Microsoft says hackers from Strontium, also known as Fancy Bear/APT28, are targeting 16 global sporting and anti-doping organizations ahead of 2020 Olympics
Microsoft said APT28 targeted “at least 16 national and international sporting and anti-doping organizations.”
Context & Ripple Effects
This disclosure extends a pattern Microsoft has built over years of publicly naming Fancy Bear's exploitation of a Windows flaw in 2016, its campaign against European research groups and think tanks earlier in 2019, and the blocked attempt to weaponize compromised IoT devices that summer. Each report has positioned Microsoft as one of the few private companies willing to attribute Russian state-linked operations by name.
The shift here is the target set: rather than policy institutes or infrastructure, Strontium is now aiming at sporting and anti-doping bodies on the eve of the 2020 Tokyo Games, where doping disputes and athlete eligibility are politically charged. Microsoft's later court-ordered seizure of seven Strontium domains shows this attribution work escalating into active disruption.
First-order effects
- At least 16 national and international sporting and anti-doping organizations face immediate credential-harvesting and intrusion risk heading into the 2020 Olympics, forcing security reviews weeks before the Games.
- Microsoft's Threat Intelligence team gains another public attribution win, reinforcing its role as the primary private-sector channel for exposing Strontium operations.
Second-order effects
- Olympic organizers and national cybersecurity agencies come under pressure to coordinate defenses with Microsoft around the Games, since the targeting list spans multiple countries' sporting bodies.
- Other technology vendors face expectations to match Microsoft's disclosure cadence, turning threat-intelligence transparency into a competitive differentiator rather than an anomaly.
Third-order effects
- If the sequence holds — attribution, then legal action like the domain seizures — private companies increasingly function as a counterintelligence layer between states, normalizing corporate naming-and-shaming of nation-state hackers as standard practice.
- Major global events like the Olympics become recurring targets for intelligence collection around politically sensitive data such as anti-doping records, pushing event organizers to treat cyber threats as core event infrastructure.
The trend: Microsoft is consolidating into a de facto public attribution and disruption force against Strontium, moving from reporting intrusions to legally dismantling the group's infrastructure.