Trace Id is missing

How Russia is trying to disrupt the 2024 Paris Olympic Games

Download
Share
A photo of a building which have a large watch with text PARIS 2024

Introduction

In the summer of 2023, a curious set of videos crept into social media platforms. Telegram feeds that normally promoted pro-Kremlin narratives suddenly began promoting a film called “Olympics Has Fallen.” Users were encouraged to scan a QR code that directed them to a Telegram channel of the same name. Upon arriving at this channel, viewers encountered a feature-length film with a similar aesthetic and a play on the title of the American political action movie “Olympus Has Fallen,” released more than a decade earlier.1 AI-generated audio impersonating the voice of film actor Tom Cruise narrated a strange, meandering script disparaging the International Olympic Committee’s leadership.

Nearly a year later and with less than 80 days until the opening of the 2024 Paris Olympic Games, the Microsoft Threat Analysis Center (MTAC) has observed a network of Russia-affiliated actors pursuing a range of malign influence campaigns against France, French President Emmanuel Marcon, the International Olympic Committee (IOC), and the Paris Games. These campaigns may forewarn coming online threats to this summer’s international competition.

Russia’s long history of disparaging the Olympic Games

Modern Russia, as well as its predecessor the Soviet Union, has a longstanding tradition of seeking to undermine the Olympic Games. If they cannot participate in or win the Games, then they seek to undercut, defame, and degrade the international competition in the minds of participants, spectators, and global audiences. The Soviet Union boycotted the 1984 Summer Games held in Los Angeles and sought to influence other countries to do the same. US State Department officials linked Soviet actors to a campaign that covertly distributed leaflets to Olympic committees in countries including Zimbabwe, Sri Lanka, and South Korea.2 The leaflets claimed non-white competitors would be targeted by US extremists—a claim that follows a tried-and-true active measures strategy: using divisive social issues to sow discord among a target audience.3 A recurring aspect of Russian malign influence is its ability to resurface themes at a later time in a different country. Remarkably, four decades later, we are witnessing similar claims of anticipated extremist violence emerging in the context of the Paris Games this summer. Separately, in 2016, Russian hackers penetrated the World Anti-Doping Agency and revealed private medical information about American athletes Serena Williams, Venus Williams, and Simone Biles.4 Two years later, the “Olympic Destroyer” cyberattack against the 2018 Winter Olympics in Pyeongchang, South Korea, managed to take some of the Winter Games’ internal servers offline. The US Department of Justice charged two Russian GRU officers in connection to the hack in 2020.5

The slow burn of Russian President Vladimir Putin and the Kremlin’s displeasure with the IOC and the ability to participate in the Olympics—an event of longstanding pride to the Russian government—has intensified in recent years. In 2017, the IOC concluded extensive investigations into Russia’s state-sponsored use of performance-enhancing drugs across several Olympic Games in 2017 which resulted in Russia being formally barred from participating in the 2018 Winter Games.6 Last year, in 2023, the IOC confirmed that Russian citizens would be allowed to compete in Paris but only as neutral athletes prohibited from sporting the flag or colors of the Russian Federation.7 Shortly after this decision, MTAC began detecting a range of foreign malign influence operations that continue today, and we suspect may intensify as the 2024 Paris Opening Ceremony approaches.8

Old world tactics meet the age of AI

Starting in June 2023, prolific Russian influence actors—which Microsoft tracks as Storm-1679 and Storm-1099—pivoted their operations to take aim at the 2024 Olympic Games and French President Emmanuel Macron. These ongoing Russian influence operations have two central objectives: to denigrate the reputation of the IOC on the world stage; and to create the expectation of violence breaking out in Paris during the 2024 Summer Olympic Games.

The “Olympics Has Fallen” website and video became the first in many videos MTAC encountered from Storm-1679. The video, which falsely purported to be a Netflix documentary narrated by the familiar voice of American actor Tom Cruise, clearly signalled the content’s creators committed considerable time to the project and demonstrated more skill than most influence campaigns we observe. Further analysis confirmed the fake documentary used AI-generated audio resembling Cruise’s voice to imply his participation, spoofed Netflix’s iconic intro scene and corporate branding, and promoted bogus five-star reviews from reputable media outlets like the New York Times, the Washington Post, and the BBC, all amid slick computer-generated special effects. Social media accounts associated with Storm-1679 promoted the documentary across several platforms, attempting to reach US and European social media users. As previously reported in MTAC’s December 2023 report, Storm-1679 deceived US celebrities into recording short videos on Cameo, a popular website where users can pay for personalized video messages from celebrities, and deceptively edited the videos into anti-Ukrainian propaganda. Among the edits to those Cameo videos included advertisements for Olympics Has Fallen and QR-code links to the Telegram channel where it was hosted, giving the false impression that American celebrities were endorsing and promoting the film.

