International sporting events have long served as platforms for soft power projection, where states compete not only for medals but for legitimacy, influence, and narrative dominance. For Russia, sport has historically been deeply embedded in its strategic communications – from Soviet-era prestige-building to contemporary efforts aimed at contesting Western narratives and maintaining geopolitical relevance despite exclusion from international competition.
Since Russia’s full-scale invasion of Ukraine in 2022, and the resulting restrictions on Russian participation in international sport, the Olympic movement has increasingly become a contested informational space. This was already evident during the Paris 2024 Summer Olympics, where coordinated disinformation campaigns sought to undermine Ukraine’s presence, discredit Western institutions, and frame the Games as politically biased.
The Milano Cortina 2026 Winter Olympics represent a continuation – and evolution – of this approach.
A defining feature of the Milano Cortina campaign is its tight temporal alignment with both the Olympic calendar and external geopolitical triggers, indicating a deliberate sequencing strategy rather than opportunistic posting.
The campaign followed a four-phase information cycle:
1) Priming
2) Saturation
3) Exploitation; and
4) Entrenchment
This was complemented by a parallel pattern of physical disruption activity, together forming a hybrid influence environment.
DISARM (Disinformation Analysis and Risk Management) provides a structured way to analyse influence operations by breaking them down into stages such as narrative development, content creation, dissemination, amplification, and adaptation.
Rather than focusing solely on individual pieces of content, DISARM enables analysts to identify patterns of behaviour, including how narratives are introduced, how they spread across platforms, and how they evolve over time. This is particularly valuable in high-volume environments, where individual posts may appear insignificant but collectively form a coordinated campaign.
Applied to Milano Cortina 2026, the framework reveals a campaign that spans nearly the entire disinformation lifecycle, demonstrating a level of operational maturity consistent with state-linked influence activity.
The campaign began in late January with a targeted effort to shape how audiences interpreted the Games before they begin.
On 30 January 2026, a post on X circulated a video falsely branded as La Repubblica, claiming that Italian authorities had increased surveillance of Ukrainian refugees due to their alleged links to terrorism. This claim was unsupported, and no such reporting appeared in legitimate sources. Despite limited engagement, the video achieved relatively high visibility, suggesting coordinated amplification.
Fig 1. Still from a fake La Repubblica video [source]
This initial narrative established a security threat framing, positioning Ukraine as a source of instability. Its function was not to dominate the information space, but to set a cognitive baseline. By associating Ukraine with terrorism and heightened security measures, it primes audiences to interpret subsequent narratives – whether related to crime, disorder, or violence – through a pre-established lens.
Operationally, this reflects a proactive shaping phase, consistent with DISARM’s narrative development stage. It introduces emotionally salient themes and targets audiences already sensitive to migration and security issues, including European host populations and Olympic visitors.
Crucially, this phase is not about virality. It is about priming interpretive frameworks that later disinformation will exploit.
As the Opening Ceremony approached, the campaign escalated into its highest-volume phase. This period is characterised by a rapid expansion of narratives across multiple themes, delivered in quick succession and often within the same 24–72 hour window.
Narratives during this phase included the following:
• Claims that Ukrainian authorities confiscated passports to prevent defection.
• That the Ukrainian flagbearer had gone missing in France.
• That Italy had refused to broadcast a message from President Zelenskyy.
• Fabricated reports alleging that Ukraine attempted to deploy Security Service (SBU) agents to the Games, framing Ukrainian athletes as both untrustworthy and politically controlled.
Fig 2. Fake Libération video claiming Ukraine’s flagbearer was missing [source].
Fig 3. Fake Bellingcat video claiming Italy would not allow President Zelenskyy to speak [source].
Fig 4. Dissemination on Pravda Network of claims that the Ukrainian SBU would be in attendance. This claim was made across multiple Russian sources [source]
These narratives were complemented by astrong criminality frame. Fake media reports claimed Ukrainian refugees wereinvolved in ticket fraud, identity theft, and phishing schemes targetingOlympic visitors. In parallel, more emotionally charged narratives emerged,including fabricated claims that Ukrainian workers were contaminating food, orthat Israeli spectators faced threats from Ukrainian “extremists”.
Fig5. Fake Libérationvideo claiming a group of Ukrainian refugees had been arrested for sellingcounterfeit tickets [source].
Fig 6. Fake Libération video claiming a group of Ukrainian refugees had been arrested for selling counterfeit tickets [source].
The tactical approach was consistent and highly structured. Content was typically seeded on Telegram and/or X, before being artificially amplified on X. In some cases, narratives were further reinforced through republication across aligned networks such as Pravda. Much of the content took the form of fake media videos, impersonating outlets such as BBC, Reuters, Libération, or government bodies such as Viginum or DGSE.
The cumulative effect is one of information overload. Rather than relying on a single dominant narrative, the campaign deployed multiple overlapping claims that reinforced each other. In this way, Ukraine is simultaneously framed as dangerous, unstable, criminal, and divisive.
This saturation was closely aligned with the Opening Ceremony, a moment of peak global attention. By concentrating output during this window, the campaign maximised visibility and establishes narrative dominance before counter-narratives could emerge.
