www.recordedfuture.com Open in urlscan Pro
172.64.144.145  Public Scan

Form analysis
0 forms found in the DOM

Text Content

This website stores cookies on your computer. These cookies are used to improve
your website experience and provide more personalized services to you, both on
this website and through other media. To find out more about the cookies we use,
see our Privacy Policy.

Accept

 * Careers
 * Contact Us
 * Login
 * ENJPKO
   
   EN
   

 * Platform
 * Solutions
 * Products
 * Services
 * Research
 * Resources
 * Company

Get a demo

Book a demo



Blog


FIELDING THREATS: CYBER, INFLUENCE, AND PHYSICAL THREATS TO THE 2022 FIFA WORLD
CUP IN QATAR

Posted: 17th November 2022
By: Insikt Group®


Editor’s Note: This is an excerpt of a full report. To read the entire analysis
with endnotes, click here to download the report as a PDF.

This report analyzes the threat landscape ahead of the 2022 FIFA World Cup
hosted in Qatar that begins on November 20, 2022. The threats analyzed include
state-sponsored cyber operations, financially motivated cyber threats, influence
operations, and physical security threats. This report will be of most interest
to organizations involved in the hosting, running, or sponsoring of the 2022
FIFA World Cup, as well as individuals intending to participate in or attend the
tournament.

EXECUTIVE SUMMARY

Whole-spectrum threats to the 2022 FIFA World Cup in Qatar are largely
determined by Qatar’s unique geopolitical position on a contentious global
stage, with the country enjoying good relations with major powers such as the
United States (US), Europe, China, and Iran.

We have not identified any imminent, planned, or ongoing state-sponsored cyber
operations linked to known advanced persistent threat (APT) groups targeting the
2022 FIFA World Cup in Qatar or its organizers, sponsors, or associated
infrastructure. China, Iran, and North Korea are unlikely to conduct a
disruptive attack against the tournament as they lack motivation due to their
relations with Qatar, their involvement in the planning and execution of the
games, or other national priorities. Nevertheless, state-sponsored APT groups
tasked with foreign intelligence collection likely view the 2022 FIFA World Cup
as a target-rich environment for cyber espionage and surveillance against
foreign dignitaries and businesspersons alike.

Russia is an outlier and very likely harbors a strong set of grievances and thus
motivation for targeting the 2022 FIFA World Cup, such as wanting to embarrass
Qatar as the host country for siding with the coalition of countries supporting
Ukraine’s territorial integrity, as well as to retaliate for Russia being banned
from participating in the tournament. There is historical precedent for Russia
conducting cyberattacks against major sporting events, although Russian APT
groups are very likely distracted with Russia’s war against Ukraine and are
therefore unlikely to conduct a disruptive attack against the 2022 FIFA World
Cup. However, we cannot rule out that the Russian government will encourage or
otherwise tacitly approve of such attacks conducted by nationalistic Russian
hacktivist groups or ransomware operators.

Large international sporting events are also attractive targets for financially
motivated cybercriminals. Tournament-related phishing attacks use various lures
such as so-called ticket giveaways, free streaming services to watch games, fake
betting websites, and tournament-adjacent items like visas and travel, hotel,
and restaurant bookings. Other cybercriminal threats include, but are not
limited to: fake mobile applications around the event that can distribute
malware and harvest user data; sales on dark web markets and shops for
counterfeit tickets and compromised credentials; and as above, ransomware
attacks that would likely seek to opportunistically target victims based on
accessibility, opportunity, and factors such as the ability to pay large ransom
amounts.

Iran, China, and Russia’s influence activities involving the 2022 FIFA World Cup
are primarily being conducted through state-owned media organizations, which
emphasize and promote bilateral relations with Qatar. Iran and Russia have also
sought to highlight divisions and exacerbate tensions between Qatar and Western
countries that have been critical of the tournament being hosted in Qatar due to
human rights concerns in the country. Similarly, Iran’s “Endless Mayfly”
influence operation identified by Citizen Lab in May 2019 involved an instance
of disinformation around the 2022 FIFA World Cup, which sought to exacerbate
geopolitical tensions between Qatar and other Arab countries following the Qatar
diplomatic crisis in June 2017.

Qatar is unlikely to face a major physical security threat during the 2022 FIFA
World Cup based on a range of factors including: the country having minimal
terrorist incidents in recent years; the decreased capabilities of terrorist
groups most likely to target the tournament, including Islamic State in Iraq and
the Levant (ISIL) and Al-Qaeda in the Arabian Peninsula (AQAP); Qatar’s enhanced
security posture, bolstered by security assistance from countries such as the
US, United Kingdom, France, Italy, Türkiye, and Pakistan; and Qatar’s
geographical orientation.

KEY JUDGMENTS

 * Recorded Future has not identified any imminent, planned, or ongoing
   state-sponsored cyber operations targeting the 2022 FIFA World Cup in Qatar.
   Nevertheless, state-sponsored APT groups tasked with foreign intelligence
   collection likely view the 2022 FIFA World Cup as a target-rich environment
   for cyber espionage and surveillance.
 * Russia very likely harbors a strong set of grievances and has the greatest
   motivation to conduct a disruptive cyberattack against the 2022 FIFA World
   Cup, and there is historical precedent for Russia targeting major sporting
   events. However, Russian APT groups are unlikely to conduct a disruptive
   attack against the tournament due to their preoccupation with Russia’s war
   against Ukraine.
 * We cannot rule out that the Russian government will encourage or otherwise
   tacitly approve of disruptive attacks conducted by nationalistic Russian
   hacktivist groups or ransomware operators against the 2022 FIFA World Cup.
   Such attacks can provide plausible deniability for the Kremlin.
 * Cybercriminals are launching tournament-related phishing attacks using common
   lures such as so-called ticket giveaways to collect personally identifiable
   information (PII) from victims, including financial information like payment
   card details, or to distribute malware.
 * Iran and Russia have sought to highlight divisions and exacerbate tensions
   between Qatar and Western countries that have been critical of the tournament
   being hosted in Qatar. And the Iran-aligned group Endless Mayfly historically
   used the 2022 FIFA World Cup in an influence operation.
 * Qatar is unlikely to face a major physical security threat during the 2022
   FIFA World Cup, although unmanned aerial systems (UAS) represent a unique
   disruptive threat that Qatari authorities are working to mitigate with
   foreign security assistance.

