State TV Broadcast a Fabricated Confession to Blame Ukraine for the Crocus City Hall Massacre
What happened
In March 2024, gunmen attacked Crocus City Hall, a popular concert venue on the outskirts of Moscow, killing more than 100 people. ISIS Khorasan claimed responsibility. Within hours, Russian state television broadcaster NTV aired something designed to reframe that answer: a video appearing to show Ukrainian officials, including top security advisor Oleksiy Danilov, admitting on camera that Ukraine had planned and carried out the attack.
The video was a deepfake. According to BBC Verify reporter Shayan Sardarizadeh, NTV had assembled AI-generated audio by splicing together voice synthesis built from recent legitimate interviews with Danilov and a second Ukrainian official. The result was footage that looked and sounded like an interview but had never taken place. Danilov made no such statement. The fabrication was constructed to carry the surface qualities of real testimony: the subject's face, voice, and phrasing, in a format audiences recognize as credible.
Splicing AI-generated audio from real source material is more difficult to detect than wholly synthetic content. The underlying voice model draws on an authentic speaker, so the cadence and timbre are consistent with how that person actually sounds. What is fabricated is the statement itself. In a news cycle already saturated with conflicting claims about a mass casualty event, that distinction collapses. The fabrication does not need to convince forensic analysts. It needs only to circulate long enough to shape the initial narrative.
The incident did not stand alone. Putin separately appeared on television to accuse Ukraine of orchestrating the attack, a claim that aligned with the deepfake's message even as ISIS's claim circulated in parallel. The broader pattern in the conflict's information environment includes a deepfake of President Zelenskyy appearing to order Ukrainian troops to surrender and fabricated footage attributed to Ukrainian soldiers. The tactic is consistent: produce believable video of a known figure making a consequential statement, then release it at the moment of maximum audience attention.
What the pattern exposes is a structural gap in how video evidence is authenticated in real time. Any video can now be assembled to show a named official saying something they did not say, with no marker distinguishing it from authentic footage. Without a provable record of what a system generated, when it generated it, and under whose direction, the burden of proof falls entirely on the audience. In a crisis, that burden is never resolved before the damage is done.
Reported impact
- Affected parties
- Not publicly disclosed
- Harm type
- Not publicly disclosed
- Scale
- Not publicly disclosed
- Financial impact
- Not publicly disclosed
- Regulatory action
- Not publicly disclosed
Classification
Relevant governance controls
Governance control mapping is not available for this record.
- No controls mapped
Not publicly disclosed
Control mapping is analytical. It does not state that any control would have prevented the incident.
Sources and evidence
This record was researched and written by the Index. The event is also catalogued in the following database, which is listed for cross-reference.