Russia-linked cybercampaigns target France, focus on Olympics and elections

Photos of blood-red hands on a Holocaust memorial. Caskets at the Eiffel Tower. A fake French military recruitment drive calling for soldiers in Ukraine, and major French news sites improbably registered in an obscure Pacific territory, population 15,000.

All are part of disinformation campaigns orchestrated out of Russia and targeting France, according to French officials and cybersecurity experts in Europe and the United States. France's legislative elections and the Paris Olympics sent them into overdrive.

More than a dozen reports issued in the past year point to an intensifying effort from Russia to undermine France, particularly the upcoming Games, and President Emmanuel Macron, who is one of Ukraine's most vocal supporters in Europe.

 

The Russian campaigns sowing anti-French disinformation began online early last summer but first became tangible in October 2023 when more than 1,000 bots linked to Russia relayed photos of graffitied Stars of David in Paris and its suburbs.

A French intelligence report said the Russian intelligence agency FSB ordered the tagging, as well as subsequent vandalism of a memorial to those who helped rescue Jews from the Holocaust.

Photos from each event were amplified on social media by fake accounts linked to the Russian disinformation site RRN, according to cybersecurity experts.

Russia denies any such campaigns. The French intelligence report says RRN is part of a larger operation orchestrated by Sergei Kiriyenko, a ranking Kremlin official.

You have to see this as an ecosystem, said a French military official, who spoke on condition of anonymity to reveal information about the Russian effort. It's a hybrid strategy.

The tags and the vandalism had no direct link to Russia's war in Ukraine, but they provoked a strong reaction from the French political class, with denunciations in the legislature and public debate. Antisemitic attacks are on the rise in France, and the war in Gaza has proven divisive.

The Stars of David could be interpreted either as support for Israel or as opposition. The effect was to sow division and unease. French Jews in particular have found themselves unwittingly thrust into the political fray despite, at just 500,000 people, making up a small proportion of the French population.

In March, just after Macron discussed the possibility of mobilising the French military in Ukraine, a fake recruitment drive went up for the French army in Ukraine, spawning a series of posts in Russian- and French-language Telegram channels that got picked up in Russian and Belarusian media, according to a separate French government report seen by The Associated Press.

On June 1, caskets appeared outside the Eiffel Tower, bearing the inscription French soldiers in Ukraine.

The larger disinformation efforts show little traction in France, but the Russian audience may have been the real target, officials said, by showing that Russia's war in Ukraine is, as Putin has said, really a war with the West.

Among the broader goals, the French military official said, was a long-term and steady effort to sow social discord, erode faith in the media and democratic governments, undermine NATO, and sap Western support for Ukraine.

Denigrating the Olympics, from which most Russian athletes are banned, is a bonus, according to French officials monitoring the increasingly strident posts warning of imminent unrest ahead of the Games.

On June 9, the French far-right National Rally trounced Macron's party in elections for the European Parliament. The party has historically been close to Russia: one of its leading figures, Marine Le Pen, cultivated ties to Putin for many years and supported Russia's illegal annexation of Crimea from Ukraine in 2014. And its leading contender for prime minister, Jordan Bardella, has said he opposes sending long-range weapons to Kyiv.

In more than 4,400 posts gathered since mid-November by antibot4navalny, a collective that analyses Russian bot behaviour, those targeting audiences in France and Germany predominated. The number of weekly posts ranged from 100 to 200 except for the week of May 5, when it dropped near zero, the data showed. That week, as it happens, was a holiday in Russia.

Many of the posts redirect either to RRN or to sites that appear identical to major French media, but with the domain and content changed. At least two of the more recent mirrored sites are registered in Wallis and Futuna, a French Pacific territory 10 time zones from Paris.

A click on the top of the fake page redirects back to the real news sites themselves to give the impression of authenticity. Other posts redirect to original sites controlled by the the campaign itself, dubbed Doppelganger.

The redirects shifted focus for the European elections and continued after Macron called the surprise legislative elections with just three weeks to spare.

Three-quarters of posts from the week ahead of the June 30 first-round legislative vote that were directed toward a French audience focused on either criticising Macron or boosting the National Rally, antibot4navalny found in data shared with The Associated Press.

One post on a fake site purported to be from Le Point, a current affairs magazine, and the French news agency AFP, criticizing Macron.

Our leaders have no idea how ordinary French people live but are ready to destroy France in the name of aid for Ukraine, read the headline on June 25.

Another site falsely claimed to be from Macron's party, offering to pay 100 euros for a vote for him and linking back to the party's true website. And still another inadvertently left a generative AI prompt calling for the re-write of an article taking a conservative stance against the liberal policies of the Macron administration, according to findings last week from Insikt Group, the threat research division of the cybersecurity consultancy Recorded Future.

They're scraping automatically, sending the text to the AI and asking the AI to introduce bias or slants into the article and rewrite it, said Clement Briens, an analyst for Recorded Future.

Briens said metrics tools embedded within the site are likely intended to prove that the campaigns were money well-spent for whoever is doing the payouts for these operations.

The French government cybersecurity watchdog, Viginum, has published multiple reports since June 2023 singling out Russian efforts to sow divisions in France and elsewhere.

That was around the time that pro-Kremlin Telegram feeds started promoting Olympics has Fallen a full-length fake Netflix film featuring an AI-generated voice resembling Tom Cruise that criticised the International Olympic Committee, according to the Microsoft Threat Analysis Centre.

Microsoft said this campaign, which it dubbed Storm-1679, is fanning fears of violence at the Games and last fall disseminated digitally generated photos referring, among other things, to the attacks on Israeli athletes at the 1972 Olympics.

The latest effort, which started just after the first round of the elections on June 30, merges fears of violence related to both the Olympics and the risk of protests after the decisive second round, antibot4navalny found. Viginum released a new report Tuesday detailing the risks ahead for the Games not for violence but for disinformation.

Digital information manipulation campaigns have become a veritable instrument of destabilisation of democracies, Viginum said. This global event will give untold informational exposure to malevolent foreign actors. The word Russia appears nowhere.

Baptiste Robert, a French cybersecurity expert who ran unsuccessfully as an unaffiliated centrist in the legislative elections, called on his government and especially lawmakers to prepare for the digital threats to come.

This is a global policy of Russia: They really want to push people into the extremes, he said before the first-round vote. It's working perfectly right now.