Exploit: Extortion & Malware
Company: The Cyber Centre
Industry: Sports & Entertainment
Sources: https://www.canada.ca/en/communications-security/news/2024/05/cyber-centre-publishes-report-on-cyber-threats-to-major-international-sporting-events.html

The Canadian Centre for Cyber Security (Cyber Centre) has issued a bulletin outlining the cyber threats facing major international sporting events. The bulletin underscores the potential exploitation by cybercriminals, hacktivists, and state-sponsored actors during such events over the next year. It is directed towards all Canadians participating in these events, including spectators, athletes, government representatives, and associated organizations.

The bulletin cautions that major international sporting events are lucrative targets for cybercriminals due to their prominence and financial stakes. The Cyber Centre predicts that cybercriminals will likely attempt to extort organizations linked to or in proximity to these events through tactics like business email compromise and ransomware attacks. Individuals involved, such as organizers and attendees, could also be targeted through phishing emails, malicious websites, and search engine manipulation, with sporting events serving as bait.

Additionally, the bulletin highlights the potential for hacktivists to leverage major sporting events to amplify their messages. They may engage in activities such as website defacements, distributed denial-of-service (DDoS) attacks, and data breaches to disrupt services and draw attention to their causes.

State-sponsored cyber threat actors may exploit major sporting events for espionage purposes, targeting prominent individuals and organizations associated with or attending these events. Their objectives may include gathering sensitive information, intelligence gathering, and establishing ongoing access to targets even after they return to their home countries.

Furthermore, the bulletin offers insights into past cyber incidents related to major sporting events and addresses the risks posed by artificial intelligence and event-specific applications.

Despite variations in event size, popularity, and host nation, the cybersecurity threats remain consistent. Canadians are urged to be vigilant and adhere to basic cybersecurity practices. The Cyber Centre regularly publishes guidance to assist individuals and organizations in defending against prevalent and emerging threats.

“Over the next year, Canada will host, attend and participate in several major international sporting events. While these provide an opportunity to showcase our athletes’ skills and our national pride on a global stage, they can also expose Canadians to increased cyber threats. Through bulletins such as this one, the Cyber Centre is raising awareness of the threats and ensuring organizations and individuals have the knowledge they need to protect their systems and their sensitive information.”

- Sami Khoury, Head of the Canadian Centre for Cyber Security

Key Points:

• The assessment is based on the Cyber Centre's expertise in cybersecurity and intelligence gathered from both classified and unclassified sources.

• Business email compromise involves tricking victims into transferring funds to criminal-controlled accounts through impersonation tactics.

• SEO poisoning aims to elevate malicious websites in search engine results, attracting unsuspecting visitors.

• DDoS attacks disrupt legitimate users' access to networked systems, services, or websites.

• High-profile attendees at risk include government officials, sporting organization leaders with government ties, representatives of affiliated private entities, and anti-doping program officials.