French cyber experts Viginum uncovered a new network of online platforms disseminating Kremlin-backed propaganda. These platforms, operating under the umbrella of “Portal Kombat,” have been identified as a successor to the previously identified Doppelgänger (RRN) network, purportedly supported by entities such as Rostec and potentially the GRU, Russia’s military intelligence agency. Established in 2021, Viginum’s mandate revolves around detecting and combating digital interference orchestrated by foreign entities with the intent to sway public opinion.
According to Viginum’s findings, the Portal Kombat network encompasses no fewer than 193 websites. Initially focusing on news from Russia and Ukraine, the network swiftly pivoted its narrative following Russia’s invasion of Ukraine, redirecting its efforts towards occupied Ukrainian territories. Subsequently, the network expanded its reach to encompass various Western nations sympathetic to Ukraine and its populace. Characterized by a lack of original content, these sites predominantly recycle materials sourced from Russian or pro-Russian social media accounts, Russian news agencies, and the official websites of local institutions. Furthermore, the network has been found to propagate fabricated news stories.

pravda-en[.]com websites.The other three sites are built along the
same lines.
The overarching objective of the Portal Kombat network appears to be the dissemination of a positive portrayal of the Russian invasion, euphemistically termed a “special military operation,” while concurrently disparaging Ukraine and its leadership. Operating across multiple languages, the network utilizes domains registered in several Western countries, including France, Germany, Austria, Switzerland, Poland, Spain, the United Kingdom, and the United States. Notably, between June 23 and September 19 of the preceding year, these sites collectively published upwards of 150,000 articles. Beyond sharing a uniform narrative, these sites exhibit identical technical attributes, including a shared IP address hosted on a server located in Russia, consistent HTML architecture, graphic layout, sectioning, and external linking patterns.
Notably, Doppelgänger bot network, which, in addition to disseminating anti-Ukrainian content, was found to propagate anti-Semitic materials. Under the pretext of expressing “deep concern,” numerous bots circulated a video allegedly originating from the Turkish nationalist group Grey Wolves (Bozkurtlar), wherein terrorists purportedly threatened to orchestrate an attack targeting Jews at the 2024 Olympics in Paris, evoking memories of the tragic events at the 1972 Munich Olympics, during which 17 individuals, including 11 members of the Israeli national team, perished.
Moreover, tens of thousands of accounts across various social media platforms, including X (formerly Twitter), shared links to counterfeit websites masquerading as reputable Western media outlets. These websites purportedly featured fabricated quotes attributed to prominent figures such as Beyoncé, Oprah Winfrey, Cristiano Ronaldo, and others, condemning the war in Ukraine and criticizing ongoing Western support for Kyiv.
In December 2022, Meta disclosed that Structura National Technologies, an IT firm, and Social Design Agency (Агентство Социального Проектирования), a marketing and political consulting entity, both subject to European sanctions, were identified as the perpetrators behind a spam attack originating from Russia. Notably, the ultimate proprietor of National Technologies is Rostec, Russia’s state-owned defense conglomerate helmed by former KGB agent Sergey Chemezov, known to be a close confidant of Vladimir Putin.
Furthermore, the bot network in question was found to endorse the EuroBRICS website, which has been linked to the GRU’s Special Service Center (Military Unit 54777). Consequently, in July 2023, the European Union imposed sanctions targeting individuals involved in the misinformation campaign, including National Technolog