Dark web shows cybercriminals ready for Olympics

Anti-Olympics messages are spread on fake news sites. — Photos of Fortinet

HÀ NỘI — Fortinet, the global cybersecurity leader driving the convergence of networking and security, warns that vigilance is required as the Paris games are being targeted.

According to its latest analysis, major sporting events like the World Cup, the Super Bowl and Wimbledon attract millions, even billions, of viewers.

Argentina’s shootouts win over France in the final game of the Qatar 2022 World Cup reached a global audience of 1.5 billion viewers. The Olympics, starting later this month in Paris, is the biggest of them all – with the 2020 Tokyo Olympics having attracted a worldwide audience of over three billion viewers.

These events are also prime opportunities for cybercriminals. Over the past decade, the number of cyberattacks targeting major events has surged, increasing from 212 million documented attacks at the London 2012 Games, to a staggering 4.4 billion at the Tokyo 2020 Games.

These attacks often have direct financial motives, such as scams, digital fraud, or the acquisition of valuable data from attendees, viewers and sponsors. In their excitement, eager fans often overlook potential risks when purchasing tickets, arranging accommodation or buying memorabilia, making them easy targets for cybercriminals.

Web scams impersonating the Paris Olympics can be found easily on the internet.

Others, desperate to view specific events, are enticed by malicious websites offering free access, only to have their devices compromised or personal data stolen. And with the world’s media focused on the event, criminals with a political agenda are looking for a large audience for their message by disrupting a significant site or knocking critical services offline.

Threat actors targeting the Paris 2024 Games

According to new FortiGuard Labs analysis based on threat intelligence provided by FortiRecon, this year’s Olympics has been a target for a growing number of cybercriminals for over a year. Using publicly available information and proprietary analysis, this report provides a comprehensive view of planned attacks, such as third-party breaches, info stealers, phishing and malware, including ransomware.

FortiGuard Labs has observed a significant increase in resources being gathered leading up to the Paris Olympic Games, especially those targeting French-speaking users, French government agencies and businesses, and French infrastructure providers.

Notably, since the second half of 2023, a surge was found in darknet activity targeting France. This 80 per cent to 90 per cent increase has remained consistent across the second half of 2023 and the first six months of 2024. The prevalence and sophistication of these threats are a testament to the planning and execution of cybercriminals, with the dark web serving as a hub for their activities.

FortiGuard Labs also witnesses a rise in advertisements for phishing kits and exploit tools customised specifically for the Paris Olympics.

The FortiGuard Labs team has also documented a significant number of typosquatting domains registered around the Olympics that could be used in phishing campaigns, including variations on the name (oympics[.]com, olmpics[.]com, olimpics[.]com, and others). These are combined with cloned versions of the official ticket website that take you to a payment method where you don’t get a ticket and your money is gone.

In collaboration with Olympic partners, the French Gendarmerie Nationale has identified 338 fraudulent websites claiming to sell Olympic tickets. According to their data, 51 sites have already been shut down and 140 have received formal notices from law enforcement.

In short, in addition to celebrating athleticism and sportsmanship, the Paris Olympics 2024 is a high-stakes target for cyberthreats, drawing attention from cybercriminals, hacktivists and state-sponsored actors. Cybercriminals are leveraging phishing scams and fraudulent schemes to exploit unsuspecting participants and spectators. VNS