Banner: Montage of screenshots from a fake BBC video depicting bugs attacking people in Paris. (Source: Shvarka News/archive)

In the days leading up to the 2024 Summer Olympics in Paris, Russian and pro-Russian influence actors intensified their activities to discredit France and President Emmanuel Macron. These discrediting efforts predicted the eruption of violence during the games, and spread various false claims about France’s inability to organize suitable conditions for the event. The operations in question are multi-language and cross-platform, employing various tactics such as impersonating reputable media, fabricating reports, using AI-generated videos, and launching hashtags, among other tactics.

Because of its support to Ukraine, France has been one of the key targets of the Russia-linked operations known as Doppelganger and Matryoshka, which aim to undermine Western support to Ukraine. France experienced an influx of Russian hybrid destabilization campaigns in the year leading up to the Summer Olympics. For example, the French government believes that Russian intelligence was responsible for the spread of graffiti featuring the Star of David on walls in Paris following the October 2023 Hamas attack on Israel, which were aimed to incite fear within the country Jewish community. In spring 2024, President Macron accused Russia of attempting to undermine the Paris Olympics, including with running information operations. And two days before opening ceremonies commenced, French security services arrested a Russia-born man suspected of “stirring up hostility in France.”

The DFRLab previously covered how Russia-linked operations have targeted France throughout 2023 and 2024, using bot-like behavior on X, and impersonating news outlets, and political figures during the July legislative elections.

The DFRLab observed that the Telegram channel Shkvarka News (Шкварка News), which serves as a frequent source of manipulated or bogus content for assets of Russia-linked Operation Matryoshka, spread various fake content discrediting the Olympics, with increasing activity in July 2024. Many of these posts spread to other Telegram channels, X, Facebook, and numerous websites, collectively reaching large audiences.

A July 19 video posted by Shkvarka News, which masqueraded as a clip from Indian outlet Free Press Journal, claimed that a UN water study concluded that India’s Ganges River was cleaner than the Siene, which is hosting open-water swimming events. Over the next several days, copies of the video with identical or similar captions were shared on Russian and French Telegram, French Facebook, and X accounts.

Screengrab of a video clip featuring the Free Press Journal logo and a claim about the Seine River being unsuitable for the Olympics. (Source: Shkvarka News/archive)

In another incident, the Telegram channel Shvarka News featured an unrealistic AI-generated animation showing horrified people attacked by giant bugs taking over Paris. The clip featured a stolen BBC logo and text claiming that “Microsoft programmers” had generated the video, sourcing the information from French media outlets. The same video was also amplified by large pro-Kremlin Telegram channels and X accounts.

Other efforts included spoofed news clips and images impersonating France 24, DW, Le Monde, and Bellingcat, among others, claiming a shortage of doctors in Paris, a massive fish die-off in the Seine, and the poor quality of Olympics facilities.

The DFRLab observed multiple instances of falsified news clips, screen captures and social media posts that emerged on Telegram channel known as The Hand of the Kremlin. A July 8 video purporting to be French news outlet France 24 spread unfounded claims that infectious fungi had been found in eighteen of Paris’s top twenty hotels, as well as mold and bed bugs.

In addition, the DFRLab observed various iterations of fraudulent news material disguised as screen captures of French news sources spreading false narratives. In one instance, the French TV broadcasting channel TF1 was impersonated with a false mobile device screen capture alleging that the police had asked Parisians to refrain from ordering food online due to the Olympic games. No trace of such article was found on TF1’s website, though its timestamp and author initials match a different TF1 article on an unrelated topic.

On X, the DFRLab observed that accounts linked to Russia’s Doppelganger operation published tweets using a hashtag to denigrate the Paris Olympics between June 1 and July 15. We observed sixty-five tweets that used the hashtag #JOPourris (“Lame Olympic Games“) to spread negative and derogatory narratives about the games. According to X data collected using the social media analytics tool Meltwater Explore, the three posts that accumulated the highest reach all originated from retweets of a post by the inauthentic account Le Belligerant. Associated with a deplatformed fake news outlet of the same name, Le Belligerant posted on X, “The Seine is unsuitable for swimming. As the authorities are unable to ensure the safety of the French, citizens must do so themselves by returning their tickets.” In late July, the Olympics triathlon was delayed due to water quality concerns.

Other accounts that used the same hashtag included La Virgule, FranceEtEU, and Candidat News, each of which were associated with iterations of Doppelganger domains that posed as false French news outlets. The accounts also engaged in hashtag hijacking in order to artificially boost trends on X.

The inauthentic accounts also amplified a video that emerged after French law enforcement noted instances of unsanitary accommodations. Their complaints were echoed by the account Le Belligerant in a July 15 X post that featured the same video.

