Ukraine spent several days last week attacking Russian technology infrastructure, including three facilities associated with Yandex…the country’s largest technology company. The strikes reportedly hit Sasovo in Russia’s Ryazan region on October 8, Kaluga on October 9, and Vladimir by October 11. Russian websites, cloud services, payment systems, and ride-hailing apps experienced disruptions as the damage affected Yandex’s operations.
But something else was attracting attention on X. On October 11, screenshots began circulating showing what appeared to be a sharp decline in posts containing the phrases “Free Palestine” and “genocide.” The charts covered October 5 through 11, with the steepest declines appearing toward the end of that period. Meanwhile, mentions of Ukrainian President Volodymyr Zelenskyy appeared to be increasing.
Visegrád24, a popular news account on X, shared the charts and reported on the speculation surrounding them. Had Ukraine just knocked out part of a Russian bot network responsible for flooding social media with pro-Palestinian messaging? The timing certainly caught people’s attention, particularly because the apparent drop followed the attacks on Russian data centers.
On October 12, Zelenskyy added fuel to the discussion during his address to the Warsaw Security Forum.
“When our strikes reached Yandex’s data centers, it suddenly became a little easier to breathe on many social media platforms,” he said. He described fewer bots, less hatred, and fewer provocations online, suggesting that the disruptions had exposed part of Russia’s machinery for manipulating public conversations.
The screenshots raised plenty of questions, although the available data couldn’t answer the biggest one. The figures displayed alongside the charts included approximately 304,000 posts associated with “Free Palestine” and 1.5 million associated with “genocide” over seven days. Those were search totals, not verified counts of Russian-operated accounts. The screenshots also didn’t identify who wrote the posts, where the accounts were based, or whether the same search settings were used throughout the comparison.
Cloudflare measurements did show a substantial reduction in automated traffic associated with Yandex following the strikes. Much of that activity, however, involved search-engine crawlers, the programs that scan websites so their contents can appear in search results. A search crawler going offline doesn’t tell us whether a Russian propaganda account on X has stopped posting.
The damaged facilities have not been publicly linked to the accounts behind the apparent decline in Palestine-related posts. Russian influence networks also use infrastructure outside Russia, and researchers monitoring Kremlin propaganda reported that those operations continued after the attacks.
Still, the suggestion that Moscow has been manipulating conversations about Israel and Gaza didn’t originate with this week’s screenshots. American investigators had already uncovered a Kremlin-directed operation that created fake American news websites, impersonated Israeli publications, and circulated fabricated stories about the October 7 massacre. Some of those stories tried to convince Israelis that Ukraine had helped arm Hamas. Others were aimed at Americans arguing over Israel, Gaza, and military assistance to Kyiv.
The people running these operations weren’t nameless internet trolls, either. They worked through Russian companies with executives, government connections, and internal planning documents. In September 2024, the U.S. Justice Department seized 32 internet domains associated with one of those operations, including washingtonpost.pm, a counterfeit website designed to resemble the real Washington Post.
The operation had a name: Doppelganger. And the people behind it had been very busy.
The men (and women) behind Doppelganger weren’t sitting around posting angry comments from anonymous accounts. They had businesses to run, employees to manage, and government officials to satisfy…(and I just reminded myself of something my mom used to say…she had places to go, people to see, things to do.)
Two of the companies involved were Social Design Agency, headed by Ilya Gambashidze, and Structura National Technology, associated with Nikolai Tupikin. A third organization, ANO Dialog, was also identified in American investigations of Russian influence operations. The U.S. Treasury sanctioned Gambashidze and Tupikin in March 2024 for their involvement in activities conducted on behalf of the Russian government.
Their work involved creating counterfeit news websites that resembled familiar American and European publications. A reader clicking on a link might find what appeared to be an article from the Washington Post, complete with a convincing layout and a headline about an issue already dominating the news. The address, however, was slightly different, and the story had been placed there by a Russian influence operation.
The websites were only part of the business. Fake social media accounts shared the articles, paid advertisements directed people to them, and fabricated online personalities helped the material spread further. The operation had internal planning documents, performance targets, and proposals describing how to reach different audiences.
In September 2024, the Justice Department seized 32 domains associated with Doppelganger and published details of the Russian government’s involvement. Investigators identified Sergei Kiriyenko, first deputy chief of staff in Vladimir Putin’s presidential administration, among the senior officials connected to the campaign.
The recovered documents included plans with names such as Good Old USA, The Guerilla Media Campaign, and U.S. Social Media Influencers Network. The operators wanted Americans to run into Russian-approved messages without realizing who had written them. An article that appeared to come from an American newspaper, or a comment from someone (or something, aka a bot) posing as an American voter, was far more useful than a statement from the Kremlin.
Following the October 7 massacre, Russian influence operators began spreading a claim that Hamas terrorists had gotten weapons supplied by Western governments to Ukraine. The allegation was presented through fabricated reports and social media posts that imitated legitimate news coverage.
Imagine being an Israeli who had just watched the horrific footage from October 7, only to encounter what looked like a credible news report claiming that some of the weapons used by Hamas had come from Ukraine. Or an American taxpayer who had supported sending military assistance to Kyiv, suddenly being told that those weapons had ended up in the hands of terrorists.
Microsoft’s Threat Analysis Center documented the campaign in December 2023. Its researchers had been following Doppelganger under the designation Storm-1099 and observed the network expanding toward American and Israeli audiences after October 7.
The allegation about Ukrainian weapons wasn’t supported by credible evidence. It was useful to Moscow because it could turn Israeli anger toward Ukraine and encourage Americans to question continued military assistance. Russia was already fighting a war against Ukraine, and weakening Western support for Kyiv was one of its central foreign-policy goals.
The operation also produced fabricated videos made to resemble reports from established news organizations. Someone encountering one of those clips while scrolling through social media might have no reason to suspect that the material had originated with Russian operators rather than the news outlet whose branding appeared on the screen.
