Cyber Incident Victim: Russian Federation

On or around June 4, 2023, a fabricated audio and video address featuring the voice and likeness of Russian President Vladimir Putin was broadcast on radio and television stations in three Russian regions bordering Ukraine: Belgorod, Rostov, and Voronezh. In the simulated address, the figure purported to be Putin announced that Ukrainian forces had invaded Russian territory. The deepfake message declared martial law, promised a general mobilization of the country, and urged local residents to evacuate further into Russia. The broadcast represented a significant incident of disinformation targeting the Russian population in these specific border areas.

Russian authorities swiftly moved to label the broadcast as a hoax. Dmitry Peskov, President Putin’s press secretary, confirmed the incident was the result of a hack. He stated to the state-owned news agency TASS, “There was definitely no [appeal],” and specifically identified a hack targeting “Mir radio.” Peskov assured the public that the situation was back under control and that relevant technical services were addressing the issue. In a subsequent statement reported by the state-owned news agency RIA, Peskov emphasized, “All of these messages are an utter fake.” The administrative center for the Belgorod region provided a further technical assessment, characterizing the message as a “deepfake,” implying the use of artificial intelligence to generate the convincing counterfeit of Putin’s appearance and voice. The nature of the hack, whether it involved compromising broadcast infrastructure directly or feeding a pre-recorded file into the systems, was not detailed by the officials.

The incident coincided with a period of intense military activity along the Russia-Ukraine border, which was widely reported as the beginning of Ukraine’s anticipated counteroffensive against Russian forces. On June 5, the day after the deepfake broadcast, Moscow claimed its forces had defeated a major Ukrainian attack in the Donetsk region, an assertion that Kyiv immediately denied. Concurrently, the Belgorod region, one of the areas affected by the hack, was experiencing shelling from Ukrainian forces. This military activity followed claims by anti-Putin Russian militias that they had liberated a city within the Belgorod region, adding to the overall climate of instability and confusion in the area. The timing of the deceptive broadcast, therefore, intersected with genuine kinetic military operations and partisan actions, potentially amplifying its disruptive impact on the local population.

The Ukrainian government’s public communications strategy during this period was characterized by an official policy of silence regarding its military operations. On June 4, the same day as the deepfake incident, Ukraine’s Ministry of Defense released a promotional video featuring Ukrainian soldiers placing a finger to their lips in a gesture calling for silence. The ad explicitly stated, “There will be no announcement about the start,” directly referring to the counteroffensive. Ukraine’s Minister of Defense, Oleksii Reznikov, shared the video on Twitter, quoting lyrics from the Depeche Mode song “Enjoy the Silence”: “Words are very unnecessary. They can only do harm.” This official stance of refusing to confirm or deny the offensive’s status stood in stark contrast to the detailed claims being made by Russian sources and created an information environment where a disruptive event like the fake Putin address could generate significant uncertainty.

The primary impact of the incident was the dissemination of a false official declaration of martial law and a call for evacuation to civilians in a active conflict zone. The broadcast had the potential to cause panic, trigger civilian evacuations, and disrupt military and civilian logistics in the three affected regions during a period of actual combat operations. The Russian state’s response was focused entirely on containment through public denial and attribution to a cyber attack. The authorities did not provide any technical details regarding the attack vector, the perpetrators, or the specific steps taken to secure the broadcast systems beyond stating that control had been reestablished. The declaration that the message was a deepfake served to technically discredit the content and reassure the public that it was not a genuine order from the national leadership. The broader consequences of the hack remain unclear, including the extent to which the local population believed the message or acted upon it, as reports did not detail any public reaction or resulting civil unrest. The incident stands as a notable example of a hybrid operation combining cyber tactics with psychological warfare, leveraging fabricated media to sow disinformation during a critical moment in an ongoing armed conflict.