Name: World Cup Threat Briefing: Preparing for Cyber, Physical, and Influence Risks
Uploaded: 2026-06-04T15:31:31.090Z
Duration: 1 h 2 min 24 s
Description: World Cup Threat Briefing: Preparing for Cyber, Physical, and Influence Risks

Transcript for "World Cup Threat Briefing: Preparing for Cyber, Physical, and Influence Risks": Hi, everyone. Thank you so much for joining today for our webinar on threats to the twenty twenty six FIFA World Cup. I'm going to start with a few housekeeping items. This webinar is being recorded, and all registrants will receive this recording via email after the live session has concluded. You will find additional resources that we will reference throughout this webinar under the docs tab as well as popping into the chat throughout. So without further ado, let's get started with a situational overview. This year, the World Cup will be held in 16 different cities across Canada, The United States, and Mexico. Each site has a unique security profile that offers unique challenges to the officials responsible for ensuring the safety of players, fans, vendors, and support staff at the games. On top of the usual challenges posed by any large event, the World Cup is the biggest sporting event in, well, the world. In 2022, the last World Cup, 1,500,000,000 people worldwide watched the championship game between Argentina and France. With that kind of attention, it's no wonder that the games also attract the attention of threat actors who are seeking to exploit the games for criminal or political gain. To help us make sense of this complex landscape, Insec Group published a report today called Threats to the twenty twenty six FIFA World Cup. This report covers a broad range of threats from physical security, cyberattacks, criminal activity, and influence operation. Today, we have three experts from Insec Group who contributed to this report to tell us a bit more about those threats in detail. We also have Maciej, our sales engineer, who is going to go through how you can use Recorded Future platform to track these threads for yourself. So without further ado, let's kick this off and have our panelists introduce themselves. Alex, why don't we start with you? Hi, everyone. My name is Alex Reid, and I primarily research cybercriminal threats such as ransomware and hacktivism. That's my contribution to this report. Excited to be here with you all today. Hey. Good morning. Good afternoon. Good evening. My name is Brian List, and I'm a senior intelligence analyst at Instigroup, focusing on influence operations and physical security. Good morning all, my name is Paul Kreher. I'm a Principal Threat Intelligence Analyst for Insync Group and I help the whole team with the APT tracking sector. Thank you. And my name is Maciej Martek. I'm a principal sales engineer in Recorded Future based out of Krakow, Poland, and I will have a pleasure to demonstrate some of the product features during these days. Webinar. Great. And I'm Megan, also a senior threat intelligence analyst with Insec Group focusing on emerging threats and risk insights. So before we get into discussing the threats in more detail, I want to share a brief poll, that you can respond to just to kind of get a sense of what are you most concerned about in terms of security around the World Cup. So please feel free to take a few moments to answer the polling question. We are going to be covering all of these, threats in some capacity. K. Great. So pretty close between cyberattacks and cybercrime. I'll leave this open for a few more minutes as we start to pivot into some of the first questions for our panelists. So this is going to be for everybody. As we are looking at threats to the World Cup, as you were putting together the report, what kinds of things were you looking at in your area of expertise? And, Brian, why don't we start with you for that? Yeah. Thanks, Megan. So, in terms of, my area of research, I can answer this on on basically two different tracks, physical security and then influence operations. On the physical security side, three things namely, organized crime, which is dominant in Mexican host cities, as well as you have also transnational criminal organizations that drive theft, extortion, kidnapping, and the potential for disruptive activities such as, like, road blockades. Number two, will be terrorism and violent extremism. And especially in The US, we're watching soft targets, fan zones, transit hubs, lodging, more than your hardened venues, which are basically the stadiums that are holding the matches themselves. And the number three is civil unrest, which is very likely in most cities, and matters most for travel disruption, logistics, or or potential clashes with police, security forces, and so on. On the influence operation side, what what we're looking at right now is whether activity is is overt, meaning state media, diplomatic sources versus covert, you know, personas on social media or so on, and how that how that landscape is shifting. Right now across Russia, China, Iran, we're seeing overwhelmingly overt content, and only with covert networks playing a very limited or an opportunistic role. So the the themes that I'm tracking are they're you know, they they own covert networks. They tend they can they can pivot, on on any kind of given time. They're very agile, which is gonna be something