A visual from the fake documentary "Olympics Has Fallen."
Figure 1: A visual from the fake documentary "Olympics Has Fallen", produced by Russia-affiliated influence actor Storm-1679, which targets the International Olympic Committee and advances pro-Kremlin disinformation. The documentary uses the image and likeness of American actor Tom Cruise, who did not participate in any such documentary.

Videos, fakes, and false flags sow anticipation of violence in Paris

The “Olympics Has Fallen” video signalled the first glimpse of what would prove to be an extensive campaign by Storm-1679. The Paris 2024 Summer Olympic Games has been one of Storm-1679’s primary objectives since at least the summer of 2023, but MTAC has previously observed this actor heavily targeting the Ukrainian refugee community living in the US and Europe. Their principal tactic involves creation of spoofed content that mimics reputable media outlets, particularly in short-form video clips posted on social media.
A graphic representation of a timeline labeled “Campaigns targeting the 2024 Paris Olympics,” divided into two phases. Phase 1 spans from August 2023 to December 2023 and Phase 2 runs from January 2024 to May 2024. There are three campaigns categories listed in the graphic, the first one is called “Denigration of IOC”, the second one is called “Allegations of Mismanagement,” and the third one is called “Expectation of violence”. Each campaign shows various negative news headlines and articles that are present in both phases.

Storm-1679’s Olympics-focused disinformation goes beyond defaming the IOC and seeks to foment public fear to deter spectators from attending the Games. Over the past year, Storm-1679 has consistently produced a collection of deceptive videos, suggesting that legitimate and trusted sources are conveying accurate information regarding expected violence during the Paris Games. In a short video, masquerading as a clip from Brussels-based media outlet Euro News, Storm-1679 falsely claimed that Parisians were buying property insurance in anticipation of terrorism surrounding the Games.9 In another spoofed news clip, this time impersonating French broadcaster France24, Storm-1679 falsely claimed that 24% of purchased tickets for Olympic events had been returned due to similar fears of terrorism.10 In a more explicit attempt to dissuade citizens from attending the Games, Storm-1679 produced fake video press releases posing as the American Central Intelligence Agency (CIA)11 and the French General Directorate for Internal Security (DGSI) warning potential attendees to stay away from the Paris 2024 Olympics due to the alleged risk of a terror attack.12

Prior to spring 2024, Storm-1679 primarily launched disinformation operations in English, only occasionally producing content in French and German, among other European languages. MTAC tracked a notable increase in Storm-1679’s French-language content as the Olympics campaign gained steam, possibly signaling an effort to target the French public more directly or set the scene for alleged unrest in the lead-up to the Games.

Image on the left showing a faked video press release warning the public of possible terror attacks at the 2024 Paris Summer Olympics. The image on the right shows a fabricated France 24 news clip claiming that nearly a quarter of Paris 2024 tickets have been returned due to concerns over terrorism.
Figure 2: A faked video press release warning the public of possible terror attacks at the 2024 Paris Summer Olympics (left). A fabricated France 24 news clip claiming that nearly a quarter of Paris 2024 tickets have been returned due to concerns over terrorism (right). Both forgeries were produced by Russia-affiliated actor Storm-1679.

The most worrisome disinformation advanced by pro-Russian actors has sought to impersonate militant organizations and fabricate threats to the Games amidst the Israel-Hamas conflict. During fall 2023, Storm-1679-linked social media accounts posted images claiming to show graffiti painted in Paris that threatened violence against Israelis attending the 2024 Games. In several of the images, Storm-1679 referenced the attacks at the 1972 Munich Olympics, where members of Black September—an affiliate of the Palestine Liberation Organization—killed 11 members of the Israeli Olympic team and a West German police officer.13 Microsoft did not observe any independent confirmation that the graffiti physically exists, suggesting the images were likely digitally generated. Separately, in November 2023, a Russian-language X (formerly Twitter) account posted a video purportedly produced by the Turkish ultranationalist organization the Grey Wolves, which included imagery from the 1972 Munich Games attacks, hinting at similar attacks at Paris 2024. The video caused significant confusion online in the hours after it was posted, many assuming it to be authentic, and even prompted a response from the Israeli Olympic Committee.14 Microsoft does not presently have enough information to attribute the video to a specific actor, but its heavy amplification by pro-Russian bot accounts suggests the video may be another operation in the broader Olympics campaign.15

A still image from the false-flag terror threat, purportedly from Turkish ultranationalist group the Grey Wolves, whose symbol is visible in the top-right corner of the screen.
Figure 3: A still image from the false-flag terror threat, purportedly from Turkish ultranationalist group the Grey Wolves, whose symbol is visible in the top-right corner of the screen. The video was widely publicized by pro-Russian bot accounts and prompted a response from the Israeli Olympic Committee.

