Russia has been actively participating in a disinformation campaign, seeking to divide sentiment against Russia within the European Union and North America. This has been carried out by a spear-phishing group known as TA499, which is specifically targeting US and European politicians, prominent business leaders, and public figures who have voiced opposition to Putin’s invasion. The main objective is to undermine any previous statements against the Kremlin by engaging the targets in video or phone conversations in which pro-Putin remarks can be extracted.
TA499 appears to be a two-person group publicly known as Vovan and Lexus, and their operations are sophisticated, complex and not financially motivated, although the extent of their connection to the Russian government is unknown. The threat group has made contact with their targets both before and after the Ukraine invasion, typically posing as the Ukrainian Prime Minister Denys Shmyhal or his supposed assistant, or as Leonid Volkov, Alexei Navalny’s chief of staff.
The purpose of such contact is to cajole the target into joining a video or telephone call, and when successful, the group engages in conversation with the aim of obtaining pro-Kremlin comments. It is believed that TA499 has not yet used deepfake technology in their attacks, instead relying on an actor to impersonate their targets, although it is likely that they will at some point in the future as the technology develops.
TA499 has already targeted the mayor of Vienna Michael Ludwig, as well as other mayors in Warsaw, Budapest, Berlin, and Madrid. Celebrities JK Rowling and Elton John have also been targeted in the past. TA499’s activities are likely to continue in the near future, as the war between Russia and Ukraine is unlikely to end soon and Ukraine continues to gain support from organisations worldwide.
Key Points
- Russia is using a threat group known as TA499 to engage in a campaign of disinformation, targeting US and European politicians, and leading businessmen and celebrities who have spoken out against Putin’s invasion.
- The primary aim of TA499 is to persuade the victims to take part in phone calls or video chats from which pro-Putin snippets can be elicited and published, thereby discrediting any previous anti-Putin comments.
- TA499 appears to be a two-person group of operators publicly known as Vovan and Lexus and is likely patriotically motivated and aligned with the Russian state.
- TA499 has targeted the mayor of Vienna Michael Ludwig, as well as other mayors in Warsaw, Budapest, Berlin, and Madrid, as well as celebrities JK Rowling and Elton John.
- It is believed that TA499 has not yet used deepfake technology in their attacks, instead relying on an actor to impersonate their targets, although it is likely that they will at some point in the future as the technology develops.