it'll be a bit of a theme for this. But but they're what we're trying to track is, you know, legitimate, authentic discourse from over media versus some of the organic over content for a coordinated influence operation. Sorry, Megan. I believe that it was you were calling on me at this point. So thank you very much for, making mention here. The, the thing that we were looking for on the cyber side is, essentially, keeping a very close eye on the Iran and Ukraine conflicts as they continue to influence our considerations, especially how they may impact, the FIFA event, obviously down the line. The World Cup is one of the largest international sporting events, as you obviously mentioned before, that brings together government officials, businesses, media organizations, and generally just very large audiences. So this provides, for the cyber perspective, the state sponsored perspective, opportunities for espionage, surveillance, and disruption. And now we assess that essentially to be the greatest threats, from that perspective do emanate from Iran, Russia, and China. But also I'd like to mention that, the role of nationalist or ideologically motivated, cyber threat actors, so some would call them lone wolves, their ability to impact the sporting teams themselves, the athletes if they're very targeted, or even their related organisations, and we'll just discuss that a little bit later. Thank you. Great. Thank you. Alex, would you like to give us an overview of the criminal and hacktivist threat? Yeah. Of course. So on the cybercrime side, we are tracking consumer fraud and phishing infrastructure, compromised credentials and ticket fraud schemes and dark web marketplaces, and, ransomware and extortion activity targeting either FIFA and football related organizations as well as, corporate sponsors and other critical infrastructure related organizations around tournaments. We're also monitoring hacktivist groups, kind of echoing what some of the other panelists have said. So ideologically motivated threat actors this year, particularly Iranian nexus threat actors for any signs of escalation tied to the tournament or specific high visibility matches or events. Great. Again, for each of you, what about this World Cup is unique from a risk analysis perspective, either compared to past World Cups or compared to other major sporting events that we've covered like the Olympic games? Brian, we can start with you again. Yeah. So I think the the the obvious one is that this is the first World Cup that is multinational, across North America, multiple host cities. I think, DHS secretary Mullen kind of conveyed this pretty accurately the other day when they referred to this as, you know, effectively multiple Super Bowls over the course of a month and a half, which then and themselves are are definitely a logistics challenge for for security and safety and around a host city, a venue, and all the activity that kinda goes around it. Beyond that, what's distinct, I think, is particularly with The US and its co hosting role. In considering the fact that we're having the World Cup converge with two hundred and fiftieth anniversary celebrations here in The United States, while some of the preliminary matches will are will be over the course of June. There will be some activity that that corresponds in time with the, with with July 4 and Independence Day in The United States. Number two, you also we're also in emerging election season with the midterms in November. So you have a lot of, cybersecurity of Flashpoints around things like primaries. Number two, there's also a well, we would argue is a politically contentious backdrop, where there's a lot of competing, thoughts and and and and debate around immigration, law enforcement, public safety, The The US's role with, Operation Epic Fury and so on. So that gives threat actors, at least from like an IO perspective, an opportunity to frame The United States' hypocritical or selective host. I mentioned I mentioned the Iran war concurrently so that, you know, Iran's participation, in the tournament itself, gives the tournament, which has been generally agnostic to politics, that underlying narrative. One thing I would contrast with is with historical Olympics events, Russia being one of, I would say, most active threat actors during you know, against, international sporting events, might have less of an intent here just due to, Ukraine's failure to qualify for the World Cup. And as I mentioned, it's it's a three it's a three country 16 city footprint. So, you know, there's not one single security environment. You're assessing this city by city, venue by venue, country by country. So, yeah, that that's that's really what we're looking at right now from the from the the unique risk analysis perspective. Great. Thank you, Paul. Same question on the cyber side. Yeah. Thank you. And piggybacking on what Brian said, definitely, Operation Epic Fury is, front and center for the obvious reasons as we have Iran being part of the big four, Iran had having a very contentious role, historically within the footballing scene as well, and using, the opportunity for, to politicize essentially the event, to bring attention to their causes. So we're keeping a very close eye on that aspect because of how, that may influence how threat actors themselves will operate against, US networks, persons, or