STATE-SPONSORED CYBER THREATS

Large international sporting events such as the Olympic Games or the World Cup
are attractive targets for cybercriminals and state-sponsored APT groups alike
for either financial, disruptive, or espionage purposes. Such events are often
years in the making, involve the investment of billions of dollars in
infrastructure to support, bring the host country considerable prestige on the
international stage, and attract a wide range of spectators, including
high-level government officials and businesspersons. As a result, disruption of
the event can prove embarrassing for the host government and organizers, while
traditional intelligence-gathering-focused cyber-espionage and surveillance
activities are likely lucrative given the target-rich environment. To mitigate
this risk, travelers to Qatar for the 2022 FIFA World Cup should take additional
precautions around their digital communications such as using encrypted
communications applications whenever possible, exercising caution when
connecting to unknown and public Wi-Fi networks (including in hotels), and
considering the use of burner devices for the duration of the trip rather than
personal or corporate devices.

As of this writing, we are not aware of any imminent, planned, or ongoing
state-sponsored threat activity linked to known APT groups targeting the
upcoming 2022 FIFA World Cup in Qatar, its organizers (such as FIFA or the Union
of European Football Associations [UEFA]), its sponsors, or associated
infrastructure. This includes attacks that may be disruptive or destructive in
nature (such as distributed denial-of-service (DDoS) attacks or wiper malware)
or more espionage-focused operations. Additionally, we have not observed the
establishment of network infrastructure attributed to state-sponsored APT groups
intended to facilitate computer network operations against the World Cup or its
affiliate organizations or attendees. Similarly, we have not as of this writing
found weaponized lure documents for use in spearphishing attacks.

In this section, we review the likely motivators for state-sponsored APT groups’
targeting of the 2022 FIFA World Cup, with a focus on the most prominent
state-sponsored threat actors — those linked to China, Russia, Iran, and North
Korea. Overall, we assess that the Russian government is the most strongly
motivated to carry out disruptive attacks against the event, but is very likely
focusing its resources on supporting its war against Ukraine instead. And while
Iran, China, and North Korea all likely possess the technical capabilities to do
so, they are unlikely to pose a disruptive threat to the games as they lack the
motivation due to their relations with Qatar, their involvement in the planning
and execution of the games themselves, or other national priorities.

CHINA

Chinese state-sponsored APT groups are unlikely to target the World Cup and its
affiliates for the purposes of disruption of the event. Nevertheless, those
groups tasked with the collection of foreign intelligence, and particularly
those falling under the Ministry of State Security (MSS) — China’s primary
civilian intelligence service — are likely to view the World Cup as a
target-rich environment for cyber espionage and surveillance against foreign
dignitaries and businesspersons alike. Likely MSS-linked cyber-espionage groups
include, but are not limited to, APT10, APT17, APT27, APT40, APT41, TAG-22,
RedBravo, and RedDelta.

China and Qatar have enjoyed increasingly close relations in recent years, with
Beijing and Doha announcing cooperation on a host of regional and global issues
in defense, energy, and economic development, including Qatar's involvement in
Beijing’s marquee international development project, the Belt and Road
Initiative (BRI). Moreover, Chinese companies maintain a considerable presence
in Qatar, and the Chinese Railway Construction Corporation in 2016 won the bid
to build the largest World Cup venue, the Lusail Stadium, which was completed in
2020.

Significantly, there is no historical precedent for Chinese threat activity
groups targeting major international sporting events or sporting bodies, and
China has shown more restraint compared to other nations in conducting
wide-reaching destructive and disruptive attacks in general. Therefore, while
Chinese APT groups have regularly targeted specific organizations and
governments ahead of key talks, and Beijing’s cyber-enabled monitoring of ethnic
and religious minorities domestically and internationally is well-documented, it
is unlikely that China poses a disruptive threat to the 2022 FIFA World Cup.
This is made even more unlikely due to China’s direct involvement in developing
the infrastructure to support the event — giving it a vested interest in
ensuring that it unfolds smoothly — as well as Beijing’s desire to continue to
strengthen its relationship with Doha as a major strategic partner in the
region.

RUSSIA

The Russian government very likely harbors a strong set of grievances and thus
motivation for targeting the 2022 FIFA World Cup in Qatar. Russian activity
targeting the event would likely be disruptive in nature, or otherwise seek to
embarrass the international entities responsible for organizing the event such
as FIFA, UEFA, or international sponsors, both public and private.

Following Russia’s invasion of Ukraine in late February 2022, FIFA and UEFA
issued a blanket ban against Russian football clubs from competitions, including
the upcoming World Cup, in protest of the invasion. Subsequently, the Football
Union of Russia abruptly withdrew its appeal of the decision in early April,
resulting in the ban remaining in place.

Russian state-sponsored APT groups have a history of targeting international
sporting organizations and events beginning as early as 2016, likely in
retribution for similar bans of its athletes from participation in major
international events, such as the Olympic Games, due to a string of doping
scandals. Past Russian state-sponsored activity targeting such organizations
includes:

 * The Russian Main Intelligence Directorate’s (GRU) reconnaissance against the
   2020 Tokyo Olympics in an alleged effort to disrupt the event
 * Sandworm’s disruption of the 2018 Pyeongchang Winter Olympics with the
   Olympic Destroyer malware
 * APT28’s hack-and-leak campaign targeting the World Anti-Doping Agency (WADA)
   and Western athletes’ personally identifiable and personal health information
   (PII and PHI) during the 2016 Rio de Janeiro Summer Olympics
 * GRU operators targeting WiFi networks and routers at hotels used by
   anti-doping officials in Rio de Janeiro and Lausanne, Switzerland, deploying
   bespoke malware once they obtained access to a host of interest

While Moscow and Doha are engaged both diplomatically and economically with one
another, there are signs of significant strain in the relationship, especially
since Russia’s invasion of Ukraine. First and foremost, Qatar has expressed its
support for Ukraine and the territorial integrity of the country along its
internationally recognized borders. Moreover, the US formally designated Qatar
as a “major non-NATO [North Atlantic Treaty Organization] ally” in March 2022 —
a move that is very likely interpreted as signaling Qatar’s long-term strategic
alignment with NATO and Washington instead of with Moscow. As a result, the
Kremlin likely has a particularly strong grievance against Qatar and may view
the World Cup as an opportunity to embarrass Qatar’s government.

Nevertheless, despite having the motivation to conduct such disruptive attacks
against the World Cup and Qatar, the Russian government is very likely
distracted with the war in Ukraine, which has turned into a grinding conflict
requiring Moscow to marshal as many of the state’s resources as possible in an
attempt to achieve its strategic aims in the face of Ukraine’s staunch armed
resistance. It is therefore very likely that Russian APT groups that may
otherwise be tasked with disruption of an international event such as the World
Cup — especially those aligned with military intelligence such as APT28 or
Sandworm, based on historical activity — are instead tasked with prioritizing
operations that are directly in support of the war effort in Ukraine.

While we assess it is thus unlikely that established Russian state-sponsored APT
groups will conduct such disruptive operations against the World Cup, we cannot
rule out that the Russian government will encourage or otherwise tacitly approve
of such attacks conducted by nationalistic Russian “hacktivist” groups — such as
KillNet or XakNet — or by ransomware operators. Such groups, whether financially
or politically motivated, are useful proxy forces that can on occasion further
the Russian government’s strategic objectives and provide plausible deniability.

IRAN

While Iranian state-sponsored APT groups frequently target public and private
entities across the Middle East in both destructive and espionage-focused
campaigns, they are not known for executing hacktivist-like attacks against
international sporting federations. Moreover, due to the strong trade and
diplomatic ties between the 2 countries, Iran’s participation in the World Cup
despite calls for its banning, and due to domestic Iranian instability, it is
unlikely that Iran will seek to use cyberattacks to disrupt the games as doing
so provides no obvious benefit to the regime and risks upsetting a key regional
partner in Qatar.

This does not rule out Ministry of Intelligence and Security (MOIS)- or Islamic
Revolutionary Guard Corps (IRGC)-linked espionage activity in-country, however,
likely primarily directed against high-profile foreign attendees of the game and
dissidents and/or critics of the Iranian regime. Such groups, including APT34
OilRig, APT35, APT39, APT42, and MuddyWater are known to routinely carry out
espionage operations against Middle Eastern and Western governments and private
sector companies in support of Tehran’s economic, political, and military
objectives. APT35 has been reported to seek strategic and tactical information
and has also undertaken counterintelligence operations at the behest of the
IRGC, including in attacks against international conferences and related
organizations such as the Munich Security Conference and Think20 Summit in Saudi
Arabia. For its part, APT39 has also been reported to focus on
counterintelligence and long-term espionage activity with the goals of
protecting the regime.

Iran and Qatar have an abnormally close relationship given the latter’s
membership in the Gulf Cooperation Council (GCC) regional bloc, and Doha
carefully balances its alliance with the US and its economic and security ties
with Tehran. These ties only strengthened during and following the 2017 Qatar
diplomatic crisis in which Doha sought to replace its traditional trading
partners — who instituted an embargo against the country — with imports from
Iran and Türkiye. Qatar’s geographic position in the Persian Gulf, as well as
its sharing of the world’s largest natural gas field with Iran, induce the 2 to
closer relations despite Iranian discomfort with Qatar’s hosting of the largest
US military base in the region at Al Udeid. Relations between Iran and Qatar
have become so cordial that Iran offered — and Qatar accepted — assistance in
hosting hundreds of thousands of visitors to the World Cup on the resort island
of Kish, offshore of Iran, thus giving Iran an economic and political stake in
the success of the games.

Finally, Iran has in recent months been rocked by domestic instability and
widespread protests following the death of Mahsa Amini while in police custody.
The protests — the largest in over a decade — have turned violent, resulting in
the government issuing lockdowns of the information environment within the
country and cutting off the internet from the outside world, as well as
deploying security forces authorized to use lethal force to quell the unrest. In
order to preserve the regime, maintaining and stabilizing the domestic situation
is very likely to be the primary task of the Iranian intelligence and security
services in the near term. This suggests that little resourcing would likely be
devoted to externally oriented cyber operations during the World Cup, even if
Iran had the requisite motivation to do so.

NORTH KOREA

North Korean state-sponsored APT groups are unlikely to conduct disruptive or
destructive attacks against the upcoming 2022 World Cup in Qatar.

There is very limited precedence for North Korea-linked APT groups targeting
international sporting events or organizations. In the 1 instance in which this
was observed — in a campaign using the fileless malware “Gold Dragon” targeting
Olympics-related organizations in the period surrounding the 2018 Winter
Olympics in Pyeongchang, South Korea — the campaign appears to have been focused
on intelligence gathering, which is consistent with the majority of North Korea
state-sponsored cyber campaigns against the South and likely a part of their
routine operations.

Moreover, the majority of historical North Korean state-sponsored APT campaigns
have been focused on revenue generation for the regime in Pyongyang, which
continues to languish under strict international sanctions that limit its access
to global markets. These attacks have primarily consisted of compromises of
financial institutions, ATM cash-out schemes, or theft of cryptocurrency. Apart
from ransomware or other forms of extortion attacks, such as the WannaCry
campaign, disruptive or destructive attacks are difficult to monetize and thus
are likely of less interest and priority to the regime.