On June 26, the DFRLab observed ten accounts that engaged in seemingly coordinated posting of a video calling out the International Olympics Committee (IOC) for allegedly including e-sports in the Paris Olympics. The video also displayed a banner that read, “The IOC destroys cybersport.” While it is true that the IOC has begun to embrace e-sports, the event does not take place until 2025 in Saudi Arabia, separate from the Summer and Winter Olympics.

Meanwhile, a two-minute English-language clip mocking the Paris Olympics and discouraging attendance garnered millions of views on X. The clip was produced in the style of the Russian band Little Big, which relocated to the US following Russia’s 2022 full-scale invasion of Ukriane. The video combined AI-generated materials with studio footage featuring real actors, five of whom Russian investigative platform Agenstvo identified as Russia-based actors and models, suggesting that the clip was filmed in Russia.

In the video, people are seen urinating and throwing garbage into the Seine as swimmers navigate streams of trash. The video also featured a fake mayor of Paris shooting at migrants, while a fake President Macron kicks out a Belarusian athlete and plants doping substances in the pockets of European athletes.

Aussie Cossack, a pro-Russian propagandist with more than 60,000 followers on X, was among first accounts to disseminate the clip on the platform, garnering 6.6 million views. Meanwhile, cyber security company HarfangLab identified instances of Doppelganger accounts posting the clip, garnering 13,000 views and more than four thousand reposts. In May, a similar clip mocking President Biden was disseminated by Doppelganger accounts on X. In that instance as well, actors from Russia took part in the filming, which according to the actors took place in Moscow.

Spreading fear of violence during the Olympic games, particularly the threat of a terrorist attack, was another narrative theme among Russian influence actors. Bogus media clips originating on Russian Telegram channels falsely claimed that the Paris Metro was devoid of passengers because of an impending terrorist attack; they also claimed that French police recommended against using food delivery services as terrorists might pose as delivery employees. In another instance, a spoofed news clip showed a fabricated Bellingcat report claiming that France was providing high-level security services to certain delegates because of increased physical threats.

On July 23, a video circulating on X showed a man wrapped in a Palestinian keffiyeh promising in Arabic that “rivers of blood will flow through the streets of Paris.” Among the disseminators of the clip on X and Telegram was Aussie Cossack, whose X post garnered more than 25 million views and was reshared more than 4,500 times. Other Russian influence actors with large followings also amplified the clip; a post by RT correspondent Chay Bowes had garnered nearly three million views at the time of writing.

In the clip, a person claiming to be a Hamas member takes responsibility for a possible attack during the Paris Olympics. OSINT researcher Tal Hagin suggested that the style and various details did not match those of Hamas, however. Additionally, official Hamas channels never amplified the video, as per usual praxtice. Hagin observed that the video was first posted on July 21 by an account called @endzionism24, which was created a couple of months earlier and featured nearly zero activity. The account has since been suspended.

The DFRLab used Meltwater Explore to analyze discussion trends on X regarding Hamas possibly attacking the Olympics. Over a seven-day period from July 19 to July 26, mentions skyrocketed for the combination of keywords “Hamas,” “Paris,” and “Olympics,” peaking on July 23. Overall, the three keywords were mentioned together more than 47,000 times in English and nearly 71,000 times in all languages combined.

Following the circulation of the video, Hamas officials denied any link to the clip, which they stated was forged. Later, Microsoft’s Threat Analysis Center attributed the clip to remnants of the infamous Internet Research Agency, formerly Yevgeny Prigozhin’s troll farm. Concurrently, X accounts pushed a conspiracy theory that the fake Hamas video was a false flag operation in which Israel would carry out a terrorist attack in Paris and blame Palestinians for the incident.

The DFRLab also observed thirty X accounts using the hashtag #JOPourris (“Lame Olympic Games”) to warn of an impending terrorist attack. The messages featured a video clip embossed with a CIA logo. “THE CIA, THE US INTELLIGENCE AGENCY, ISSUED A WARNING TO INFORM AMERICANS THAT IT WAS NOT ADVISABLE TO USE THE PARIS METRO DURING THE OLYMPIC GAMES DUE TO THE HIGH TERRORIST THREAT,” the posts read. Others appeared with the same warning in French. Copies of the video spread on X, as well as the Telegram channels The Hand Of The Kremlin and Shkvarka.

The fact that the video masqueraded as a CIA announcement raises the possibility that it could be linked to threat actor Storm-1679 and Operation Doppelganger, as previously investigated in a June 2024 Microsoft threat assessment. That same month, the French government agency Viginum documented the use of forged content with CIA labels as part of a Russian influence operation known as Matryoshka.

Eto Buziashvili and Valentin Chatelet, “Russia-linked operations target Paris 2024 Olympics,” Digital Forensic Research Lab (DFRLab), August 1, 2024, https://dfrlab.org/2024/08/01/russia-linked-operations-target-paris-2024-olympics/.