even sporting teams. Great. Thanks. And, Alex, what is unique on the criminal hacktivist side? So I anticipate my answer will heavily overlap with Brian and Paul here. But both financially and ideologically motivated threat actors are very likely to capitalize on the chaos surrounding the war with Iran and US domestic politics to develop highly specific lures and branding for their attacks. Similarly, the event being hosted in multiple countries also introduces new complexity for law enforcement, which is very likely to benefit and maybe even embolden threat actors running purchase scams, ticket fraud, and credential harvesting operations. Aside from this, the most notable shift since 2022 is gonna be AI, which is enabling cyber criminal infrastructure to be stood up at a much greater scale than during previous tournaments that we've seen. Great. Thank you. I think we're going to keep hearing a lot of these themes throughout the more in-depth sections, particularly around the very complex geopolitical scene, the war with Iran, and then also, the impact of AI on how it changes threat actors' operations. So let's dig in a bit more to some of the unique regional issues for physical security. So I'm gonna be speaking to Brian during this section. How are security priorities in Mexico, The United States, and Canada different, and where do they overlap? Thanks, Megan. Yeah. So the the dominant threat for each of the three countries, I think, sharply vary vary by country. I mentioned this kind of in my opening, but, you know, Mexican host cities, they face the highest physical risk according to our assessment that you know, driven by TCOs, cartels, so on organized crime, concerns around kidnapping, extortion, and theft. You know, these because of the the heightened security presence, from from Mexican authorities around with the host cities and the host venues themselves, They're unlikely to target venues directly, but they there's always that potential to exploit the influx of visitors, fans, patrons, and the strained local resources. In The US, a little bit different. We're we're primarily looking at, like, opportunistic threat theft, concentrated in your your major host cities, Los Angeles, New York, Miami, Seattle, as well as the relatively distinct violent extremist dimension around soft targets. Paul mentioned lone wolves, which is something we'll talk a little bit about later, But but just kind of that overarching threat of, Islamic State inspired, lone wolves, acting on those soft targets similarly like to what we saw, in in 2025, in New Orleans during the Sugar Bowl. That's the the the one of the ambient threats in rural Canada. Tends to be one of the lower threat levels, mainly around petty theft. Toronto and Vancouver, two of the host cities, are generally rated low for crime. But the overlap among all of them is is opportunistic crime, in crowded spaces, civil unrest, you know, counter protests, politically related unrelated protests, across across really all three countries. And one final nuance to that too is while our report looks at Mexico as, leaning on a violent crime risk level, data security and privacy threats, are are generally the greatest in The United States and Canada. Great. So I wanna pivot into, looking a bit more at how the war in Iran will influence, specifically physically physical security risk as that's something that has come up frequently in everyone's, opening statements. Yeah. So the war the war in Iran, has may mainly raised the the ambient threat, in The United States. So you got Iran nexus actors that have almost certainly increased their operations after the the 2025 US, US strikes in Iran, coinciding with attempted attacks and threats against US officials. One thing to note that at the time of our publication, we hadn't identified any evidence that Iran linked actors were intending to target the World Cup, which in itself is consistent with the fact that they have not targeted large sporting events in the last five years. So with the the war in Iran, what it really does is raises the baseline threat environment. So requires a heightened level of awareness from public safety officials and defenders. There's also the potential for an escalation trigger. So any sort of sudden kinetic activity involving The US or Israel or Iran and the Persian Gulf, whether or not it's related to, you know, fallout of negotiations or, you know, the closing of the Strait Hormuz or what have you, it would likely increase the risk of retaliatory attack at least in The Middle East, whether that's on, US allies in the region or, you know, military personnel stationed in the region. Then there is, I would say, just given that baseline, like, an increased risk of potential retaliation in, like, host cities or general population centers. But that is relatively lower than the initial scenario I mentioned, you know, targets, regionally in The Middle East. That's probably one of the indicators that we're really paying attention to, especially as, the the tournament kicks off. Great. Physical security has definitely been top of mind for the host of the World Cup pretty much since it was announced, and there have been a lot of security protocols already put in place to ensure the safety of fans. This includes an operation in Mexico to deploy nearly a 100,000 secondurity personnel across