Reactions to Paris Olympics Cyber Threats

Paris’ hosting of the Olympics has brought with it 2024-levels of cyber threats. In this post, industry leaders comment on the situation…

Gabriella Sharadin – Cybersecurity Threat Researcher at Imperva

The surge in cyber threats is a clear indication of the malicious intent to exploit this global event. The staggering increase in vulnerability scanning and DDoS attacks underscores the need for robust cybersecurity measures. Our focus must be on protecting the digital infrastructure and sensitive data to ensure the safety and integrity of the Games.

Imperva (a Thales Company) has identified a 770,000% increase in vulnerability scanning activity on Olympic-related sites from June to July 2024,  indicating a surge in malicious intent and heightened risk of cyber-attacks designed to exploit this year’s global event.    

Historically, the Olympics have been a prime target for cybercriminals, state-sponsored actors, and hacktivists. Primary targets during the Olympics typically include official websites, live streaming services, ticketing systems, and critical infrastructure such as transportation and power grids – and this year is no exception. 

Imperva’s Threat Research team has identified 6 types of attacks to watch out for during the Paris 2024 Games: ransomware attacks, state-sponsored espionage, DDoS attacks, insider threats, social engineering and phishing, and supply chain attacks

Key threats identified by Imperva include: 

• 770,000% Increase in Vulnerability Scanning: From June to July, vulnerability scanner activity on Olympic-related sites has surged by an astonishing 770,000%, indicating a significant rise in malicious interest. (See chart below) 

• Rise in Automated Tool Usage: There has been a notable increase in the use of automated tools on these sites, leading to attempted data leakage, Remote Code Execution (RCE), and Distributed Denial of Service (DDoS) attacks.
  
  
• DDoS Attack Frequency: DDoS attacks on Sports and Travel websites have increased by 230% and 31%, in the run up to the games.
  
    
• Social Engineering Attacks: Social engineering attacks are particularly prevalent during high-profile events due to their widespread recognition and the public’s heightened interest. Paris2024.exe has been making rounds, leveraging the official Paris Olympics logo and name to deceive victims into trusting and executing the malicious software.  

Chaim Mazal – Chief Security Officer at Gigamon

Global events are particularly vulnerable due to the rise of geopolitical tensions. Whenever nation-states have a reason to stir the pot, it is essential to take extra precautions. Furthermore, in the last 12 months, only 1 in 3 organisations were able to detect they’d been breached, which is particularly concerning amid the Olympic organising committee’s announcement that cyber threats will increase tenfold this summer.

So where does the risk arise? One area, in particular, is from cloud-based streaming services. In a new era of live TV, enabling viewers to watch on-demand on any device in any location, bringing additional traffic to the organisation’s networks when viewed on a work device or network. However, with any cloud-based service comes risk. All cloud traffic is automatically encrypted and despite its good intent to keep data safe, research has found that 93% of malware hides behind encrypted traffic. Once a threat actor breaches perimeter security, they hide behind encrypted traffic for weeks or even months making visibility into all network traffic essential. This includes North to South traffic – traffic that flows from outside to inside an organisation and East to West traffic – traffic traversing laterally within the organisation enabling threat actors to hide and locate sensitive data wherever it may live in the network.

An example of how this could play out is through social engineering techniques where a threat actor may leverage a phishing campaign to manipulate a user to click a link to watch highlights from a team or athlete’s latest routine/match etc. In reality, once clicked it opens the door to the user’s information and potentially many doors after that, including their company’s network the next time they log into its virtual private network (VPN) or access the company’s Wi-Fi. When it comes down to it, risk is inevitable, however, visibility into all data in motion can be the difference maker between a bad actor walking away with highly sensitive data or being caught in their tracks before successful exfiltration.

Last Updated on August 2, 2024 by Nick Ross