In effect, this phase reflects a classic saturation strategy, where volume substitutes for credibility.
Following the initial saturation phase, the campaign became more adaptive, shifting towards real-time exploitation of events.
A key trigger was the disqualification of Ukrainian skeleton athlete Vladyslav Heraskevych, which prompted a surge in personalised narratives. Fabricated reports claimed that: his helmet was being worshipped in Ukrainian churches; the Ukrainian team was isolated due to “toxic” behaviour; other athletes criticised Heraskevych; and that Ukrainian supporters engaged in violent or disruptive conduct.
Fig 7. Post claiming that Ukrainians were praying to Heraskevych’s helmet in churches [source].
Fig8. Post claiming that soldiers in Ukraine posting solidarity with Heraskevychwere targeted and killed by Russian forces due to GPS identification [source].
This marked a clear tactical shift. Where earlier narratives were broad and thematic, this phase introduced hyper-specific, event-driven claims, increasing plausibility by anchoring disinformation in real developments. The focus expanded to include individual athletes, institutional decisions, and crowd behaviour.
At the same time, additional narratives continued to reinforce existing themes. Claims anti-Ukraine graffiti and institutional bias (including alleged preferential treatment by WADA or the IOC) contributed to a broader narrative of declining support and internal dysfunction.
Fig9. One of multiple examples seen in the Pravda Network claiming that graffitiin Italy had emerged showing anti-Ukrainian sentiment and an image of Zelenskyy[source].
Crucially, this phase also coincided with a series of railway sabotage incidents across northern Italy, beginning on 07 February 2026 and continuing throughout the Games. While attribution remains unclear, the timing mirrors disruptions observed during Paris 2024.
These incidents reinforce disinformation narratives around insecurity and instability. Whether coordinated or opportunistically exploited, they contribute to a hybrid influence environment, in which physical events and information operations interact. Real-world disruption provides tangible reference points, increasing the plausibility of otherwise fabricated claims.
This phase demonstrates a high degree of operational agility, with narratives adapting rapidly to unfolding events and media coverage.
In the final phase, the campaign shifted from reacting to events toward consolidating its messaging into broader, generalised claims.
Narratives evolved from specific incidents into aggregate assertions. This included:
• Fabricated reports claimed that Ukrainians were responsible for the majority of crimes during the Games.
• That members of the Ukrainian delegation had disappeared or defected.
• That European audiences and athletes were increasingly hostile toward Ukraine due to the proliferation of refugees across the continent.
These narratives were presented in formats designed to mimic authoritative reporting –such as fake Euronews or BBC-style videos – giving the impression of evidence-driven conclusions rather than isolated claims.
Fig10. Fake Euronews video claiming that Ukraine’s interpreter had defected [source].
Fig11. Fake BBC News video claiming that Ukrainians were "facing aggressionfrom Europeans" due to the behaviour of refugees [source].
The function of this phase was to transform short-term narratives into perceived long-term truths, thus altering the belief structure within the cognitive domain. By repeating and aggregating earlier claims, the campaign reinforced confirmation bias and created a sense of narrative fatigue, increasing the likelihood that audiences accepted the messaging as credible.
Strategically, this phase is aimed at post-Games impact. It seeks to influence how the event is remembered, shaping media discourse, public perception, and potentially policy debates.
This represents a shift from persuasion to consolidation, ensuring that disinformation “sticks” beyond the immediate event.
The Milano Cortina campaign does not appear to be a single, discrete operation. Instead, it reflects a convergence of tactics associated with multiple known Russian influence efforts, suggesting a flexible and adaptive ecosystem.
SecAlliance attributes the Milano Cortina campaign with high confidence to the Russian state – and specifically, to the Matryoshka / Operation Overload campaign – which is characterised by fabricated media content, Telegram-first dissemination, and coordinated amplification on Western platforms. The use of fake videos, staged visuals, and high-volume distribution closely mirrors this model.
At the same time, the campaign shares features with Doppelgänger-style operations - which primarily focus on website cloning and impersonation of media brands. This was particularly seen in the persistent impersonation of trusted media brands and the construction of a layered information environment.
The Pravda network appears to serve as a persistence layer, republishing narratives and extending their lifespan, contributing to the perception of independent verification.
Together, these elements indicate a hybridised influence model, combining multiple established techniques into a cohesive operational approach.
The Milano Cortina 2026 disinformation campaign demonstrates a clear and deliberate sequencing strategy, structured around a four-phase lifecycle: priming, saturation, exploitation, and entrenchment.
Rather than emerging as isolated or reactive incidents, the campaign unfolded in a coordinated manner that reflected prior planning and a sophisticated understanding of how narratives evolve within high-attention environments.
Across all phases, narratives are:
• Introduced early to shape perception
• Amplified at moments of peak visibility
• Adapted to real-world events
• Consolidated into long-term claims
This structured approach, combined with the integration of physical disruption, reflects a mature hybrid influence operation.
As with Paris 2024, the Milano Cortina Games illustrate how international sport has become a key domain for geopolitical contestation. In this environment, influence is not achieved through a single narrative, but through the sustained and coordinated shaping of perception over time.
