Fake video of threat to Olympic Games appears to be from Russia, researchers say

A video spreading on X and Telegram of a man purporting to be a Hamas fighter threatening the Olympics in Paris is part of a Russian-linked disinformation campaign meant to disrupt the event, according to researchers at Microsoft.

On Telegram, Hamas official Izzat al-Risheq denied the video had come from Hamas, calling it a forgery.

Researchers from Microsoft’s Threat Analysis Center, who reviewed the video at NBC News’ request, said it appears to have come from a known Russian disinformation group, noting that details of a previous video about Ukraine match it.

In the most recent video, a man with his face wrapped in a scarf stands against a gray wall and addresses the people of France and President Emmanuel Macron. He says in Arabic that “rivers of blood will flow through the streets of Paris” for what he said was France’s support of Israel in the war with Hamas and its welcoming Israeli athletes to the Olympic Games, holding up a severed mannequin’s head seemingly covered in red paint.

With the opening ceremony just days away, French authorities have reassured the public that it has taken every possible security precaution, which includes deploying tens of thousands of security personnel. Microsoft had warned that Russia was looking to scare people away from the Games.

The Microsoft researchers said Tuesday that a group known as Storm-1516, a small but prolific outgrowth of Russia’s infamous Internet Research Agency troll farm, appeared to be behind the video. The video has in recent days been spread by several popular accounts known to traffic in Russian propaganda, with some also trying to claim it came from Israel.

“This operation closely aligns with tactics, techniques and procedures observed in previous Storm-1516 operations, including a previous video that similarly pretended to be Hamas,” the Microsoft group said in a statement.

NBC News found similarities between the new video and the previous one about Ukraine, which was posted in October and had been identified by Clemson University researchers as having come from Russia’s Storm-1516.

In the October video, several men in scarves and face coverings stand against a gray wall. One of them thanks Ukrainian President Volodymyr Zelenskyy in Arabic for “a new shipment of weapons and military equipment.” The post promoted a false claim that Ukraine had provided military assistance to Hamas, disinformation that Russian propagandists have boosted on social media.

In both videos, the man who delivers the message appears to be standing in front of the same gray wall wearing the same uniform. He also begins his speech with the same invocation to God.

Microsoft researchers said Storm-1516 campaigns are recognized by certain tactics, including creating videos in which actors allege a conspiracy and then posting those videos to relatively new online accounts with few followers. The videos are then laundered through Telegram, X and websites impersonating local news sites or as sponsored content on foreign news sites. Their goal is to reach mainstream audiences in the West.

In June, Microsoft’s threat analysis center said in a report that one of Russia’s goals was to create fear around the threat of violence during the Paris Olympic Games “to deter spectators from attending the Games,” wrote Clint Watts, general manager of Microsoft’s Threat Analysis Center.

The fake Hamas video was initially posted Sunday on X by an account with the name “Hamas fighter,” which was started in February and has posted only a few dozen times.

Darren Linvill, a professor and director of the Media Forensics Hub at Clemson, said the fake Hamas video had been laundered through Kremlin-friendly Arab and French West African news outlets on Monday, in what he called “classic Russian placement and layering strategy.”

And early Tuesday it passed through pro-Russian accounts, first reposted by Simeon Boikov, an Australian propagandist for Russian President Vladimir Putin who is living in Sydney’s Russian Consulate and posts online under the moniker “Aussie Cossack.” It was then shared by pro-Kremlin Telegram channels, including Golos Mordora, to 169,000 subscribers, citing Arabic-language media reports.

Two hours after it was posted by Aussie Cossack, it was shared by Pravda-En, a known Russian propaganda outlet. The link is no longer active.

Some of those accounts claimed Israel may have been behind the video, an accusation also leveled by al-Risheq, the Hamas spokesperson. There is no evidence that the video came from Israel.

By the afternoon, the video had been posted on X nearly 4,000 times, according to PeakMetrics, a company that tracks online threats.

Grok, Elon Musks’ artificial intelligence model on X, which has struggled in its goal to curate the news without inserting misinformation and unverified claims, summarized the post as a trending topic, wrongly attributing the video to Hamas and adding, “This threat has sparked widespread concern and calls for increased security measures to ensure the safety of the event.”

“Grok can make mistakes, verify its outputs,” a warning label attached to the trending post read.