Ruza Flood — APT Profile
Ruza Flood is a Russian influence operation group that combines hacking with disinformation campaigns targeting Western media and government.Also tracked as
DoppelGänger, Doppelganger, Social Design Agency, Structura National Technologies, RRN, Reliable Recent News
IntelFusions coverage (1)
- The Agentic AI Insider Threat: Palo Alto Networks Warns Autonomous Agents Outnumber Human Employees 82-to-1 2026-02-16 · AI Security
Tools & malware
- Keitaro Traffic Distribution System Traffic distribution / campaign-tracking software (repurposed ad tracker)
- Multi-stage redirection infrastructure (ggspace[.]space, sdgqaef[.]site, greatroomservice[.]info) Redirection infrastructure
- telegra.ph Metadata / thumbnail hosting
- Traefik reverse proxy HTTP reverse proxy / load balancer
- Typosquatted / cloned media domains Spoofing infrastructure
Vendor research
- Doppelgänger | Russia-Aligned Influence Operation Targets Germany SentinelOne (SentinelLabs)
- Master of Puppets: Uncovering the DoppelGänger pro-Russian influence campaign Sekoia.io
- Russia-linked operators engaged in expansive efforts to influence US voters Microsoft (Security Insider / Microsoft Threat Analysis Center)
- Securing US elections from nation-state adversaries Microsoft (On the Issues, Brad Smith)