Doppelgänger NG Cyberwarfare campaign

ClearSky and SentinelLabs report on “Doppelgänger NG”, a 2024 Russian information‑warfare campaign that operates hundreds of fake news sites and coordinated redirect chains to publish disinformation across the US, Israel, Ukraine, France and Germany. The analysis documents new infrastructure (root domain sdgqaef.site), obfuscated Base64 JavaScript redirect stages, reuse of Google Analytics IDs linking impersonating and legitimate domains, forensic ties to an APT28-attributed phishing HTML file, and an extensive set of IOCs (domains, IPs, ASNs) for detection and mitigation.