Storm-1679 is not the only Russia-aligned actor with a particular—and growing—interest in undermining the 2024 Paris Games. The Russia-affiliated influence actor Microsoft tracks as Storm-1099—better known as “Doppelganger”—has also increased its anti-Olympics messaging in the past two months. Articles published by the actor’s core disinformation outlet Reliable Recent News (RRN), as well as any of its 15 unique French-language “news” sites, echo claims of rampant corruption within the IOC and warn of potential violence at the Games. Similarly, in Storm-1099’s spoofs of reputable media outlets—pro-Russian clones of legitimate media websites peddling propaganda—forgeries of French outlets Le Parisien and Le Point also raise the specter of violence and castigate Macron’s government. Posts in this network of forgeries criticize Marcon’s showmanship around the Games and emphasize his indifference to the socio-economic hardships faced by French citizens.16

An image of graffiti, reportedly left in Paris, threatening a repeat of the 1972 Munich terror attacks at the upcoming Olympic Games in Paris.
Figure 4: An image of graffiti, reportedly left in Paris, threatening a repeat of the 1972 Munich terror attacks at the upcoming Olympic Games in Paris.
Three screenshots of news websites controlled by prolific Russian influence actor Storm-1099.
Figure 5: Assets controlled by prolific Russian influence actor Storm-1099 considerably increased anti-Olympics messaging in recent months, particularly in the French language.

Protecting the Paris Games: Indicators and warnings of malign influence

In just under three months, after traversing more than 3,000 miles across 450 French towns, the Olympic flame will be lit at the Opening Ceremony and we all might expect Russia to increase the intensity of its influence campaigns seeking to discredit the IOC, incite fear amongst participants and attendees, and sully the image and reputation of the Paris Games. The Kremlin’s propaganda and disinformation machine is unlikely to hold back in leveraging its network of actors to undermine the Games as the Olympics draw near.

We are likely to see renewed efforts to launch influence campaigns messaging in English, German, French, and other languages to maximize visibility and traction online as Russian-affiliated actors aim to reach a broader audience. Actors are likely to use a mix of propaganda facilitated by generative AI across social media platforms to continue their campaigns against France, the IOC, and the Olympic Games.

Traditionally, video has been a powerful tool for Russian influence campaigns. While video will remain the most prolific medium, we are likely to see a tactical shift toward online bots and automated social media accounts as Kremlin-affiliated actors seek to disseminate their messaging more effectively. Bots and other automated services can offer influence actors a wide range of tools that can offer the illusion of widespread support by quickly flooding social media channels. These digital proxies can also offer Russia plausible deniability while exerting its influence. It will be crucial to remain vigilant of online discussions, trending hashtags, and other online activity demonstrating common characteristics of generative AI.

On the ground, Russian actors may look to exploit the focus on stringent security efforts by creating the illusion of protests or real-world provocations. By drawing attention to physical-world events, Russia aims to undermine the confidence in the IOC and French security forces. In-person staging of events—whether real or orchestrated—near or around Olympic venues could be used to manipulate public perceptions and generate a sense of fear and uncertainty.

Microsoft remains committed to protecting the conduct and integrity of the 2024 Summer Olympic Games. MTAC will monitor and report on any campaigns stemming from Kremlin-backed actors in the lead up and opening of the Paris Games. In parallel, Microsoft’s Democracy Forward team recently signed on to the Tech Accords to Combat Deceptive Use of AI in the 2024 Elections—a collaborative effort to protect democratic elections worldwide. MTAC has published several elections reports supporting that effort, most recently in mid-April.

Related articles

Same targets, new playbooks: East Asia threat actors employ unique methods

Microsoft Threat Intelligence has observed several key cyber and influence trends from China and North Korea since June 2023 that demonstrate not only doubling down on familiar targets, but also attempts to use more sophisticated influence techniques to achieve their goals.
Learn more

Navigating cyber threats and strengthening defenses in the era of AI

Advances in artificial intelligence (AI) present new threats—and opportunities—for cybersecurity. Discover how threat actors use AI to conduct more sophisticated attacks, then review the best practices that help protect against traditional and AI-enabled cyberthreats
Learn more

Cyberthreats increasingly target the world’s biggest event stages

Complex and target-rich, major sporting events and world-renown activities present opportunities for threat actors to disrupt travel, commerce, communication and emergency services, and more. Learn how to manage the vast, external attack surface and defend world event infrastructures.
Learn more

Follow Microsoft Security