Russian information operation uses US celebrity Cameos to attack Zelensky

Kremlin propagandists tricked a half dozen celebrities into recording videos urging Ukraine's president to seek treatment for substance abuse.

On Aug. 17, Russian news outlet RIA Novosti published a story carrying an urgent message from the American actor John McGinley to Ukrainian President Volodymyr Zelensky.

“Over the last year, booze and drugs have become your best friends, I understand,” the actor, perhaps best known for his role as Dr. Cox on the show “Scrubs,” told Zelensky. “The most important advice I can give you in this matter is that the only way out is kindness.”

The story reported that the actor “called on Zelensky to seek treatment for drug addiction,” and reported that “the Internet” had noticed strange behavior from the Ukrainian president, “often linking this with drug addiction.”

McGinley’s video message, it turns out, was part of an apparent Russian influence operation documented in a Microsoft report released Thursday. It was one of roughly a half dozen such videos in which Western celebrities sent personal messages to “Vladimir” via Cameo, a website where users can pay for personalized messages from celebrities or other prominent people. Other celebrities featured in the campaign included Elijah Wood, Dean Norris, Kate Flannery, Priscilla Presley and Mike Tyson, among others.

Designed to be shared by normal people and covered in news outlets, the videos aimed to spread the idea that Zelensky struggles with drug addiction, a message frequently pushed by pro-Russian sources.

A representative for McGinley did not respond to a request for comment. A representative for Wood told CyberScoop that the “request was submitted through Cameo and was in no way intended to be addressed to Zelensky or have anything at all to do with Russia or Ukraine or the war.”

The operation, which continued through late October, represents one aspect of the Russian government’s ongoing hybrid war against Ukraine. As the war drags on and the physical gains by either side become harder to come by, cyber operations will continue to play a major role, Clint Watts, the general manager of Microsoft’s Threat Analysis Center, wrote in a new report detailing such campaigns that the company has observed between March and October 2023.

“Kyiv will require a steady supply of weapons and popular support to continue resistance, and we are likely to see Russian cyber and influence operators intensify efforts to demoralize the Ukrainian population and degrade Kyiv’s external sources of military and financial assistance,” Watts wrote.

Microsoft’s report also details a seasonal pivot of Russian kinetic and cyber attacks to target Ukraine’s agriculture industry, cyberespionage aimed at war crimes investigations, governmental bodies and think tanks and continued intelligence collection from Russian military and foreign intelligence cyber units.

More recently, Russian-aligned efforts have pushed anti-Ukrainian messaging in the context of fighting between Israel and Hamas, a shift that illustrates the ability of pro-Russian information operations to seize on global events to spread their preferred narratives.

For instance, Microsoft noted, a Russian-aligned information operation tracked as Storm-1099 pushed the false claim that Hamas acquired Ukrainian weapons on the black market for its Oct. 7 attack on Israel. Another set of actions pushed claims that foreign recruits fighting in Ukraine, including Americans, were transferred from Ukraine to join the Israeli Defense Forces in Gaza.

A key aspect of Storm-1099 activity, tracked more widely as “Doppelganger,” includes both spoofed news websites and original phony news sites used to push various pro-Russian narratives. Recent reporting from Recorded Future revealed the operation using generative artificial intelligence to create news stories that, so far, are receiving very little organic engagement. Researchers at Meta have also closely tracked Doppelganger activities across its platforms, including Facebook and Instagram, and have separately said that the phony material is failing to reach a broad audience.

Doppelganger has primarily targeted Germany and Western Europe more broadly, Watts wrote, but the expansion of targeting and themes over the course of 2023, to include Israel and the U.S. more recently, suggests the group and other pro-Russian information operations will target the 2024 elections.

“Outside of Ukraine, the U.S. presidential election, and other major political contests in 2024 may afford malign influence actors an opportunity to put their video media and nascent AI skills to use to turn the political tide away from elected officials who champion support to Ukraine,” Watts wrote.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure