Organisations linked to the Paris Olympics 2024 have an elevated danger of cyber assaults, together with ransomware, credential leaks and phishing campaigns, a research has discovered.
Insikt Group, the menace analysis division of safety agency Recorded Future, has already noticed posts promoting entry to Video games-related organisations in France and compromised credentials utilizing “paris2024[dot]org” domains on the Darkish Internet.
These findings have been revealed in a new report highlighting high-priority threats to the Video games, primarily based on an evaluation of previous assaults, present threats and geopolitical context.
Corporations in industries like hospitality and transportation usually tend to pay a ransom cost through the Olympics as a result of they are going to be dropping extra enterprise than regular throughout any downtime. Consequently, cyber attackers will see the Olympics as a profitable alternative, the report claims.
“The underlying aim of a ransomware assault is to elicit a ransom cost, and also you usually do this by way of a way of urgency,” Alexander Leslie, Menace Intelligence Analyst at Recorded Future, informed reporters in a webinar. “That sense of urgency goes to have actually heightened expectations and worldwide consideration almost about the Olympics.”
However it’s not simply organisations in danger, because the authors of ‘Hurdling over Hazards: Multifaceted Threats to the Paris Olympics’ say that attendees will “nearly definitely” be focused with Olympics-related phishing schemes.
TechRepublic takes a better take a look at the very best precedence cyber threats to the 2024 Paris Olympics recognized within the report.
Ransomware attackers goal corporations linked to Paris Olympics
The report authors “anticipate to see cybercriminals benefit from the pressures dealing with a number metropolis to extort ransomware payouts.”
Corporations concerned within the operating of the Video games — suppliers, sponsors and different “low-hanging fruit,” based on Leslie — will likely be underneath elevated strain to keep up excessive and steady ranges of service. They are going to be concerned in sectors resembling hospitality, transportation, logistics, healthcare and authorities.
These corporations will even not be used to the demand that can include new visibility and the arrival of 15 million vacationers, in contrast to main organisers, the Worldwide Olympic Committee and Worldwide Paralympic Committee, and suppliers Olympics infrastructure.
SEE: 94% of Ransomware Victims Have Their Backups Focused By Attackers
Moreover, the variety of corporations opting to pay the ransom when struck by ransomware is presently declining, with the common payout lowering by 32% from This fall 2023 to Q1 2024. Consequently, cyber criminals are extremely motivated to launch a profitable assault.
These two components compounded imply that the danger of ransomware assaults for organisations related to the operating of the Video games is excessive, as attackers will seize the chance for a payday.
“Whether or not that be disruptive or harmful, the downtime with that ransomware assault will inherently have an effect on the operations of the Olympics,” Leslie mentioned throughout a webinar.
Nonetheless, whereas the danger of ransomware assault is excessive, the extent of disruption will “fluctuate primarily based on the vital position performed by the focused organisation,” and there may be “nearly no probability of a whole halt of the Paris Olympics” as a consequence of a single cyber occasion, based on the report authors. It’s because a lot of the organisations and processes underpinning the Video games function individually from each other, so there gained’t be a domino impact of disruption.
Ransomware types a part of double extortion
Leslie informed reporters in a webinar: “Given the sense of urgency and the tight timeframe to elicit a ransom cost, we’d seemingly see extra extortion strategies going together with a ransomware marketing campaign.”
Menace actors is not going to solely demand cost in return for restoring entry to the corporate’s information, but additionally threaten to leak it both to the Darkish Internet or publicly as extra leverage as a part of a double extortion assault. Leaking the knowledge might put the enterprise and the Video games prone to additional cyber assaults, monetary penalties from regulatory our bodies and vital reputational injury.
Different types of extortion the ransomware assault may very well be paired with embody web site defacement, doxxing, distributed denial of service and govt harassment. The extra impacts of those double extortion assaults put much more strain on the businesses to pay the ransom.
Preliminary entry brokers promoting distant entry to corporations linked to Paris Olympics
The Insikt Group analysts consider the “elevated urge for food” for a profitable ransomware assault on organisations related to the Paris Olympic Video games will result in extra exercise from preliminary entry brokers.
IABs are specialised menace actors that promote distant entry to compromised company networks on Darkish Internet boards and through non-public communication channels like Telegram. Ransomware operators, or different menace actors, should buy entry to organisations related to the Video games from IABs to stage their assaults.
SEE: Preliminary entry brokers: How are IABs associated to the rise in ransomware assaults?
Between the beginning of the 12 months and April 29, 2024, Insikt Group monitored 17 menace leads for commercials of preliminary entry strategies for French entities and 14 for Video games-related industries in France. “These embody sporting organisations, athletic items producers and sporting groups inside international locations which can be collaborating within the Olympics,” Leslie mentioned within the webinar.
“It is a vital improve from not solely This fall of 2023, however the earlier 12 months.”
These listings have been discovered on the Darkish Internet and in boards and included entry to distant desktop protocol methods, internet shells, File Switch Protocol Safe and a buyer relationship supervisor system with administrator privileges.
Leaking of credentials affecting Paris Olympics
Insikt says that “the amount and worth of credentials affecting the Paris Olympics will seemingly improve within the months previous the occasion, to fulfill menace actor demand.”
Compromised credentials, obtained both from infostealer malware or Darkish Internet information dumps, are one of many most important methods menace actors acquire entry to a goal organisation’s system. They can be utilized to stage social engineering campaigns, enterprise e-mail compromise, spear phishing or different assaults, which, if profitable, can enable lateral motion throughout an organisation’s community.
Leslie mentioned through the webinar: “Compromised credentials can goal staff, they’ll goal members, they’ll even goal spectators; folks which can be attempting to simply purchase tickets for the Olympics.”
Between January 1 and April 29 this 12 months, analysts recognized 624 references to compromised credentials of Paris Olympics staff on Darkish Internet retailers and marketplaces. “It is a marked improve from final 12 months and a major improve in solely the final month,” Leslie mentioned.
Domains included olympics[dot]com, paris2024[dot]org and paralympics[dot]org, and the log-in data of an e-mail account “seemingly associated to a present worker” of the Worldwide Olympic Committee.
Phishing scams directed at Paris Olympics attendees and related corporations
“Olympic-themed phishing lures and scams will nearly definitely goal companies and attendees alike,” the authors wrote.
Attackers will disseminate malware through e-mail and textual content messages that harvest credentials or different personally identifiable data. Messages will embody the “use of pressing language in emails, the impersonation of executives or distributors, and the usage of malicious web sites posing as distributors or ticketing methods.”
SEE: Spear Phishing vs Phishing: What Are the Primary Variations?
Leslie mentioned through the webinar: “Within the final three months, we’ve recognized over 1,400 references to phishing domains concentrating on the Olympics, each inside France and world wide.”
These embody typosquat registrations of Olympic Video games domains, the place phrases have been intentionally misspelt to direct these in search of a reputable web site to a rip-off model within the occasion of a spelling mistake.
Mitigation ideas for Paris Olympics cyber threats
The report’s authors have supplied some mitigations that organisations referring to the Paris Olympics can take to decrease their danger of cyber assault:
- Guarantee complete visibility of the organisation’s assault floor with a menace intelligence platform. Take note of alerts, automate remediations and observe the menace panorama.
- Establish infostealer logs and credential leaks associated to your organisation and monitor IAB commercials to forestall account takeovers, information theft, ransomware and different assaults.
- Detect and take down area and model impersonations that may very well be used to rip-off clients or third events.
- Elevate consciousness of phishing inside the firm and prioritise the patching of high-risk vulnerabilities.
- Monitor the geopolitical atmosphere for occasions that might alter adversarial nations’ intent to conduct cyber intrusions towards the Paris Olympics.
“Organisers and related stakeholders should give attention to an adaptive safety technique that takes into consideration the geopolitical menace panorama in addition to the capabilities of varied teams,” the authors wrote.
“Monitoring the evolution of cyber and affect menace actor TTPs and adoption of latest applied sciences guaranteeing strong cyber defences amongst all organisations concerned within the Paris Olympics from the IOC to public transportation, and fostering worldwide cooperation in intelligence-sharing will likely be vital to making sure the seamless operating of the Paris Olympics.”
