{ "id": "042e705f-ee11-48fc-9b1b-c955bd1d0f3b", "created_at": "2026-04-06T00:06:34.510729Z", "updated_at": "2026-04-10T03:35:36.685631Z", "deleted_at": null, "sha1_hash": "87016fa58d0f6a7341bdb53987d4a6c5822a7fb9", "title": "How Russia is trying to disrupt the 2024 Paris Olympic Games - Microsoft On the Issues", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 583265, "plain_text": "How Russia is trying to disrupt the 2024 Paris Olympic Games -\r\nMicrosoft On the Issues\r\nBy Clint Watts\r\nPublished: 2024-06-03 · Archived: 2026-04-05 13:07:22 UTC\r\nRussia is ramping up malign disinformation campaigns against France, French President Emmanuel Macron, the\r\nInternational Olympic Committee (IOC), and this summer’s Olympic Games in Paris. While Russia has a decades-long history of targeting the Olympic Games, the Microsoft Threat Analysis Center (MTAC) has observed old\r\ntactics blending with artificial intelligence (AI) in malign activity that may intensify as the 2024 Paris Opening\r\nCeremony approaches. These operations have two principal aims:\r\nDenigrate the reputation of the IOC\r\nCreate the expectation of violence breaking out in Paris at the Games\r\nSeveral prolific Russian influence actors, which Microsoft tracks as Storm-1679 and Storm-1099, have pivoted\r\ntheir operations since June 2023 to focus on the Olympics. These insights are detailed in a special Microsoft\r\nThreat Intelligence report published today: “Russian Influence Efforts Converge on 2024 Paris Olympic Games.”\r\nOlympics Has Fallen\r\nhttps://blogs.microsoft.com/on-the-issues/2024/06/02/russia-cyber-bots-disinformation-2024-paris-olympics/\r\nPage 1 of 5\n\nOlympics-focused activity kicked off in June 2023, when Storm-1679 released on Telegram and then spread\r\nonline a feature-length film called “Olympics Has Fallen”, mimicking the 2013 American political action thriller\r\n“Olympus Has Fallen”. Using a fake AI-generated audio impersonating the actor Tom Cruise to imply his\r\nparticipation, the film disparaged the IOC leadership. The use of slick computer-generated special effects and a\r\nbroad marketing campaign, including faked endorsements from Western media outlets and celebrities, indicates a\r\nsignificant increase in skill and effort compared to most Influence Operations (IO) campaigns.\r\nFigure 1: A visual from the fake documentary “Olympics Has Fallen”, produced by Russia-affiliated\r\ninfluence actor Storm-1679, which targets the International Olympic Committee and advances pro-Kremlin disinformation. The documentary uses the image and likeness of American actor Tom\r\nCruise, who did not participate in any such documentary.\r\nSpreading fear of violence\r\nStorm-1679’s goals are not limited to defaming the IOC. It also seeks to spread public fear to deter spectators\r\nfrom attending the Games. Over the past year, it has consistently produced a collection of deceptive videos on the\r\nexpectation of violence at the Games. Examples include:\r\nA video purporting to be from Brussels-based media outlet Euro News, claimed Parisians were buying\r\nproperty insurance in anticipation of terrorism at the Games.\r\nA fake video pretending to come from French broadcaster France24 claimed that 24% of tickets for the\r\ngames had been returned due to fears of terrorism.\r\nFake video press releases were produced posing as coming from the American Central Intelligence Agency\r\n(CIA) and the French General Directorate for Internal Security (DGSI) warning potential attendees to stay\r\naway from the Paris 2024 Olympics due to the alleged risk of a terror attack.\r\nhttps://blogs.microsoft.com/on-the-issues/2024/06/02/russia-cyber-bots-disinformation-2024-paris-olympics/\r\nPage 2 of 5\n\nFigure 2: A faked video press release warning the public of possible terror attacks at the 2024\r\nParis Summer Olympics (left). A fabricated France 24 news clip claiming that nearly a\r\nquarter of Paris 2024 tickets have been returned due to concerns over terrorism (right). Both\r\nforgeries were produced by Russia-affiliated actor Storm-1679.\r\nStorm-1679 has also sought to use the Israel-Hamas conflict to fabricate threats to the Games. In\r\nNovember 2023, it posted images claiming to show graffiti in Paris threatening violence against Israeli\r\ncitizens attending the Games. Microsoft assesses this graffiti was digitally generated and unlikely to exist\r\nat a physical location.\r\nOther images and videos referenced the 1972 Munich Olympics where members of Black September, a\r\nmilitant organization, killed 11 members of the Israeli Olympic team and a West German police officer.\r\nMicrosoft does not presently have enough information to attribute the video to a specific actor, but its\r\nheavy amplification by pro-Russian bot accounts suggests the video may be another operation in the\r\nbroader Olympics campaign.