Storm-1679
Storm-1679 is a Russian influence operation tracked by Microsoft and also referred to as Oka Flood, Matryoshka, and Operation Overload in the provided content. Microsoft describes it as an influence/disinformation actor aligned with Kremlin propaganda. The activity has targeted major international events and broader political issues, including the Paris 2024 Olympics, global elections, Ukraine, immigration, and the conflict environment referenced in the source material. In the Paris 2024 Olympics context, Storm-1679 conducted a coordinated disinformation campaign using fake warnings, spoofed media reports, and fabricated intelligence-style messages intended to discourage attendance and amplify fear around terrorism and safety risks. Reported tradecraft included AI-generated and deepfake content, such as a fabricated documentary titled "Olympics Has Fallen" that used Netflix branding and an AI-generated Tom Cruise voice, as well as fake videos impersonating outlets such as the BBC and Al Jazeera and agencies including the CIA and French intelligence services. The content states the group produced multiple fake English- and French-language videos per week. The provided material also links Storm-1679/Matryoshka/Operation Overload to AI-enabled influence operations during later sporting events, including fabricated news segments using AI voice cloning to mimic broadcasters such as CBC and Euronews. One cited example was a doctored CBC report that falsely claimed Ukrainian athletes had been segregated in the Olympic Village. The content further states that the operation adapted its narratives to exploit ongoing geopolitical tensions. According to the source material, Storm-1679 previously focused on anti-Ukrainian refugee messaging before pivoting to Olympics-related themes. Microsoft attributed coordinated influence campaigns during the Paris Olympics to Russian operations including Storm-1679, but one cited researcher noted it had not been established whether Storm-1679 was directly backed by the Russian government or operated independently. High-confidence characterization from the content is that it is a Russian-aligned influence operation associated with Kremlin narratives.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Media & Entertainment
Where they target
Geographies tied to known operations.
- 🇫🇷 France
Where they're from
Attributed origin per open-source reporting.
- RU
Tradecraft
5 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Russian influence operation using AI-generated and deepfake content to spread false terror-related narratives around major sporting events.
Russian influence operation adapting conflict-related narratives for media impersonation and disinformation targeting European audiences.
Large-scale, AI-driven disinformation campaigns targeting global elections and controversial issues to sow discord in democratic countries.
Russia-linked influence operations cluster listed in Microsoft's naming taxonomy mapping.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.