02.05.2025

Following the notifications received and the investigation carried out in cooperation by several state institutions with attributions in the field, ANCOM is mandated to communicate the following:

A network of cloned websites was identified, that imitate the exact appearance of the official websites of public institutions, televisions and important press agencies (Romanian Government, Ministry of Health, TVR1, DIGI24, Hotnews, Adevărul, Libertatea), used to promote deceptive content on social, political, economic and health topics aiming to mislead the population and to negatively influence public perception.

This campaign is a complex one, being carried out below the anomaly detection threshold, employing specifics tactics, such as exploitation of social media algorithms, the use of AI generated content, the constitution of subliminal narratives, the use of advertisements adapted to the specificity of vulnerable audiences, as well as cross-sectoral activities to activate reactions in society.

The same information structure is used for micro-profiling activities allowing the definition of audiences that are vulnerable to disinformation narratives and the tailoring messages considering the emotional niches.

These influence activities are not intended to promote specific entities but to amplify the social, economical and political dissatisfaction within the collective mindset. The goal is to polarize the society and erode the public trust in public authorities, thereby limiting the state’s capacity to respond and influencing national decision-making processes.

Thus, the emergence of networks of inauthentic pages and accounts on a social media platform with a coordinated level of posts and content designed to artificially generate high level of interaction was observed. These pages systematically share AI-generated content (text and images), focusing on emotional impactful topics to generate reactions from real users.

Within this ecosystem, links redirecting users to the cloned pages mentioned above via malicious ads acting as ”trampolines“, present on local websites, especially clickbait websites (ex: cezicelumea.ro, surse.eu, stiricalitative.ro, dromania.ro, redactia.ro, viralnews.ro, lendermagazin.ro etc.) have been identified.

Malicious ads are presented as fake news headlines, the advertising spaces in which they are posted being contracted by advertising companies using ”native ads” – Adskeeper, Geozo, Adnow and MGID, previously flagged in the public space for direct links with Russian Federation. For example, Adnow company is subject to extensive investigations in other member states, but also in Romania for its involvement in information operations in favour of the intelligence services of the Russian Federation.

Additionally, the cloned websites feature ads in both Romanian and another foreign language that promote similar misleading content, funded via fictitious social media pages/accounts. The entire infrastructure is supported through the pages in question, which distribute the above-mentioned AI-generated content.

We specify that the responsible public authorities act in a coordinated manner to counter these malicious influence actions and to limit their effects in the population, in partnership with the internet service providers and the social media platform in question.

Investigations and verifications are ongoing, aiming to locate and disable the entire digital infrastructure sustaining the ecosystem presented, respectively to identify and hold accountable the entities involved.

To avoid being misled by the exposed mechanism, it is recommended that the official websites of the public institutions or media entities concerned be accessed directly.

A graphic representation of the Doppelganger network and its exploitation mechanism in influence operations is available, in Romanian, in the attachment.