\r\nFigure 3: An image of graffiti, reportedly left in Paris, threatening a repeat of the 1972 Munich\r\nterror attacks at the upcoming Olympic Games in Paris (left). A still image from the false-flag terror\r\nthreat, purportedly from Turkish ultranationalist group the Grey Wolves, whose symbol is visible in\r\nhttps://blogs.microsoft.com/on-the-issues/2024/06/02/russia-cyber-bots-disinformation-2024-paris-olympics/\r\nPage 3 of 5\n\nthe top-right corner of the screen. The video was widely publicized by pro-Russian bot accounts and\r\nprompted a response from the Israeli Olympic Committee (right).\r\nOther Russian threat actors are joining the fray\r\nStorm-1679 is not the only Russia-aligned actor seeking to undermine the 2024 Games. The Russia-affiliated actor\r\nthat Microsoft tracks as Storm-1099, better known as “Doppelganger,” has ramped up its anti-Olympics\r\nmessaging in the past two months. Using its array of 15 unique French language “news” sites, including its core\r\ndisinformation outlet Reliable Recent News (RRN), it makes claims of rampant IOC corruption and warns of\r\npotential violence at the Games. The actor also makes forgeries of French outlets Le Parisien and Le Point to echo\r\nsuch claims and castigate Macron and his government, his supposed showmanship around the Games and his\r\nindifference to the hardships faced by French citizens.\r\nFig 4: A selection of Storm-1099’s anti-Olympics messaging, including from its core disinformation\r\noutlet Reliable Recent News (RRN).\r\nLooking forward\r\nWith the Olympic Games opening ceremony less than three months away on July 26th, MTAC expects Russian\r\nOlympics-focused malign activity to intensify. Predominantly French-language activities will likely expand to\r\nEnglish, German, and other languages to maximize visibility and traction online and the use of generative AI will\r\nalso likely increase. While video has traditionally been a powerful tool for Russian IO campaigns and will remain\r\nso, we are likely to see a tactical shift towards online bots and automated social media accounts. These can offer\r\nthe illusion of widespread support by quickly flooding social media channels and give the Russians a level of\r\nplausible deniability.\r\nOn the ground, Russian actors may look to exploit the focus on stringent security by creating the illusions of\r\nprotests or real-world provocations, thus undermining confidence in the IOC and French security forces. In-person\r\nstaging of events – whether real or orchestrated –near or around Olympic venues could be used to manipulate\r\npublic perceptions and generate a sense of fear and uncertainty.\r\nhttps://blogs.microsoft.com/on-the-issues/2024/06/02/russia-cyber-bots-disinformation-2024-paris-olympics/\r\nPage 4 of 5\n\nMicrosoft remains committed to protecting the conduct and integrity of the 2024 Summer Olympic Games.\r\nMTAC will monitor and report on any campaigns stemming from Kremlin-backed actors in the lead up to and\r\nopening of the Paris Games.\r\nTags: cyber influence, influence operations, Microsoft Threat Analysis Center, MTAC, Russia\r\nSource: https://blogs.microsoft.com/on-the-issues/2024/06/02/russia-cyber-bots-disinformation-2024-paris-olympics/\r\nhttps://blogs.microsoft.com/on-the-issues/2024/06/02/russia-cyber-bots-disinformation-2024-paris-olympics/\r\nPage 5 of 5", "extraction_quality": 1, "language": "EN", "sources": [ "Malpedia", "MISPGALAXY" ], "references": [ "https://blogs.microsoft.com/on-the-issues/2024/06/02/russia-cyber-bots-disinformation-2024-paris-olympics/" ], "report_names": [ "russia-cyber-bots-disinformation-2024-paris-olympics" ], "threat_actors": [ { "id": "c91e335e-42be-48d9-96b5-ba56749a723b", "created_at": "2022-10-25T16:07:23.458346Z", "updated_at": "2026-04-10T02:00:04.616481Z", "deleted_at": null, "main_name": "CIA", "aliases": [ "Central Intelligence Agency" ], "source_name": "ETDA:CIA", "tools": [], "source_id": "ETDA", "reports": null }, { "id": "cb28ca1d-a3c8-4edf-9c2e-015ac6539708", "created_at": "2024-02-02T02:00:04.070404Z", "updated_at": "2026-04-10T02:00:03.549765Z", "deleted_at": null, "main_name": "Storm-1099", "aliases": [], "source_name": "MISPGALAXY:Storm-1099", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "29766ed4-2a41-49b1-b6f9-7b3a918db21f", "created_at": "2024-09-20T02:00:04.589212Z", "updated_at": "2026-04-10T02:00:03.702787Z", "deleted_at": null, "main_name": "Storm-1679", "aliases": [], "source_name": "MISPGALAXY:Storm-1679", "tools": [], "source_id": "MISPGALAXY", "reports": null } ], "ts_created_at": 1775433994, "ts_updated_at": 1775792136, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/87016fa58d0f6a7341bdb53987d4a6c5822a7fb9.pdf", "text": "https://archive.orkl.eu/87016fa58d0f6a7341bdb53987d4a6c5822a7fb9.txt", "img": "https://archive.orkl.eu/87016fa58d0f6a7341bdb53987d4a6c5822a7fb9.jpg" } }