Russian information operation uses US celebrity Cameos to attack Zelensky
On Aug. 17, Russian news outlet RIA Novosti published a story carrying an urgent message from the American actor John McGinley to Ukrainian President Volodymyr Zelensky.
“Over the last year, booze and drugs have become your best friends, I understand,” the actor, perhaps best known for his role as Dr. Cox on the show “Scrubs,” told Zelensky. “The most important advice I can give you in this matter is that the only way out is kindness.”
The story reported that the actor “called on Zelensky to seek treatment for drug addiction,” and reported that “the Internet” had noticed strange behavior from the Ukrainian president, “often linking this with drug addiction.”
McGinley’s video message, it turns out, was part of an apparent Russian influence operation documented in a Microsoft report released Thursday. It was one of roughly a half dozen such videos in which Western celebrities sent personal messages to “Vladimir” via Cameo, a website where users can pay for personalized messages from celebrities or other prominent people. Other celebrities featured in the campaign included Elijah Wood, Dean Norris, Kate Flannery, Priscilla Presley and Mike Tyson, among others.
Designed to be shared by normal people and covered in news outlets, the videos aimed to spread the idea that Zelensky struggles with drug addiction, a message frequently pushed by pro-Russian sources.
A representative for McGinley did not respond to a request for comment. A representative for Wood told CyberScoop that the “request was submitted through Cameo and was in no way intended to be addressed to Zelensky or have anything at all to do with Russia or Ukraine or the war.”
The operation, which continued through late October, represents one aspect of the Russian government’s ongoing hybrid war against Ukraine. As the war drags on and the physical gains by either side become harder to come by, cyber operations will continue to play a major role, Clint Watts, the general manager of Microsoft’s Threat Analysis Center, wrote in a new report detailing such campaigns that the company has observed between March and October 2023.
“Kyiv will require a steady supply of weapons and popular support to continue resistance, and we are likely to see Russian cyber and influence operators intensify efforts to demoralize the Ukrainian population and degrade Kyiv’s external sources of military and financial assistance,” Watts wrote.
Microsoft’s report also details a seasonal pivot of Russian kinetic and cyber attacks to target Ukraine’s agriculture industry, cyberespionage aimed at war crimes investigations, governmental bodies and think tanks and continued intelligence collection from Russian military and foreign intelligence cyber units.
More recently, Russian-aligned efforts have pushed anti-Ukrainian messaging in the context of fighting between Israel and Hamas, a shift that illustrates the ability of pro-Russian information operations to seize on global events to spread their preferred narratives.
For instance, Microsoft noted, a Russian-aligned information operation tracked as Storm-1099 pushed the false claim that Hamas acquired Ukrainian weapons on the black market for its Oct. 7 attack on Israel. Another set of actions pushed claims that foreign recruits fighting in Ukraine, including Americans, were transferred from Ukraine to join the Israeli Defense Forces in Gaza.
A key aspect of Storm-1099 activity, tracked more widely as “Doppelganger,” includes both spoofed news websites and original phony news sites used to push various pro-Russian narratives. Recent reporting from Recorded Future revealed the operation using generative artificial intelligence to create news stories that, so far, are receiving very little organic engagement. Researchers at Meta have also closely tracked Doppelganger activities across its platforms, including Facebook and Instagram, and have separately said that the phony material is failing to reach a broad audience.
Doppelganger has primarily targeted Germany and Western Europe more broadly, Watts wrote, but the expansion of targeting and themes over the course of 2023, to include Israel and the U.S. more recently, suggests the group and other pro-Russian information operations will target the 2024 elections.
“Outside of Ukraine, the U.S. presidential election, and other major political contests in 2024 may afford malign influence actors an opportunity to put their video media and nascent AI skills to use to turn the political tide away from elected officials who champion support to Ukraine,” Watts wrote.
