Tracking Russian Disinformation On X During The French Parliamentary Elections

Foreign Information Manipulation and Interference (FIMI) is not a new phenomenon, but its scale has reached an unprecedented level in our digital age. 
Russia has engaged in large-scale coordinated disinformation operations on multiple occasions, using social media manipulation as part of a broader domestic and foreign policy strategy. A notable FIMI operation is the Russian interference in the 2016 US presidential election campaign. French elections have also been the target of Russian information operations, notably with the Macron Leaks affair in 2017.
The intensity and frequency of such operations have significantly increased since the start of the invasion of Ukraine by Russia in February 2022, with active influence networks operating online in Europe since at least May of the same year.
The electoral campaign for the European elections already represented an intense period of activity for Russian actors of disinformation. In France, the list of the government only obtained 14,60 percent of the votes, while the far-right opposition party of the Rassemblement National gathered 31,37 percent of the votes. Following those results, French President Emmanuel Macron dissolved the lower house of Parliament and called for legislative elections on 30 June and 7 July. The dissolution and the subsequent elections constituted an opportunity for Russian disinformation actors. 

This article examines Russian disinformation on the X social media platform (formerly known as Twitter) during the French parliamentary elections. QuoIntelligence tracked potentially inauthentic accounts, analyzing their behavior and the narratives they spread. We used the ABC framework to structure our investigation and the DISARM framework to map the different tactics, techniques, and procedures (TTPs) used in this operation (See annex 1).

Key Findings

Our main takeaways and key findings in this article include:

• • Russian disinformation network Doppelgänger has been active on X throughout all the French Parliamentary elections.
  • The campaign aimed to undermine support for Ukraine, denigrate President Macron, promote the far-right party Rassemblement National, sow division in French society, and weaken France’s alliances.
  • To achieve these objectives, the Doppelgänger network used three subsets of inauthentic X accounts showing varying levels of sophistication.
  • We identified some bot-like accounts posting memes and false celebrity quotes, while others shared links to websites impersonating reputed media as well as original Doppelgänger-created versions of French news sites. More curated profiles mimicked news videos and press articles, using reputable media names to enhance credibility.
  • The campaign had likely very limited impact on the outcome of the elections but contributed to fuel general mistrust in information.

Actor: Doppelgänger, A Russian Persistent FIMI Threat

QuoIntelligence has tracked the activity on X of the Russia-based disinformation network dubbed Doppelgänger. This persistent network was first identified by the EU Disinformation Lab in September 2022. It characterizes itself by social media manipulation deliberately building a network of websites impersonating media and government to convey pro-Russia narratives and sow divisions in countries supporting Ukraine. Researchers have linked this campaign to several companies based in Russia. Doppelgänger has been active for over three years, operating across Europe and the US, tailoring its content to different audiences and events. The network has demonstrated persistence, likely indicating its imbrication into Russian foreign policy. 
Some of the websites QuoIntelligence discovered in this campaign were already reported in previous disinformation campaigns and attributed to the Doppelganger network. Analysis of the campaign also points to the Tactics, Techniques, and Procedures (TTPs) used by this disinformation network. 

Behavior: Three Subnetworks Of Inauthentic Accounts Operating On X 

Our investigation identified three sets of inauthentic accounts displaying sensibly different behaviors. These subnetworks exhibit varying levels of sophistication, both in the content they share and the TTPs they employ to evade platform detection.

Single-use Accounts Sharing Links
The first set of inauthentic accounts we identified were single-use accounts. These profiles made no efforts to conceal their bot-like appearances. The accounts were relatively new, only a few months old, and had hardly any followers. Their profile pictures depicted bored apes, referencing the Bored Ape Non-Fungible Token (NFT), or were likely AI-generated. These accounts have very few interactions on X. Their previously published content was related to NFT and cryptocurrency (potentially scams) and written in languages different from the one used for the disinformation campaign.

Figure 1 – Screenshot showing three X posts from a single-use account. Translation: “For the first time, I feel the wind is changing in France. Good riddance Macron!”

Their participation in the campaign involved a single disinformation post, sharing a link to an inauthentic website associated with the Doppelgänger network. Their posts did not include any hashtags. The operators used varying sentences and slightly different URLs to avoid detection.
These URLs redirected to three types of websites:

• • The first set of URLs and the most numerous ones redirected to original websites self-created by the Doppelgänger network, including the French version of the RNN website (Reliable Recent News), first attributed to this actor by the French watchdog for foreign digital interference VIGINUM. We tracked eight other original domains: lesfrontieres[.]media, artichoc[.]io, lexomnium[.]com, franceeteu[.]today, notrepays[.]today, tribunalukraine[.]info, lesifflet[.]net, laterrasse[.]online, some of them already reported in previous research.
  • Other URLs redirected to typosquatting websites cloning reputable news websites such as LePoint and Le Parisien. While the Doppelgänger network is known for cloning news and government websites, researchers uncovered a typosquatting website of Psychologies Magazine, a woman magazine dedicated to well-being and personal development, likely created by the Doppelgänger network. This move was likely an attempt to reach other audiences that may not be interested in politics.
  • Some posts also shared legitimate articles from LePoint, Liberation, Le Monde, L’Opinion, France TV Info, Le Figaro, Les Echos, or The Conversation.

Single-use Accounts Sharing Visuals
The second group of inauthentic X accounts relaying Russian disinformation shows numerous similarities with the first set of profiles. They are also single-use accounts with a low degree of sophistication: recent accounts, random profile pictures, few to no followers, and previous posts related to NFT or cryptocurrencies. Their posts only contained one sentence, without any hashtag. This set of accounts differs from the previous one by relaying spreading, including memes, videos, and pictures of public figures such as Allain Delon, Bilal Hassani, Adèle Exarchopoulos, or Vincent Cassel, along with false quotes. Some of the memes were highly likely AI-generated.

Figure 2 – Screenshot showing a X post from a single-use account. Translation: “Ukraine never existed before and never will. Ukraine is Poland, Hungary and Russia.”

Curated Accounts Sharing News-like Content
The third set of accounts we monitored were curated X profiles, more likely to deceive users on the platform. The accounts were verified profiles, indicating the actors behind them paid to get the X checkmarks next to their profile names to increase credibility and visibility. These accounts were created over the past four years and used photos of random individuals. They published several disinformation posts containing curated visuals mimicking news videos or articles. Their posts often referred to reputed think tanks or media outlets such as the Carnegie Endowment for International Peace, Pew Research Center, The Guardian, Politico, Le Point, Financial Times, Reuters, Kyiv Independent, or Wprost.

Figure 3 – Screenshot showing a X post from a curated account. Translation: “CREA: In 2023, the United States was the biggest buyer of refined products made in India from Russian crude, worth $1.3 billion. In the end, the Yankees are the biggest hypocrites of all.” The image is titled “Russian LNG: The EU New Dependence” and allegedly quotes the Financial Times (FT), Politico, and Reuters.

On the first days of our investigation, this set of accounts reposted each other publications. This likely facilitated their identification by X moderators, leading to their suspension. Additionally, it limited the amplification of the campaign as the platform blocks the visualization of reposts from suspended accounts. Following X’s reaction, the actors behind these accounts stopped this reposting practice. 
Additionally, on 22-23 June, X suspended numerous curated accounts. This led the actors operating this campaign to adapt their modus operandi. Single-use accounts started to post the content usually shared in curated profiles, indicating the same actors were likely behind all three types of accounts. This shift ensured the continuity of their operations while operators built new curated accounts. 

Content: Primarily Focused On Undermining Support For Ukraine And Denigrating French President

The content shared by inauthentic X accounts during this campaign was in French, further indicating that the targeted audience was French users on the platform. We categorized the narratives shared by these accounts under four main themes: the war in Ukraine, French elections, French socio-political controversies, and France’s international allies. 

Undermining Support For Ukraine
Historically, the primary goal of the Doppelgänger network was to undermine support for Ukraine in the context of the Russian invasion of February 2022. We assess this remains its core objective. The content shared by the three sets of inauthentic accounts active in this campaign was predominantly related to the war in Ukraine. 
To erode French support for Ukraine, the inauthentic accounts and websites we identified spread narratives saying that Ukraine is losing the war and that Ukrainians do not want to fight. Narratives also mobilized fear of nuclear war and the possibility of French soldiers’ involvement and death in Ukraine. The latter narrative exploits the ambiguity of Emmanuel Macron’s recent declarations suggesting that France might send troops to Ukraine at some point.

Figure 4 – Screenshot showing a meme shared by an inauthentic account saying “Let’s drink to the health of our soldiers who died in Ukraine”. Translation of the text: “Neutrality is key for France. Macron does not seem to understand it”

Multiple posts also denounced the economic consequences of Western sanctions on Russia, including the energy crisis and inflation, while underlining their inefficiency on the Russian economy. Other contents were defamatory against Ukrainian officials, especially targeting Ukrainian President Volodymyr Zelensky. 