With respect to the 2022 World Cup, North Korea likely lacks the political
motivation to engage in disruptive or destructive activity against the games.
Pyongyang voluntarily withdrew from World Cup qualifiers in May 2021 likely due
to concerns over COVID-19, but unlike Russia was never formally banned from
participation by the organizing bodies. Moreover, Qatar has — at least until the
imposition of recent United Nations (UN) sanctions that went into effect at the
end of 2019 — been host to thousands of North Korean migrant laborers. Many of
these laborers were integral to the construction of the venues for the upcoming
World Cup games, including the aforementioned Lusail Stadium which was built by
a Chinese firm. Overall, Qatar has proven more willing than many governments to
continue some form of direct relations with North Korea, and Pyongyang is
unlikely to see a benefit to damaging relations via disruptive cyberattacks
against the World Cup.

CYBERCRIMINAL THREATS

As mentioned above, large international sporting events such as the 2022 FIFA
World Cup are attractive targets for financially motivated cybercriminals.
Cybercriminal threats to the 2022 FIFA World Cup include but are not limited to
tournament-related phishing attacks, fake mobile applications around the event
that can distribute malware and harvest user data, sales on dark web markets and
shops for counterfeit tickets, and threats of ransomware.

PHISHING AND FRAUD

Cybercriminals are leveraging the 2022 FIFA World Cup as a lure in phishing
attacks and in other fraudulent activities. Cybercriminals are almost certainly
creating fraudulent websites related to the 2022 FIFA World Cup that can be used
in phishing campaigns to collect PII from victims, including financial
information like payment card details, or to distribute malware.

Between October 31, 2021 and October 31, 2022, we identified:

 * 130 registered typosquat domains of fifa[.]com, 30 of which were created in
   October 2022 as the 2022 FIFA World Cup draws near
 * 143 registered domains that include the terms “Qatar” and “2022”, some of
   which are impersonating the official 2022 FIFA World Cup website,
   qatar2022[.]qa, such as in Figure 1
 * 889 registered domains that include the terms “World” and “Cup”
 * 56 registered domains that either include the terms ([“FIFA” or “Qatar”] and
   “Ticket”), or (“World” and “Cup” and “Ticket”).



Figure 1: Example of a typosquat domain impersonating the legitimate
qatar2022[.]qa website, with redirects to other suspicious websites (Source:
qatar2022[.]pro)

We identified 669 references to 2022 FIFA World Cup phishing campaigns between
October 31, 2021 and October 31, 2022. These phishing attacks have targeted both
organizations and individuals, though as the tournament approaches, phishing
attempts are very likely to focus on targeting individuals. Phishing attacks
targeting individuals relate to various components of the tournament, including:
tickets to the games (typically so-called “ticket giveaways; free streaming
services for when the tournament begins; betting websites; and
tournament-adjacent items like visas and travel, hotel, and restaurant bookings.
In November 2021, Kaspersky reported that they detected 11,000 phishing emails
between August 15 and October 15, 2021 primarily targeting organizations by
inviting bids on contracts to supply goods or services for the 2022 FIFA World
Cup, where recipients were asked to pay a commission to participate.

Another attack vector used by cybercriminals is creating fraudulent mobile
applications that impersonate legitimate ones, such as the “Hayya to Qatar 2022”
mobile application created by Qatar’s Supreme Committee for Delivery and Legacy
(Apple, Google Play). We identified multiple mobile applications posing as the
official 2022 FIFA World Cup application, with thousands of downloads. Although
we have not conducted an analysis of these mobile applications, we strongly
recommend that individuals only download official 2022 FIFA World Cup mobile
applications such as those created by Qatar’s Supreme Committee for Delivery and
Legacy and by FIFA.

DARK WEB ACTIVITY

We identified 277 references to the 2022 FIFA World Cup on dark web
special-access forums between October 31, 2021 and October 31, 2022. We observed
discussions of individuals claiming to be selling tickets to the 2022 FIFA World
Cup, as well as other individuals posting in an effort to purchase tickets. We
also observed an individual sharing the likely compromised login details of 2
accounts for beIN CONNECT, a state-owned global sport and entertainment network
headquartered in Doha, Qatar, with the individual stating “SAVE FOR WORLD CUP”.



Figure 2: Example of a post on a dark web forum advertising 2022 FIFA World Cup
ticket sales (Source: Recorded Future)

Another notable post includes an October 4, 2022 post on Cracked Forum by
“xAcordx” advertising a malicious .doc exploit file that is claimed to be fully
undetectable (FUD) by all antivirus solutions, that “can be sent via Gmail and
other popular email providers”, and that “downloads and executes any file when
ran [sic]”. The file is advertised at $600 for a single full FUD build, or
$2,400 for the builder allowing unlimited builds with a weekly update to
maintain its FUD status. The post advertises many different lures for the
document, including “world cup” and “world cup qualifying”, demonstrating that
the 2022 FIFA World Cup is being used as a lure in malicious documents. The
threat actor also includes in their listing a proof-of-concept video that
demonstrates the exploit’s functionality.



Figure 3: Exploit with features advertised by xAcordx (Source: Cracked Forum)

Furthermore, Recorded Future’s Identity Intelligence Module identified
credential leaks for 14 unique *@qatar2022[.]qa email addresses on both clearnet
and dark web sources, including 8 unique email addresses with associated
passwords. These credential leaks were included in database dumps including
GoNitro Database Dump, Cit0day Dump, ShareThis Data Dump, Zynga Data Dump,
Dropbox Credential Dump, and Qatar National Bank Data Dump, while other
credentials were stolen through infostealer malware such as Vidar. Credential
leaks can be abused by threat actors to obtain initial access into an
organization or to perform additional fraudulent activities such as social
engineering, spearphishing, and business email compromise (BEC). However, the
passwords associated with the email addresses in the aforementioned breaches
could be passwords for other websites where the owner used their qatar2022[.]qa
email address for a different online service, and are not necessarily the
passwords for the owner’s email account or corporate network. Using unique
passwords for each online service mitigates the risk that leaked credentials can
be used by threat actors to access more than 1 online service.

Finally, we identified 269 references to tickets[.]fifa[.]com and
hayyar[.]qatar2022[.]qa on dark web shops, specifically Russian Market, Genesis
Store, and 2easy Shop. These 2 domains are used to purchase tickets to the 2022
FIFA World Cup, and to apply for a Hayya Card, respectively. All tournament
visitors need a Hayya Card to be permitted entry to Qatar, for access to match
stadiums, and for free use of public transportation on match days. Visitors
applying for a Hayya Card need to provide their personal details. As explained
below, these dark web shops sell packages of compromised account details and
user logs; cybercriminal actors could purchase compromised account details from
these, and other, dark web shops and marketplaces that could lead to greater
theft of PII data and possibly match tickets.

 * Russian Market is a dark web shop operated by the threat actor RussianMarket
   that sells dumps, RDP and SSH access, logs, and various account details.
   Threat actors who purchase credentials typically log in to the accounts and
   perform malicious activities such as BEC, privilege escalation, and overall
   online identity takeovers due to extensive information about the source of
   the credentials and cookies being scraped from victims.
 * Genesis Store sells packages of compromised account credentials and
   associated user data designed to allow threat actors to bypass anti-fraud
   solutions. Victim data is sold in a single package referred to as a “bot”,
   which includes account credentials, IP address, browser fingerprint (system
   information), and cookies. After purchasing a bot, the victim data can be
   imported into a browser plugin called Genesis Security, allowing the attacker
   to masquerade as the victim to perform attacks such as account takeovers or
   card-not-present fraud. The price for each bot varies depending on the amount
   of account credentials, types of accounts, and geographical location of the
   victim
 * 2easy Shop sells stealer logs harvested from victims infected with
   infostealers. The prices for logs vary between $3 and $200 per listing and
   include compromised user logs and accounts from hundreds of organizations
   worldwide. When compromised data is purchased on 2easy Shop, a buyer
   typically receives a victim’s browser cookie data, browser history,
   screenshots, general system information about compromised machines, and other
   data. The compromised account credentials and associated user data are
   commonly used by threat actors to bypass targeted organizations’ defenses and
   anti-fraud solutions.

RANSOMWARE

We have not identified any specific threats made by ransomware groups
demonstrating intent to target the 2022 FIFA World Cup, though we would not
expect such conversations to appear in the open. Similar to what we described in
our report on Threats to the 2022 Winter Olympics, the 2022 FIFA World Cup may
be seen as an attractive target for ransomware attacks given the potential for
significant profit, as organizations involved in the tournament will want to
ensure the tournament goes as smoothly as possible. Potential targets could
include organizations that support the 2022 FIFA World Cup, including those in
the transportation, media, healthcare, logistics, and security sectors. However,
it is more likely that ransomware operators would seek to opportunistically
target victims based on accessibility, opportunity, and factors such as the
ability to pay large ransom amounts, as opposed to conducting a large-scale
coordinated attack. We have created dozens of Hunting Packages for ransomware
families that can be used to detect ransomware samples and behavior.

As discussed above, as a result of Russia being banned from participating in the
2022 FIFA World Cup due to their war against Ukraine and their strained
relations with Qatar, we cannot rule out that the Russian government will
encourage or otherwise tacitly approve disruptive attacks conducted by
nationalistic Russian “hacktivist” groups — such as KillNet or XakNet — or by
ransomware operators. Such threat groups, whether financially or politically
motivated, are useful proxy forces that can on occasion further the Russian
government’s strategic objectives and provide plausible deniability. We have
previously documented the ties between the Russian state and Russia-based
cybercriminals in our report “Dark Covenant: Connections Between the Russian
State and Criminal Actors”.

INFLUENCE OPERATIONS

As a result of Qatar’s unique geopolitical position, influence operations
involving the 2022 FIFA World Cup will likely attempt to “win over” Qatar by
emphasizing and promoting bilateral relations while creating and exacerbating
tensions between Qatar and the influencer’s adversaries. As discussed above,
Qatar maintains good relations with Iran and China, and previously had good
relations with Russia that have since been strained as a result of Qatar siding
with the coalition of countries supporting Ukraine’s territorial integrity.
Meanwhile, Qatar enjoys good relations with the US, UK, Germany, and many other
Western countries. Qatar also offers Europe an alternative to their dependency
on Russian gas exports during Russia’s war against Ukraine.

POSITIVE INFLUENCE

We have observed efforts by Iran, China, and Russia to emphasize their support
for Qatar in hosting the 2022 FIFA World Cup and to promote bilateral relations
through state-owned media outlets. For example:

 * Iran’s Mehr News Agency published an article on October 18, 2022 entitled
   “Iran calls for boosting Tehran-Doha economic cooperation”, citing “the
   readiness of the Islamic Republic of Iran to provide any kind of assistance
   for holding the 2022 World Cup in Doha”.
 * China’s Global Times published an article on October 24, 2022 entitled
   “China-Qatar relations exemplified in World Cup preparation, giant panda
   fostering, joint efforts in energy crisis: ambassador” following an interview
   with Qatar’s Ambassador to China Mohammed bin Abdullah Al Dehaimi.
 * Russia’s RT published an article on October 13, 2022 citing Putin’s support
   of Qatar hosting the 2022 FIFA World Cup, stating that Russia is “doing
   everything we can in terms of transferring [our] experience of preparing for
   the World Cup”, with the Emir of Qatar, Sheikh Tamim bin Hamad al-Thani,
   responding that “Russian friends have provided great support to Qatar,
   especially in terms of organization, with the organizing committee of the
   2022 World Cup … We thank you for this and we are proud of this
   relationship”.