different World Cups host cities. Can you speak a bit more about some of the specific goals of this response and what impact it might have on the game experience? Yeah. As you mentioned, so the Mexican government had announced the deployment of about a 100,000 security personnel in around, the the host cities in Mexico aimed to deter and respond to potential threats associated with TCOs, that again being transnational criminal organizations. The the substantial security presence, it it definitely hardens that, that target a lot, but the the the issue is on kind of the inverse. It's it might create, you know, a sense of of tension for fans. Just seeing that that presence, it it it can feel a little intimidating or, you know, there's there's always the opportunity for for clashes with, like, protesters or demonstrators on various political issues with maybe security forces. But generally, a successful implementation of the the plan, would, you know, reduce violent crime risk in those host states. As I mentioned, large deployments in your event cities would also increase the risk of confrontation with demonstrators. And that can cause issues for logistics or travel disruption, potentially even on, like, match days themselves. One clear example of this we talked about in the report is on March 28, when protesters have blockaded a highway near, Mexico City's stadium, then that resulted, in some logistics challenges. So the practical impact is that while that's going to improve, the threat posture of the venues of the host cities themselves, there is a level, a raised level of friction in around those cities, just kinda given the presence of the security forces. Great. Yeah. Thank you for highlighting some of the complexities that are facing defenders when thinking about how to protect the games, protect the fans, and make sure the tournament, goes off smoothly. So I'd like to pivot over to Paul. We're going to be talking about some of the risks from advanced persistent cyber threat actors. It's not just physical security that is a concern in these games, of course. It's also cyber attacks. What kind of state sponsored cyber activity are we most likely to see, in and around the games? And what are some of the motivations behind some of these events? Yeah. Thank you, Megan. I guess clear and simple, the motivations are espionage, surveillance, and potentially, in worst case scenario, disruption or destructive activity. So barring that last threat element, the World Cup should really be considered or viewed as part of a continuum. So espionage operations that initiated well before the, competition and will continue long after it ends. Oh, pardon. The mic just went on. So, yeah, the Iranian, Russian, Chinese threat groups are likely to view this tournament as an opportunity for intelligence collection, to fulfill those long standing intelligence requirements and to further their access against, North American based surveillance targets as well. So the the targeting of strategically important individuals, whether they're government or private, as well as business media organizations, and and all those elements, such as travel providers, telecommunications, bodies, hospitality services, and even the event contractors themselves. Essentially, the the ecosystem that supports the FIFA tournament, those should be viewed as potential targets by the state by state sponsored groups. Now looking at that disruptive element, when we consider that, Russia and Iran have more of a a history or an intent and the capability, to execute those operations. That's again, it's a possibility for them to execute them while also using not only the direct groups that we're we're familiar with, but also the proxy elements and the threat actors that are aligned, with those states. So looking at a disruptive scenario, for example, we're looking at the possibility for DDoS attacks, website defacements, those that attempt to really interfere with event related services, the media broadcasting, or the public facing platforms that are used by the fans that need to have access to them to ensure that there's a smooth operation on the ground. On a more aggressive level, we could see something like, the targeting of SCADA industrial control systems, in an effort to disrupt the event. So a clear example of that would be not not too long ago, I think within two weeks, the LA transit system was reported to have been targeted by, Iranian threat groups. Now that that's the type of scenario where in a major urban environment where spans will depend on the transit system to get from point a to point b, you know, the disruption of these services could really cause, some type some type of just brand reputation damage or even, the the the ability for it to disrupt the event. So it it's not all, about a potential violent outcome or a destructive outcome. It's about causing a lot of interference as well. So and it essentially, that is is all about creating, for for those groups, it's about demonstrating their ability to interfere with the US government's ability to host a successful event. It's about brand reputation against the US government. Great. Thank you for that overview. In terms of sporting events specifically, have we seen state sponsored actors target events in the past, and what kind of, operations have we observed? Yes. Absolutely. So