Russia tricked US actors into contributing to propaganda efforts

Why would US actors promote pro-Russian propaganda on social media? They’ve been duped, and then clips were forged, a report by Microsoft reveals.

Since July 2023, videos on social media have circulated featuring famous personalities citing Russian propaganda. The videos featured musician Shavo Odadjian, actors Priscilla Presley, Elijah Wood, Dean Norris, Kate Flannery, and John McGinley.

“Unwitting American actors and others appear to have been asked, likely via video message platforms such as Cameo, to send a message to someone called “Vladimir,” pleading with him to seek help for substance abuse,” the Microsoft Threat Analysis Center (MTAC) noted.

Then, the videos were modified to be aimed at Ukrainian President Volodymyr Zelensky with emojis, links, and logos of propaganda media outlets. Fake videos circulated on social media channels advancing Russian propaganda claims that the Ukrainian leader struggles with substance abuse.

Platforms such as Cameo allow any buyer to book a personal video from a beloved celebrity for a few hundred bucks or lower.


Microsoft believes that unknown Russia-aligned influence actors tricked celebrities into providing video messages that were then used in pro-Russian propaganda.

The first video in this campaign displayed Ukrainian flag emojis, watermarks from American media outlet TMZ, and links to both a substance abuse recovery center and one of President Zelensky’s official social media pages.

Since the summer, pro-Russian social media channels have circulated at least six more videos. Those videos were also featured in Russian news outlets as if they were authentic. To appear reputable, fabricated clips featured logos from the largest news outlets.

Russia-affiliated propaganda networks have focused on using video as a dynamic medium to spread various messages. MTAC observed two ongoing campaigns.

While the first was trying to paint Zelensky as a corrupt drug addict, the other tried to convince social media users that Western support for Kyiv is detrimental to their countries‘ domestic populations.

“The content in both campaigns consistently seeks to diminish support for Ukraine but adapts narratives to align with emerging news events – like the June 2023 Titan submersible implosion or the Israel-Hamas war to reach wider audiences,” the report reads.

The first observed instance of such forged video circulation was in April 2022, when pro-Russian Telegram channels posted a fake BBC news video claiming the Ukrainian military was responsible for a missile strike that killed civilians. The clip contained errors that are common when translating from Russian to English. Telegram channels amplified similar videos before they spread to mainstream social media.

Russia's cyber operations exploit war weariness

According to Microsoft, Russian cyber and influence operators have demonstrated adaptability throughout the war in Ukraine. Threat actions try to demoralize the Ukrainian public, direct concentrated attacks against the country’s agriculture sector, and lean into cyberespionage operations against the Ukrainian military and its foreign supply lines.

After the death of Russian businessman Yevgeny Prigozhin in August 2023, who owned the Wagner Group and the infamous Internet Research Agency troll farm, Russia maintained its influence and propaganda capabilities.

“Microsoft has observed widespread influence operations by Russian actors that are not linked to Prigozhin, indicating that Russia has the capacity to continue prolific and sophisticated malign influence operations without him,” the report reads.

Russia shifted its anti-Ukraine messaging to the US and Israel, using threat actor Storm-1099, responsible for the mass-scale website forgery operation “Doppelganger” and attacks against Ukraine’s supporters.

“The group creates unique, branded outlets such as the Reliable News Network (RNN) and stokes on-the-ground demonstrations, bridging the digital and physical worlds through amplification of these events,” researchers said. “Storm-1099 assets pushed the false claim that Hamas acquired Ukrainian weapons on the black market for its October 7th attack on Israel.”

Researchers alert that cyber and influence operations remain an urgent threat to the security of computer networks and civic life within Ukraine's allies in the region, NATO, and globally.

“Russian cyber and influence operators will aim to demoralize the Ukrainian population and degrade Kyiv’s external sources of military and financial assistance, along with possible winter attacks on Ukraine’s energy sector,” Microsoft warns.

US presidential elections and other major political events will be used as opportunities for malign actors to degrade support for pro-Ukraine political candidates.

More from Cybernews:

Android barcode scanner app exposes user passwords

Trafficking for cyber fraud is globalising – Interpol

Carpet cleaning giant admits data breach

23andMe scrambles to update user terms of use to avoid lawsuits

Cybersecurity downsizing: 47% of organizations planning to reduce teams

Subscribe to our newsletter

Leave a Reply

Your email address will not be published. Required fields are markedmarked