NEGATIVE INFLUENCE

Western countries (including Germany, Denmark, France, and others) have been
critical of Qatar’s hosting of the 2022 FIFA World Cup, citing human rights
concerns in the country. This criticism presents an opportunity for adversaries
to highlight divisions and exacerbate tensions between Qatar and the West. We
have not observed China taking advantage of this opportunity, whereas Iran and
Russia have used state-owned media organizations to highlight Western criticism
of Qatar. For example:

 * Iranian state media highlighted multiple examples of Western countries
   criticizing Qatar due to human rights concerns, including: remarks from
   Germany’s Interior Minister Nancy Faeser; the Netherlands’ House of
   Representatives asking the Dutch government to not send a delegation (though
   the Dutch government ultimately decided to send a delegation); German
   football player Toni Kroos stating that he’s against the 2022 FIFA World Cup
   being hosted in Qatar; and more.
 * Russia’s RT also highlighted multiple examples of Western countries
   criticizing Qatar due to human rights concerns, including: multiple men’s
   football teams protesting with their football kits ; remarks from Germany’s
   Interior Minister Nancy Faeser; reports that some French cities will not be
   broadcasting the 2022 FIFA World Cup in public areas in protest against
   Qatar; and more.
 * Global Research’s French-language website, Mondialisation[.]ca, published an
   article on October 28, 2022 stating that Western countries have launched a
   campaign to criticize Qatar on “LGBT issues, or the conditions of foreign
   workers” because Qatar has “not bowed to Western pressure on gas supplies to
   replace Russian gas”. Global Research is a documented pillar of Russian
   disinformation and propaganda, and has previously “published or republished
   seven authors attributed by Facebook to be false online personas created by
   The Main Directorate of the General Staff of the Armed Forces of the Russian
   Federation, popularly known as the GRU”.
 * Both Iran’s Fars News and Russia’s RT France published articles on October
   25, 2022 citing the Emir of Qatar, who stated that Qatar has faced
   unprecedented criticism since winning the bid to host the 2022 FIFA World Cup
   and that the criticism included “fabrications and double standards that were
   so ferocious that it has unfortunately prompted many people to question the
   real reasons and motives behind the campaign".



Figure 4: Sentiment analysis of references to the 2022 FIFA World Cup on
Iranian, Chinese, and Russian state media sources (Source: Recorded Future)

ENDLESS MAYFLY

There is a particular precedent in Iran for using influence operations in an
attempt to sow discord between Qatar and its international partners and regional
neighbors, such as the Endless Mayfly influence operation uncovered by Citizen
Lab in May 2019. This influence operation was “an Iran-aligned network of
inauthentic websites and online personas” used to amplify geopolitical tensions
by spreading false and divisive information critical of Saudi Arabia, the US,
and Israel, among others, since at least early 2016.

The Endless Mayfly influence operation included 1 instance of disinformation
specifically involving the 2022 FIFA World Cup, namely that 6 Arab countries had
asked FIFA to strip Qatar’s right to host the FIFA World Cup in 2022. This
disinformation attempted to exacerbate geopolitical tensions between Qatar and
Arab countries following the Qatar diplomatic crisis in June 2017, whereby Gulf
countries and other Arab nations including Saudi Arabia, the United Arab
Emirates (UAE), Egypt, Bahrain, and others severed diplomatic relations with
Qatar, blaming Qatar for “[embracing] various terrorist and sectarian groups
aimed at destabilising the region”, including the Muslim Brotherhood, al-Qaeda,
Islamic State, and Iran-supported proxy groups within Gulf nations. The 1
instance of disinformation involving the 2022 FIFA World Cup was part of 11
inauthentic articles identified by Citizen Lab that aimed to exacerbate
Saudi-Qatar tensions.

Endless Mayfly’s disinformation campaign involving the 2022 FIFA World Cup
involved the creation of an inauthentic The Local article on July 15, 2017
alleging that 6 Arab countries had asked FIFA to strip Qatar’s right to host the
2022 FIFA World Cup. The inauthentic article was hosted on a lookalike domain,
telocal-xt3c[.]com, instead of thelocal[.]com. Reuters then published an article
on July 16, 2017 citing the inauthentic The Local article, with the heading
"Boycott nations demand FIFA strips Qatar of 2022 FIFA World Cup – report".



Figure 5: Reuters article citing the inauthentic The Local article involving the
2022 FIFA World Cup (Source: Reuters)

Then, an Endless Mayfly online persona, @Shammari_Tariq, published an article on
Buzzfeed Community, which allows for user-submitted content, amplifying the
story and citing the inauthentic The Local article and the Reuters article.
Another Endless Mayfly online persona, @GerouxM, published a story on Medium
reiterating the claim and citing the inauthentic The Local article. Furthermore,
after the Reuters article was published, several other media outlets such as
Global News, The Jerusalem Post, Bleacher Report, and Haaretz also reported on
the story, quickly propagating the disinformation to a wider audience.

PHYSICAL THREATS

Qatar is unlikely to face a major physical security threat during the 2022 FIFA
World Cup based on the event's substantive security apparatus and decreased
capabilities of global terrorist organizations. An externally directed terrorist
attack, while unlikely for reasons enumerated below, would have the greatest
potential impact, and unmanned aerial systems (UAS) represent a unique threat
vector for targeting attendees and disrupting the event. Qatar has taken steps
to mitigate this risk by bolstering its defenses and is receiving security
assistance from multiple countries for the duration of the 2022 FIFA World Cup,
particularly to defend against any UAS attacks.