Denigrating French President Emmanuel Macron While Promoting Far-Right Party Rassemblement National
The second most commonly employed narrative advocated a change in government. It alleged that Emmanuel Macron did not consider the will of the French people and pointed to his purportedly poor economic and political management. This narrative also heavily criticized his decisions about the Russia-Ukraine conflict. Interestingly, the campaign focused on the person of Emmanuel Macron, likely leveraging its unpopularity. Conversely, the Rassemblement National was presented as a desirable alternative, depicting Marine Le Pen and Jordan Bardella in positive terms.

Figure 5 – Screenshot showing a X post from an inauthentic account. Translation: “Bardella is the only one who supports a real social policy and is concerned about our security.”

Exploiting Socio-political Controversies To Sow Division and Criticize The Ruling Government
This disinformation campaign took advantage of multiple socio-political controversies to sow division in French society. The farmer protests, the end-of-life bill, the labor reform, the immigration question, antisemitism, and the rape of a 12-year-old Jewish girl were leveraged in inauthentic posts and websites spread by the Doppelgänger network.

Figure 6 – Screenshot showing a X post from an inauthentic account. Translation: “The EU must stop this disorganized immigration. It’s a breeding ground for terrorism.”

Figure 7 – Screenshot showing a X post from an inauthentic account. Translation: “Macron’s silence confirms his indifference to the Jews of France.”

Interestingly, some topics, such as dengue fever cases and the closing of the Museum Pompidou Center for renovation, have generated little controversy in legitimate media. The Doppelgänger network closely monitors French news and is ready to exploit any signs of division or mismanagement by national authorities.

Decrying France’s International Partners To Weaken Alliances
Russian disinformation on X spread narratives criticizing NATO enlargement. The campaign also attempted to discrete the G7, picturing it as inefficient. A few posts mentioned the EU and predicted its end. Additionally, multiple posts addressed the US elections, calling for Joe Biden’s withdrawal from the presidential race while presenting Donald Trump as a better alternative for Europe. 

Limited Impact On Electoral Outcome, Fuels Mistrust In Information

Posts from single-use accounts showed thousands of reposts. However, when trying to review them, X does not display any accounts reposting or quoting those posts. This inconsistency is possibly due to the inauthentic nature of these reposts, likely the results of bots’ activity. Digital Forensic Research Lab already pointed to this discrepancy in a previous report. Posts from curated inauthentic accounts show no repost, apart from few exceptions. Their number of views ranges from a few hundred to a thousand. Nevertheless, we could not assess the legitimate nature of these views. Additionally, some X users exposed inauthentic accounts, underlining the lack of credibility of most of these accounts.

Figure 8 – Screenshot showing a X post from an inauthentic account and a reply saying “Russian troll for dummies (newborn version, even he does not believe in it)”

Outlook: Disinformation Campaigns To Continue To Leverage Vulnerabilities In Strategic Periods

The Doppelgänger network will highly likely continue its operations across Western countries. The intensity of its campaign targeting France will likely decrease, pivoting towards other theaters of information warfare. The upcoming US presidential elections will very likely mobilize Russian disinformation efforts in the coming months. Other countries, such as China, will almost certainly engage in FIMI operations through social media manipulation in the context of the US electoral race. Disinformation networks will highly likely use vulnerable narratives, such as rumors, bias, previous defamatory content or controversial political issues, to develop their campaigns.
While X has not embraced the most proactive and transparent approach towards inauthentic accounts, the platform regularly blocks posts and suspends accounts. Nevertheless, we expect motivated and well-funded disinformation actors to continuously create new inauthentic accounts on social media platforms and adapt their TTPs to evade detection in an endless game of cat and mouse. 

Annex 1 – DISARM Framework Mapping the TTPs we observed during our investigation

Research by Alixia Rutayisire, Geopolitical Cyber Threat Intelligence Analyst at QuoIntelligence.

Alixia is an accomplished Geopolitical Analyst with extensive experience in cybersecurity and international relations. Prior to joining QuoIntelligence, she served as a Geopolitical Analyst for West Africa at the Ministère des Armées in France where she was responsible for analyzing geopolitical risks, including political and security situations, as well as internal and international conflicts.