MAI warning, before the elections: the network of cloned sites that mimic institutions and publications / how users cheat.

The Ministry of Internal Affairs (MAI) draws an alarm signal on an influencing campaign of the presidential elections in Romania, carried out through a network of cloned pages that mimic official sites, televisions and publications.

According to the authorities, compared to the previous alert, launched on May 2, when such such attacks were reported for the first time, the campaign is now “in an undisguised way, coming out of the detection threshold under which it was previously.”

The “DopppleGanger” (tr. Susie) network that is behind these actions has evolved, officials say, adapting to the political and social context.

The distributed messages are designed to generate fast emotional reactions, are presented in the form of “explosive disclosures” and are accompanied by suggestive images, some of them generated with the help of artificial intelligence. On sites that look strikingly similar to some devoted ones, thus misleading users.

“The reported network manifests an increased adaptation capacity, including by synchronizing messages with major internal and external events, as well as by using political micro -tarter techniques in sponsored campaigns,” the press release issued by the relevant ministry shows.

According to May, the campaign is carried out on social networks through an extended infrastructure, which includes over 2,000 active pages on Facebook. The administrators of these accounts constantly place, in the comments sections of some viral posts or belonging to the known institutions, links to the cloned pages.

“Direction of users to fake pages is done through malicious advertisements on a series of clickbait sites, whose links are posted in the comment section by the administrators of over 2,000 Facebook pages,” explains the authorities.

Indices related to Russian involvement in misinformation operation

On May 2, two days before the first round of the presidential elections of 2025, the National Authority for Administration and Regulation in Communications (ANCOM) announced that a network of cloned sites has been identified, which imitated the image of the official web pages of public institutions, as well as of publications, including HotNews, with the indication of some companies with the involvement. Russia.

“Links have been identified that redirect users to the aforementioned cloned pages, through malicious advertisements, used as” trampolines “, present on local sites, especially of clickbait type (eg: cezicelumea.ro, sources.eu sticalitative.ro, dromania.ro, edactia.ro, viralnewagazin.ro, lendermagazin.ro, etc.).

ANCOM says that, for example, ADNOW is investigated in several EU states for involvement in operations in favor of Russia's intelligence services.

“The investigations and checks are in progress, following the establishment and unavailability of the entire digital infrastructure that supports the presented ecosystem, respectively identifying and liable for the entities involved. To avoid misleading through the exposed mechanism, it is recommended that the official websites of the public institutions or the media are accessing”

He then stated that the pages were either eliminated or suspended.

Photo: © Flynt | Dreamstime.com