we've seen both sides. When when we're considering Iran, since it's kind of front and center of many of our, analysts' discussions here, we could look at an example from Greenhotel, which is a group that we track internally. Externally, it generally overlaps with a cold and sandstorm. Greenhotel has an established history of, executing hybrid cyber operations, targeting sporting, media, and event related organizations. So it it established a group essentially called, the Zeus' hacking group. And it was used, to target Israeli Olympic athletes in addition to the National Sports Center of Israel. And this was just prior to the twenty twenty four Paralympic Games. And subsequently, what it did was ran a pretty, let's say, pretty extensive doxing campaign against the athletes themselves during that event. Additionally, we're keeping an eye on, groups such as Handal Haq team or the Ababil of Manab group. Both, highly likely well, they they operate at the behest of the Iran's Ministry of Intelligence. And while they don't technically have a direct history or a lineage of targeting sporting events, we're tracking them due to their aggressive posture essentially against the US government and US private entities. So and we we know that these groups, could execute what they perceive to be a legitimate retaliatory, disruptive, or destructive operation, against US networks supporting, the FIFA tournament. So those those are just two examples from the Iran side. If we're looking more at, like, Russia, then there's very, clear track record as well. We're looking at events, and operations ran by the Basenbaum team. So it ran the Olympic destroyer attack, which disrupted the twenty eighteen Winter Olympics in South Korea. Russian operators are also, linked to, reconnaissance operations, during the Tokyo twenty twenty Summer Olympics, that targeted logistics providers and sponsors. And even more recently, Italian officials reported that, they disrupted a Russia linked cyber operation targeting the twenty twenty six Milano Cortina Winter Olympics. I think from an espionage perspective, obviously, from from that from that group grouping, we're we're seeing blue bravo, blue Charlie, blue deltas, blue echoes. These are the major groups, APT twenty eight, APT twenty nine, and so forth, and Tula, that are responsible for that. Also, the espionage and credential, type of theft activity that, is well known, within the Russia cyber arena. When considering China, we don't suspect them to really be running more of the disruptive, destructive type attacks, and we're centering them more on the espionage elements, and the threat that they pose. So we've got at least two clear cases, one which in sync group, instant group tracks as threat activity group number 51, which compromised the networks of a telecommunications provider for the, twenty twenty two FIFA World Cup. So very much in line with the threats posed to the World Cup environment as a whole. And furthermore, we, also track a group called Red Lima, which conducted reconnaissance against French government departments and organizations, that were associated with the twenty twenty four, Paris Olympics. So those are just some some examples, and I definitely, suggest for our, listeners to go and and read more cases, in in the actual report that will be released. Right. There are a lot of more in-depth examples in there, and I think both the report and your overview have given a really great look at the complexity of this cyberattack surface from city infrastructure to the perception of the games and teams themselves. I want to ask one more question that kind of goes back to a point that you brought up in your introduction and I think will lead nicely into our next section on hacktivist threats. But you mentioned nationalist and ideologically motivated lone wolves targeting football specifically. Could you say a bit more detail about that? Yeah. Absolutely. So, for all the football fans out there, they there's they they will know that football and hacking are not, isolated. There there's a very long track record of that type of activity occurring. I mean, just most recently, we had, one of the biggest Dutch teams in the world, IX Amsterdam, experienced a pretty notable breach where one threat actor was associated to an incident that exposed the personal information of more than 300,000, IX supporters, and it could have affected more than 42,000 seasoned ticket holders. So that's that's quite quite a a a feat for any, cyber, analyst. And why that is a bit of a concern is because, getting access to those types of sensitive systems, those that are associated with ticketing, could cause, great confusion to host nations. So it's it's about creating a confusion with seed assignment irregularities or offering tickets online when there are none to be offered. It it that also kind of migrates into the criminal element, and I'll let Alex discuss that. But for those elements that are more nationalistic, related, more ideologically associated with nation state service like Iran or Russia, It's about creating that brand reputation. And we don't have to just focus even just on that IX Amsterdam case. You've got, cases like the the Rui Pinto Football Leagues case, which is a little bit older, goes back into 2019, if I'm not mistaken. This was an example of an ideologically motivated