Russia has been actively engaging in a campaign of disinformation, attempting to fracture anti-Russian sentiment within the European Union and North America, with a spear-phishing group tracked as TA499 targeting US and European politicians, leading businessmen, and celebrities who have spoken out against Putin’s invasion. The primary aim is to discredit any prior anti-Kremlin statements by engaging the targets in video calls or phone conversations in which pro-Putin snippets can be gleaned.
TA499 appears to be a two-person group publicly known as Vovan and Lexus, and their operations are sophisticated, complex and not financially motivated, although the extent of their connection to the Russian government is unknown. The threat group has made contact with their targets both before and after the Ukraine invasion, typically posing as the Ukrainian Prime Minister Denys Shmyhal or his supposed assistant, or as Leonid Volkov, Alexei Navalny’s chief of staff.
The purpose of such contact is to cajole the target into joining a video or telephone call, and when successful, the group engages in conversation with the aim of obtaining pro-Kremlin comments. It is believed that TA499 has not yet used deepfake technology in their attacks, instead relying on an actor to impersonate their targets, although it is likely that they will at some point in the future as the technology develops.
TA499 has already targeted the mayor of Vienna Michael Ludwig, as well as other mayors in Warsaw, Budapest, Berlin, and Madrid. Celebrities JK Rowling and Elton John have also been targeted in the past. TA499’s activities are likely to continue in the near future, as the war between Russia and Ukraine is unlikely to end soon and Ukraine continues to gain support from organisations worldwide.
Key Points
- Russia is using a threat group known as TA499 to engage in a campaign of disinformation, targeting US and European politicians, and leading businessmen and celebrities who have spoken out against Putin’s invasion.
- The primary aim of TA499 is to persuade the victims to take part in phone calls or video chats from which pro-Putin snippets can be elicited and published, thereby discrediting any previous anti-Putin comments.
- TA499 appears to be a two-person group of operators publicly known as Vovan and Lexus and is likely patriotically motivated and aligned with the Russian state.
- TA499 has targeted the mayor of Vienna Michael Ludwig, as well as other mayors in Warsaw, Budapest, Berlin, and Madrid, as well as celebrities JK Rowling and Elton John.
- It is believed that TA499 has not yet used deepfake technology in their attacks, instead relying on an actor to impersonate their targets, although it is likely that they will at some point in the future as the technology develops.
