and questions of Germany’s place as Europe’s leader (as seen in Figure 1). Insikt Group has observed Doppelgänger abandoning several of its “legacy” brand websites with attempts to establish new brands, including multiple websites specific to German politics, likely due to a combination of repeated discovery and disruption of several of these websites.

While we continue to observe Doppelgänger evolve its tactics and attempt to evade defenders, its ability to meaningfully impact public discourse very likely remains limited. Despite continued efforts to expand its network, Doppelgänger remains constrained by low levels of engagement, with minimal views and interactions across its newly launched domains and social media brands.

Using New Infrastructure to Deliver Old Themes

Since October 2024, Insikt Group has tracked a series of new domain registrations, discovering web page infrastructure that overlaps with previously attributed Doppelgänger-controlled domains. As of February 2025, Doppelgänger has registered ten domains that include eight new websites and two “parked” domains. The active domains reflect seven news brands that target German-speaking audiences:

Figure 1: New Doppelgänger domains specific to Germany and German-speaking audiences (Source: Recorded Future)

Figure 2: The seven new Doppelgänger brands targeting Germany and German-speaking audiences
(Source: Recorded Future)

Each of the active websites uses distinct IP addresses, listed below, with the exception of weltwahl[.]com and stolzvolk[.]org, which both share 15.197.130[.]221. Administrators of these domains use web hosting provider resources provided by Hosting Concepts B.V. (d/b/a Registrar.eu), QHoster, NameSilo, Namecheap, or Vicetemple. Stolzvolk’s newest domain, stolzvolk[.]ac, uses web hosting services provided by Ultahost, Inc.