operator, somebody who's kind of seen himself as as a fighter against corruption, and he ended up leading, intrusions against, well known clubs across Europe, such as Manchester City, which impacted Paris Saint Germain, and so forth. And so there was quite a bit quite a big, of a snowball effect that led after that with investigations against the clubs and so forth. And last but not least, I think, for any of those who have who love the World Cup and have and know its history quite well, they don't have to look too far back into the last World Cup that was held in The US and and, the tragic case of a Colombian football player, Andres Escobar, who was, assassinated essentially because believed to be assassinated because of an own goal that he scored, during one of the games, for Colombia. And so what that what does that mean now when we're in the globally connected digital age? What are the threats to the actual players and the athletes themselves? So ideological ideologically motivated groups that are associated with nation states could really try to lead efforts against the athletes themselves. The sporting teams could harass them, could target their personal, social media, accounts and so forth, and really create an environment where, the the players themselves feel like they're threatened or they have to feel that they have to act in one way or another. And so, yeah, those are just some of the cases where, the lone wolf, quote, unquote, lone wolf or the ideologically motivated threat actor could really influence, the cyber dynamic to favor a nation state. Great. Thank you so much, Paul. And that will lead us into our next section on the hacktivist and criminal threat. So we'll be talking to Alex a bit more about how these threat actors are going to take advantage of the games and really emphasizing again some of the interconnectedness between all of the different threats that we are talking about today. So I wanna start with probably a very basic question, but why is something like the World Cup so appealing to a hacktivist? I think that's a great question to start with. The core answer is gonna be visibility. So the World Cup is one of the most watched events on the planet, which means it's the perfect stage for a hacktivist group looking to make a highly public political statement. Typically, standard hacktivist operations like DDoS attacks and web defacements might get minimal coverage and are easily remediated usually, sometimes without many people even noticing that they happened. But they could make international news when they're tied to a tournament that billions of people have eyes on. Furthermore, echoing what Paul was saying earlier, there's a lot of potential for these operations to cause highly visible disruptions and, consequently, reputational damage to organizations involved in the critical infrastructure or the games. So media companies, transit systems and host cities, hotels, this is all very attractive, to hacktivists who want to present their targets in a negative light. And that brings me to my next point, which is, the rich symbolic context around this year's World Cup, the Iran conflict, the controversy around their participation, the symbolism that the Iranian team is carrying domestically, these are live and emotionally resonant issues that Iranian nexus hacktivists can point to directly as they launch campaigns. And one last thing worth noting on this question is that the line between hacktivist and financially motivated cybercrime is blurring, and this is something that'll come up, I'm sure again, that we've observed groups, using hacktivist branding to dress up what are essentially, extortion operations and trying to use political messaging to amplify the psychological pressure on victims and attract media attention that purely criminal groups don't always get. And the World Cup is a perfect environment for that kind of hybrid activity. Great. So what exactly are some of the hacktivist capabilities? What can we expect them to try to do? Yeah. So in terms of raw capabilities, hacktivist groups typically operate at the lower end of the technical spectrum. Their core toolkit is pretty predictable. So, again, DDoS attacks, web defacements, data leaks, and doxing. These are accessible, highly visible operations that don't require deep technical sophistication. And these days, it's especially easy to onboard new participants and launch automated attacks through things like Telegram bots and DDoS as a service platforms. And the goal of these operations is usually to make a bunch of noise and generate media attention rather than to cause lasting operational damage. That being said, the ceiling on what hacktivist groups can achieve has risen, and that's for primarily two reasons. For one, the convergence between hacktivist and financially motivated criminal actors, has increased, and that means that some groups now have ransomware and extortion capabilities either directly or through partnerships with established groups or platforms. We've tracked groups like KillSec, CyberVolk, and BQT Lock that operate in that blurred space, and have either developed bespoke tools based on leaked ransomware builders or launched their own ransomware as a service programs. Second, and this has been alluded to as well by Paul, some hacktivist personas have direct links to state sponsored