TERROR TACTICS AND UAS

Terrorist attacks typically use unconventional methods to inflict casualties,
disrupt societies, and damage economies. These tactics vary based on the
environment in which the terrorists operate, but have included solo knife
attacks, coordinated small arms operations, suicide bombings, vehicle ramming,
and UAS, including so-called “suicide drones”. The use of UAS represent a
potentially significant evolution in terrorist operations since it utilizes
commercial off-the-shelf technology readily available in many countries, which
can be modified to deploy explosive payloads or perform target reconnaissance.
UAS may also be operated beyond line of sight, enabling operators to control
them from a place of relative seclusion. More advanced UAS –– such as those
reportedly supplied by Iran to the Ansar Allah (Houthis) movement for use
against the Saudi-led coalition in Yemen –– are capable of traveling long
distances and could reach Qatari territory. Even unarmed UAS can pose a threat
to critical infrastructure, as demonstrated by the standstill created by UAS
flying near London’s Gatwick Airport in December 2018 and Dubai Airport in 2016
and 2019.

Qatar has faced minimal terrorist attacks in recent years. According to the US
Department of State, there were no reported terrorist incidents in Qatar in 2020
(the most recent year they published such data) or 2019. Recorded Future’s
Geopolitical Intelligence Module did not identify any notable references to
terrorist attacks in Qatar in the last 3 years. There have also not been any
recent UAS attacks against Qatar. However, the Houthis have used UAS against
targets in nearby Saudi Arabia and the UAE in the past few years. For example,
the Houthis launched UAS attacks against the UAE as recently as January and
February of 2022, and have regularly targeted critical infrastructure in Saudi
Arabia including oil facilities and pipelines and airports. Islamist terrorist
groups such as ISIL have also used UAS, and the United Nations’s top official on
counter-terrorism, Vladimir Voronkov, reportedly told the UN Security Council in
August 2022 that ISIL “has also significantly increased the use of UAS in the
past year, including reported [sic] in northern Iraq”.

TERRORIST GROUPS

In June 2017 several Arab countries, including but not limited to Saudi Arabia,
the UAE, Egypt, Jordan, and Bahrain, broke diplomatic ties with Qatar, accusing
Qatar of embracing “various terrorist and sectarian groups aimed at
destabilising the region”, including the Muslim Brotherhood, al-Qaeda, ISIL, and
groups supported by Iran in Saudi Arabia’s eastern province of Qatif. This
rupture came after years of similar concerns expressed in the US by
Congressional members, Treasury Department officials, and foreign policy
experts. Relations between Qatar and its fellow Gulf countries began to be
restored in January 2021, and the US government has partnered with Qatari
counterparts to stem the flow of terrorist financing on the Arabian peninsula,
indicating that Doha is taking steps to address these concerns. Nevertheless,
Qatar’s unique geopolitical position, as discussed in the Influence Operations
section of this report –– particularly its good relations with Iran –– likely
contributes to the lack of terrorist attacks that have affected Qatar.

Although an externally directed terrorist attack against the 2022 FIFA World Cup
is unlikely, the event does present an opportunity for a symbolic strike against
a gathering that represents global cooperation and a relationship between
Western countries and Muslim-majority and Arab nations. We note that an attack
on the World Cup aligns with historic targeting objectives of the following
terrorist organizations and actors:

 * ISIL — Since the collapse of its caliphate under a US-led military campaign
   in March 2019, followed by the subsequent death of its founder, Abu Bakr
   al-Baghdadi, ISIL has endured a steady decline in its operational capacity,
   but still likely retains the capability to coordinate or inspire an attack on
   Qatari soil. Although ISIL has not conducted a large-scale external attack
   outside of the Levant since the 2019 Easter bombings in Sri Lanka, the 2022
   FIFA World Cup would likely be a target of interest for the organization.
   This assessment is based on the high-profile nature of the event, which will
   draw numerous political delegations from major Western countries that ISIL
   has attacked previously, as well as threats ISIL has issued against the
   Qatari government for a number of perceived sins. These grievances include:
   hosting US and other foreign forces at Al Udeid air base; supporting the
   Iraqi Awakening Movement; and collaborating with the Iranian government, the
   IRGC, and Hezbollah (delivered in a May 2020 audio statement by the former
   ISIL spokesman, Abu Hamza al-Qurashi, and published in an article in a June
   2020 edition of Al-Naba). Also, an infographic in the most recent edition of
   Islamic State Khorasan Province (ISK)’s Voice of Khurasan magazine celebrated
   the recent death of Doha-based Sheikh Yusuf al-Qaradawi and denounced his
   service to the “Taghut of the at-Thani’s house in Qatar” –– using the same
   derogatory term that ISK reserves for the Taliban, its primary antagonist in
   Afghanistan.

 * AQAP — AQAP represents the Al-Qaeda branch that is most capable of conducting
   an operation targeting the 2022 FIFA World Cup, although operational
   limitations imposed by Yemen’s intractable civil war very likely will reduce
   AQAP’s ability to launch such an attack. As noted by a recent UN Security
   Council report, despite battlefield setbacks in recent years, AQAP remains a
   serious threat in Yemen and seeks to reconstitute its ability to conduct
   international operations. However, the realities of fighting a multifront war
   against the Houthis, Saudi-led coalition forces, and members of the Islamic
   State’s Yemen affiliate have required AQAP to retrench significantly. Aside
   from 2 attacks in 2019, occurring in Saudi Arabia and the US, the group has
   focused its operations on targets within Yemen –– indicating that the World
   Cup presents an unlikely target.

 * Lone Wolves — Despite not sending a significant number of foreign fighters to
   Iraq and Syria during the rise of ISIL’s self-declared caliphate (and thus
   having a limited rate of returnee extremists), Qatar contends with an
   elevated risk of domestic violent extremism; a lone wolf attack targeting the
   World Cup is thus a possibility, although such an event is unlikely. In 1
   social media study conducted in 2014, 47% of Qatar-based social media posts
   about ISIL expressed positive sentiment, a significant deviation from the
   much lower percentages found across Europe and the Middle East. Although the
   US Department of State believes Qatar is making strides in addressing violent
   extremism, its most recent country report pointedly observed that
   state-supported intolerance, sectarianism, and violence is still found in
   textbooks and disseminated through media.

