Still throwing toys out the pram over its relationship with international sport, Russia is engaged in a multi-pronged disinformation campaign against the Olympic Games and host nation France that's intensifying as the opening ceremony approaches.

Microsoft said on Sunday that it's tracking a number of Russia-affiliated cyber groups working to undermine trust in the Games through a variety of means - everything from fake news articles inciting fears of terrorism to Tom Cruise deepfakes.

The Top Gun star's likeness is used in a fake Netflix documentary the Russians have called "Olympics Has Fallen" - no prizes for guessing which movie that was named after.

Microsoft said: "Further analysis confirmed the fake documentary used AI-generated audio resembling Cruise's voice to imply his participation, spoofed Netflix's iconic intro scene and corporate branding, and promoted bogus five-star reviews from reputable media outlets like the New York Times, the Washington Post, and the BBC, all amid slick computer-generated special effects."

It's the work of the group Microsoft tracks as Storm-1679, which may be remembered from December when Russia was paying celebrities to record Cameo videos supporting "Vladimir" in his fight against substance abuse. The videos were later used in an attempt to discredit Ukraine's president, Volodymyr Zelensky.

Those videos were craftily edited to amp up the anti-Ukraine theme where possible and also used to promote the "Olympics Has Fallen" fake documentary.

Storm-1679 is also working alongside Storm-1099, another Russia-affiliated group, which is instead focusing its efforts on targeting French citizens through 15 fake French-language news sites, and dupe Le Parisien and Le Point sites, to pursue various different disinformation goals.

Storm-1099 appears to be trying to undermine French President Emmanuel Macron by spreading fake stories about his indifference to citizens' socio-economic struggles, for example. 

It's also working to stoke fears around the security of the Summer Games, disseminating images of graffiti suggesting that terrorist events similar to those of the 1972 Games would repeat this year in Paris. Microsoft believes these to be fakes.

Tangentially, similar references to the 1972 murder of 11 Israeli Olympics team members by a Palestine Liberation Organization affiliate featured in an X video posted by the Turkish ultranationalist group Grey Wolves. The video hasn't been officially linked to Russia, but Russian-speaking accounts were promoting it, suggesting it could be part of the broader campaign against this year's Olympics.

Pursuing the terrorism idea in an apparent attempt to ultimately limit the number of attendees during the Games, Storm-1679 has launched similar disinformation campaigns. It has released fake videos purportedly from the CIA warning of the terrorism threat level as "high" in Paris during the Games, as well as fake France24 clips of tickets being returned owing to security fears.

"Over the past year, Storm-1679 has consistently produced a collection of deceptive videos, suggesting that legitimate and trusted sources are conveying accurate information regarding expected violence during the Paris Games," said Microsoft. "In a short video, masquerading as a clip from Brussels-based media outlet Euro News, Storm-1679 falsely claimed that Parisians were buying property insurance in anticipation of terrorism surrounding the Games.

"Prior to spring 2024, Storm-1679 primarily launched disinformation operations in English, only occasionally producing content in French and German, among other European languages. [Microsoft Threat Analysis Center] tracked a notable increase in Storm-1679's French-language content as the Olympics campaign gained steam, possibly signaling an effort to target the French public more directly or set the scene for alleged unrest in the lead-up to the Games."

Russia's fraught relationship with the Games

Russia will again not be competing at a major international sporting event when the Summer Olympic Games begin in July. Since Putin invaded Ukraine in 2022, the country has been barred from spectacles such as the rugby and football world cups, Formula 1 grand prix races, and equivalent events for many other sports.

The Olympics previously banned Russia due to doping, but had that not been a factor it would also likely have banned the country from this year's Games too.

Away from its sporting integrity, Russia has also been fingered for its role in numerous cyberattacks on the Olympics since it hosted the 2014 Winter Games in Sochi. The event was geared up to present a new Russia in the wake of various human rights abuses, but was instead tarnished by what followed. Aggression in Ukraine and the aforementioned doping scandal essentially undid Russia's efforts to improve its image.

In 2020, the UK and US formally attributed Russia to seven major cyberattacks since the 2014 Games, including malware attacks on the 2018 Winter Games in South Korea, and charged six of its intelligence officers with hacking offences: 

• Attacks on Ukraine's critical infrastructure using Industroyer, BlackEnergy, and KillDisk malware (2015-2016)

• Spearphishing and hack-and-leak ops against Macron's Presidential campaign (2017)

• NotPetya (2017)

• Attacks on the Pyeongchang Winter Olympics, targeting South Korean citizens, Olympic athletes, spectators, and International Olympic Committee officials (2017-2018)

• Attacks on the IT systems of the Pyeongchang Games using Olympic Destroyer malware (2017-2018)

• The poisoning of Sergei Skripal, his daughter, and UK citizens on English soil (2018)

• Various attacks against Georgia's government and a media company in the country (2018-2019)

Then-UK foreign secretary Dominic Raab said in response to the formal attribution: "The GRU's actions against the Olympic and Paralympic Games are cynical and reckless. We condemn them in the strongest possible terms.

"The UK will continue to work with our allies to call out and counter future malicious cyberattacks."

The attacks on the Pyeongchang Games using the Olympic Destroyer malware led to the destruction of data, and the crashing of the event's website and on-site Wi-Fi networks. Russia was also pinned to reconnaissance efforts against officials related to the 2020 Olympics in Tokyo.

There is a belief among critics that Russia's consistent targeting of the Games represents an effort to ensure Sochi was the last Olympics that went off without a hitch.

Vitaly Kazakov, a postdoctoral fellow at the University of Iceland who wrote his PhD on the Sochi Games, said that inside Russia, following the 2020 attribution of the Putin administration to the spree of cybercrimes, voices were skeptical.

There, the reputational benefits of Sochi are far more pronounced than they are outside of Russia. Kazakov's analysis of tweets in the days surrounding the news of Russia's cyber campaigns breaking showed many more people focused on the negative aspects of the cybercrime, rather than positive or neutral reflections of the 2014 Games.

"Russian-language tweets shared since the publication of hacking reports included individuals reflecting on Sochi 2014 with a sense of nostalgia and national pride," said the academic.

"The enduring reputational effects of events like this and the 2018 World Cup appear much more pronounced for the Kremlin at home than they are internationally. Yet the diverse nature of international public reflections on such events and their political implications need to be acknowledged, as they also inform public attitudes to new crises." ®

https://www.theregister.com//2024/06/03/russias_cyberattacks_against_2024_olympics/