infrastructure. Hondala Hak Team is a really good example of this, and it's been attributed to Void Manticore, which is tied to Iran's Ministry of Intelligence. And when a hacktivist persona is essentially a front for a state actor, the capabilities behind it are considerably more serious. And that's typically when you see hacktivist groups deploying things like wipers, targeting ICS and SCADA systems, and compromising critical infrastructure. Great. Let's move into talking a bit more specifically about financially motivated threat actors. Since probably the tournament was announced, cyber criminals have been trying to take advantage of it. And in our report, we track a lot of campaigns that are actually actively ongoing, not just getting set up for the game. So what have we been seeing so far in terms of criminal activity around the World Cup? Yeah. So, indeed, criminal exploitation of the tournament is already well underway, and we have been tracking active campaigns since at least April 2026. The most concrete example is a network of over 30 World Cup themed purchase scam domains that we've identified linked to over 2,000 malicious advertisements, that are hosted on legitimate advertising platforms like meta ads, which make them a little more convincing to victims. And these are fake FIFA storefronts that look like legitimate merchandise or ticketing sites, but they're fully integrated into real payment processing infrastructure through fraudulent merchant accounts. So victims aren't just losing money to a site that then disappears. Their payment card data and personal information are also being captured and sent to threat actors through what looks like a normal transaction. We also observed a separate campaign where threat actors compromised legitimate websites and manipulated their search engine visibility to funnel victims towards scam infrastructure. In these cases, the malicious websites are actually not indexed or flagged by search engines, which makes detection significantly harder for the defenders. On the phishing side, the numbers are also very notable already. Since April, we've identified over a thousand registered domains combining the terms World Cup, over 600 typosquad domains spoofing fifa.com, and nearly 300 domains combining FIFA branding with references to specific host cities. And that's a large volume of infrastructure standing up in a relatively short window, and AI generated content is almost certainly enabling threat actors to build and deploy these campaigns at a massive scale. Then we also have credential theft and ticket fraud. Although we've not seen a huge influx of data based dumps related to FIFA on underground forums quite yet, we are seeing compromised FIFA related account credentials being sold on dark web marketplaces like Russian market. And threat actors on criminal forums are advertising cash out services targeting major ticketing platforms like Ticketmaster, StubHub, and SeatGeek. The thing is, high ticket demand and cross border transactions create very favorable conditions for this kind of fraud. So we're expecting it only to intensify as the tournament progresses. Great. Can you say a bit more about specifically what do we expect criminals to do? How do we expect tactics to shift as we get closer to the games? Yeah. Like I said, what we're seeing right now is largely groundwork. Infrastructure is being built, domains are being registered, and merchant accounts are being set up. And the shift that we expect as the tournament gets underway is from the setup to active exploitation. In practical terms, that means that the phishing and smishing campaigns that are currently being staged will start firing at volume. So travelers booking last minute accommodations, fans trying to secure tickets through secondary markets, people looking for streaming access, all those behaviors are exploitable moments, and criminals are very good at timing their operations around them. Hospitality is a particular area of focus for us. So that's hotels, airlines, travel platforms. These are all attractive targets both as lures for fraud targeting individual consumers, and because compromising them directly provides access to large volumes of personal data of football fans and, watchers. Social engineering groups like Shiny Hunters are also definitely worth watching here. This is these are highly adaptive attention seeking groups with experience and account takeovers and post compromise ransomware deployment. And the World Cup gives them a ready made set of lures to work with at scale as well as a world stage to, do that on. On the hacktivist side, the timing dynamic is a little bit different. And rather than a steady ramp up, like like we're seeing with financially motivated cyber criminals, we'd expect hacktivist activity to spike around specific triggers. So particularly any kinetic escalation in the Iran war during the tournament window or politically significant moments tied to the matches themselves. So if the Iranian team's matches generate controversy, if there's specific incidents involving Iranian fans or officials, or if there's a major development in the conflict while the games are running, those are gonna be the moments where, these hacktivist groups are most likely to mobilize. The symbolic stakes around this particular tournament are also high enough that even