SECURITY DEFENSES

Qatar has enhanced its own security in the lead-up to the 2022 FIFA World Cup.
The government plans to use its own drones to enhance surveillance and security
patrols, and the Qatari government reportedly deployed 32,000 government
security forces and 17,000 private security forces during a 5-day security
exercise across the country in October 2022, indicating the scale of Qatar’s
security defenses. Furthermore, Qatar is receiving security assistance from
multiple countries for the duration of the 2022 FIFA World Cup, including:

 * The US: the US made a number of commitments “to strengthen Qatar’s event
   security, port security, screening, contraband interdiction, and risk
   management capabilities”, such as helping Qatar “to identify air passengers
   linked to terrorism and trafficking of narcotics, weapons, currency, and
   people”. The New York Police Department also met with Qatar’s police forces
   to exchange expertise. More recent memorandums of understanding have been
   signed between the US and Qatar on defense cooperation around the 2022 FIFA
   World Cup.
 * The UK: the Royal Air Force (RAF) and Royal Navy “will support Qatar with
   military capabilities to counter terrorism and other threats to the
   tournament” including “maritime security support from the Royal Navy,
   advanced venue search training, operational planning and command and control
   support, and further specialist advice”.
 * France: France is sending around 220 police officers to provide “high-level
   expertise and specialised logistical support”. The officers primarily consist
   of anti-drone policing, in addition to bomb-disposal experts, sniffer dogs,
   anti-terror police, and police offers specialized in tackling football
   hooliganism. Other French support reportedly includes “a BASSALT anti-drone
   system that detects and identifies incoming drones” and an E-3F Airborne
   Warning and Control System (AWACS) aircraft.
 * Italy: the Italian Air Force is “deploying a Counter-Unmanned Aerial
   Anti-Drone Task group to further support the Qatari Armed Forces' defense”
   against UAS, with Italian armed forces troops being stationed in the country
   during the tournament.
 * Türkiye: Türkiye is providing 3,000 riot police, 100 special operations
   police, 50 bomb specialists, and 80 sniffer dogs and riot dogs to Qatar.
 * Pakistan: Pakistan is sending an army contingent to provide security during
   the tournament.
 * Jordan: Jordan expressed its willingness to assist with security at the 2022
   FIFA World Cup, with reports stating that as many as 6,000 ex-Jordanian
   soldiers were hired into security jobs for the tournament, some of whom have
   allegedly returned to Jordan after a salary dispute.

An additional mitigating factor decreasing the threat of terrorism to the 2022
FIFA World Cup is Qatar’s geographical orientation. Qatar only shares 1 land
border with Saudi Arabia and is a peninsula in the Persian Gulf. The border with
Saudi Arabia is isolated, has a flat desert topography, and is small enough for
security forces to control. While the borders of Bahrain and the UAE are only
roughly 10 to 20 miles across the Persian Gulf, these countries, like Saudi
Arabia, have cordial relations with Qatar and are not primary incubators of
terrorist groups that would seek to target Qatar. A lack of accessible ingress
opportunities for terrorist organizations into Qatar, along with Qatar's
security defenses discussed above, mitigate (but do not eliminate) the threat of
terrorism to the 2022 FIFA World Cup.

OUTLOOK

Qatar’s unique geopolitical position on a contentious global stage means it’s
unlikely that state-sponsored APT groups from China, Russia, Iran, and North
Korea will conduct a disruptive attack against the 2022 FIFA World Cup, despite
Russia having the greatest motivations for doing so. Instead, nationalistic
Russian hacktivist groups or ransomware operators could conduct disruptive
attacks against the tournament, which as previously noted can provide the
Kremlin with plausible deniability.

Cybercriminal phishing attacks are almost certainly going to continue throughout
the 2022 FIFA World Cup tournament, before dispersing after the tournament
concludes. It’s very unlikely that tournament-themed phishing attacks targeting
businesses will continue to use lures that invite victims to bid on contracts or
supply goods or services to the tournament given that the tournament begins
soon.

It is very likely that Iran and Russia will continue to highlight divisions and
exacerbate tensions between Qatar and Western countries that are critical of the
tournament being hosted in Qatar, while also promoting their own bilateral
relations. Furthermore, Iran, China, and Russia are likely to use the 2022 FIFA
World Cup in future influence operations as an example of where the West has
sought to impose “Western values” on other countries.

Finally, Qatar is unlikely to face a major physical security threat during the
2022 FIFA World Cup based on the factors explained above. Although Iran, China,
Russia are emphasizing and promoting bilateral relations with Qatar through
discourse, countries like the US, UK, France, Italy, Türkiye, and others are
providing material security assistance to Qatar for the tournament. This
security assistance, building on other security cooperation, in addition to the
US formally designating Qatar as a “major non-NATO ally” in March 2022, is
likely to lead to further security cooperation between Qatar and Western
countries.

The sources used in this report are the Recorded Future® Platform and open
sources.



RELATED BLOG

Blog

SHELL NO! ADVERSARY WEB SHELL TRENDS AND MITIGATIONS (PART 1)

Posted: 30th Jun 2016
Blog

THE ART OF DEFENDING YOUR ATTACK SURFACE

Posted: 15th Nov 2023
Blog

VETERANS DAY: CELEBRATING STORIES OF SERVICE AND SUCCESS

Posted: 9th Nov 2023


ABOUT US

 * Intelligence Cloud
 * Services & Support
 * Why Recorded Future
 * Research
 * Resources
 * Company

HELPFUL LINKS

 * Careers
 * Contact Us
 * Get a Demo
 * The Intelligence Graph

--------------------------------------------------------------------------------

JOIN US ONLINE

 * 
 * 
 * 
 * 
 * 

READY TO JOIN?

Contact us today

Copyright © 2023 Recorded Future, Inc.
 * Security FAQ
 * Cookies
 * Privacy Policy
 * Terms & Conditions