OpenAI published a case study, originally part of its May 2024 threat report, on four clusters of accounts linked to the Russian influence operation known as Doppelganger. The clusters generated anti-Ukraine comments in five languages for 9GAG and X, translated Russian articles for rrn.media, proofread French articles for franceeteu.today, and wrote German posts for a Facebook group.
The Doppelganger case shows generative models slotted into separate functional teams of an existing operation rather than running the campaign end to end. Each cluster used the models for one narrow job, such as multilingual comments, Russian-to-English translation, French proofreading, or German posts derived from an existing site, while memes, redirect links, and geofenced websites came from elsewhere. OpenAI says one cluster reached its models through a service linked to companies in Russia and the Czech Republic, and it disabled that service's API access.
The case remains a useful reference now because it documents an operator hiding model access behind a third-party service built to bypass country restrictions. Detection that relies on spotting generated text would miss much of this operation, because the distribution layer carried the clearest tells. On X, typical posts had around 1,000 shares with zero replies and zero likes.
The report covers only what one model provider observed and does not measure reach beyond engagement counts on 9GAG and X. Useful follow-up evidence would be platform-side confirmation of the amplification networks and reuse of the same redirect domains.