Incident Overview
On September 17, 2024, Microsoft’s Threat Analysis Center (MTAC) identified a Russian-linked cyber influence operation targeting the U.S. presidential election. The operation, attributed to the group Storm-1516, fabricated a video depicting a woman falsely claiming that Vice President Kamala Harris was responsible for a 2011 hit-and-run accident that left her paralyzed. The video featured an on-screen actor portraying the victim, with claims that Harris had caused severe injuries. This fabricated content was disseminated through a newly created website impersonating a local San Francisco media outlet, which was established just days before the video’s release. The video generated millions of views, amplifying its reach and impact.
Storm-1516 is a Kremlin-aligned troll farm known for producing and spreading disinformation, often using AI-generated synthetic media to create fake witnesses, staged events, and manipulated narratives. This incident marks the second inauthentic video produced by Storm-1516 in recent weeks, with the first depicting an alleged attack by Harris supporters on a Trump rally attendee. Both videos were designed to discredit Harris and sow discord ahead of the 2024 U.S. election.
The fabricated hit-and-run video was traced back to Storm-1516 after Microsoft’s analysis linked its dissemination to a network of accounts and websites controlled by the group. Platforms subsequently removed the video following Microsoft’s report, though not before it had already circulated widely. The incident underscores the evolving tactics of Russian influence operations, which increasingly rely on AI-generated synthetic media to create plausible yet entirely false narratives.
Storm-1516’s shift toward targeting Harris follows a broader pattern observed by Microsoft, where Russian actors pivoted from earlier efforts focused on President Biden’s campaign to exploit perceived vulnerabilities in the Harris-Walz ticket. This strategic adjustment reflects a deliberate attempt to undermine Democratic candidates by amplifying divisive or damaging content. The use of AI in generating fake witnesses and fabricated events highlights the sophistication of modern disinformation campaigns, which blend technological tools with traditional propaganda techniques.
Storm-1516’s operations also included the creation of a fake news site masquerading as a legitimate San Francisco media outlet. This site was used to launder the fabricated video, lending it an appearance of credibility. The rapid deployment of such infrastructure—including the creation of a new website within days—demonstrates the agility of these groups in responding to political developments.
Microsoft’s report notes that Storm-1516 is part of a larger ecosystem of Russian influence operations, which now includes another group, Storm-1679, also producing and disseminating false videos targeting Harris. Storm-1679, which had previously focused on content related to the 2024 Paris Olympics, shifted its efforts to publish videos discrediting Harris, including a fake billboard campaign in New York City. These videos were shared rapidly across platforms like Telegram and X, with one post on X receiving over 100,000 views within four hours of its Telegram publication.
These tools allow threat actors to scale their influence efforts efficiently, generating content that appears authentic while spreading misinformation at a pace that overwhelms fact-checking mechanisms. The integration of AI into disinformation campaigns poses significant challenges for platforms, policymakers, and the public, as distinguishing between real and synthetic media becomes increasingly difficult.
Possible Root Cause
The root cause of this incident lies in the systematic exploitation of AI technologies by Russian state-aligned actors to fabricate and disseminate disinformation. Storm-1516’s use of AI-generated synthetic media—including deepfake videos and fake witnesses—enables the creation of highly convincing yet entirely false narratives. The group’s ability to rapidly deploy new websites and social media accounts further amplifies the reach of these fabricated stories, making them appear legitimate to unsuspecting audiences.
The strategic focus on Harris and the Harris-Walz campaign reflects a calculated effort to exploit political divisions and undermine Democratic candidates ahead of the 2024 election. By leveraging AI to produce fake witnesses, staged events, and manipulated media, Storm-1516 and related groups can create narratives that align with existing biases or controversies, increasing their likelihood of being shared and believed.
The creation of imposter news sites, such as the San Francisco media outlet used to launder the hit-and-run video, is a deliberate tactic to enhance credibility.
Additionally, the coordination between Storm-1516 and other Russian-linked groups, such as Storm-1679, suggests a broader, organized campaign. Storm-1679’s pivot from Olympic-related content to anti-Harris narratives indicates a deliberate reallocation of resources to maximize impact. The use of multiple platforms—including Telegram, X, and newly created websites—ensures that disinformation reaches diverse audiences, increasing its virality and potential influence.
The integration of AI into these operations also reflects a broader trend in cyber influence tactics, where nation-state actors increasingly rely on automation and machine learning to generate and distribute content at scale.
Takeaways
This incident highlights the growing threat posed by AI-generated synthetic media in election interference campaigns. The use of deepfake videos, fake witnesses, and imposter news sites by Storm-1516 demonstrates how rapidly disinformation can be produced and disseminated to influence public opinion. The challenge for platforms, policymakers, and the public is to develop effective countermeasures that can detect and mitigate these threats before they gain traction.
The strategic targeting of specific political figures, such as Vice President Harris, underscores the personalized nature of modern influence operations. Russian actors are not merely spreading generic disinformation but are tailoring their campaigns to exploit perceived weaknesses or controversies associated with individual candidates. This approach increases the likelihood that fabricated content will resonate with certain audiences, amplifying its impact.
The rapid deployment of new infrastructure, including websites and social media accounts, shows the adaptability of these groups. Storm-1516’s ability to create a fake San Francisco news site within days of launching the hit-and-run video demonstrates how quickly disinformation networks can evolve in response to political developments. This agility makes it difficult for platforms to keep pace with the creation of new accounts or sites, requiring continuous monitoring and proactive measures.
The coordination between multiple Russian-linked groups, such as Storm-1516 and Storm-1679, indicates a well-organized and resourceful campaign. The shift in focus from one group to another—such as Storm-1679’s move from Olympic content to anti-Harris narratives—suggests a deliberate strategy to maximize the spread of disinformation. This level of coordination complicates efforts to attribute or disrupt these operations, as threat actors can quickly shift resources or tactics in response to countermeasures.
The use of AI in generating fake witnesses and manipulated media poses significant challenges for detection and verification.
Microsoft’s report highlights the need for coordination between tech companies, government agencies, and civil society to monitor and respond to influence operations.
For the public, this incident serves as a reminder of the need for media literacy and critical thinking. The rapid spread of fabricated videos and fake news sites requires individuals to verify information from multiple sources before accepting it as true.
Finally, the persistence of these influence operations—despite previous disruptions, such as the U.S. government’s sanctions on Russian-linked entities—demonstrates the resilience of these groups. Even after the seizure of certain websites or accounts, actors quickly adapt by creating new infrastructure. This adaptability highlights the need for sustained vigilance and innovation in countering disinformation, as well as the importance of international cooperation to address the global nature of these threats.