a diplomatically significant moment, so a ceasefire announcement or, say, the collapse of a ceasefire, could prompt a response. Great. And last question. How you mentioned AI earlier being one of the differentiators for this tournament compared to previous ones. Can you be more give more specific examples about how AI is playing a role in both hacktivist and criminal operations? Yeah. AI is probably the most significant force multiplier that we're tracking across the criminal threat landscape for this tournament, and it's showing up in a few ways. The most straightforward application for it is just scale. AI generated content is enabling threat actors to produce and deploy phishing and smishing campaigns at volumes that just were not achievable during previous World Cups. So, for example, that influx of typosquat and World Cup themed domains that we've already identified were registered in a relatively short window, and AI tooling is almost certainly part of what's enabling that pace. And it's not just volume because the quality of the content is also significantly improving, which makes detection harder at every level, whether that's through email filtering for specific keywords, user awareness that they're interacting with a fake website or brand monitoring for companies. And similarly, it brings a concerning shift, on the social engineering side because AI is allowing threat actors to convincingly impersonate individuals and organizations in ways that previously required significant human effort and language skill. So vishing, which is voice based vishing, is a good example of this where convincing voice impersonation no longer requires a native or a near native speaker. And so criminal groups can now target victims across language boundaries they couldn't previously effectively cross. AI generated voice and video also removes that barrier almost entirely. So, criminal and hacktivist groups can now target victims, recruit members, and create messaging across language boundaries. And I will say that this trend is definitely not isolated to cybercrime. And we're seeing the same AI enabled content generation driving state sponsored influence operations. So Russia, China, and Iran are all using AI generated content to scale their messaging around the tournament. So when we talk about the blurring line between hacktivist, criminal, and state sponsored activity, AI is absolutely helping to enable that, and it's a thread that runs across the whole threat landscape we're talking about today. Right. I think you had described it earlier as a key force multiplier, which is definitely influencing how we're seeing threat actors use that capability. I wanna move into our last section. We're gonna come back to Brian for a bit about some of the influence operations that we're observing and what we can expect to see as the games begin. So, Brian, what does the picture look like for 2026 when it comes to influence operations? And, is it so far shaping up to be what you've expected, or is there any surprises? Yeah. So as as I as I mentioned too in in the opening, what we've what we've been tracking from Russian, Chinese, Iranian influence operations networks, is that the content around the World Cup has been overwhelmingly overt. Again, that's that's state media, that's diplomatic channels, embassy social media, very out outward and overt personas, driving that coverage far more consistently than what we're seeing from covert networks. That that activity remains, again, very limited and highly opportunistic, from from Russian influence operations in particular. Like, what we've been seeing is very nuanced small mentions from, like, news aggregators such as InfoDefense and Portal Combat. For for Empire Dragon, we've only seen, like, one instance of an account talking about the World Cup. So it's very, very small. The the the the other part too of that is we're also the the World Cup is taking place, while there's also other geopolitical priorities right now. So for example, Russian covert influence operations, they're heavily preoccupied with Armenia's parliamentary elections that are coming up this weekend. There's been very little about the World Cup thus far. So where they might go next, whether that's, you have Latvia's parliamentary elections coming up later this year, you have midterm elections coming up this year, which is something we're gonna be taking a look at. So there there's also the opportunity for World Cup content as the tournament gets underway. So a lot of that content is very much up in the air and still very much dynamic. The wild card with that is these influence operations are incredibly agile. And they're again, as I've as I've said a few times, they're very opportunistic and they're very resourceful. So they're with, you know, the enablement of AI, they're able to quickly create, curate, and disseminate content, on on viral events or, events that are, you know, just merging in the news. For one just example of that, is after the, April White House correspondents dinner shooting, that was occurring on a Saturday. One of the influence operations that we track is Matryoshka. They then were able to produce content within about two days of that, targeting, claiming the Ukrainians were accomplices in the shooting by those that were working at the hotel. So they're very quick and agile to move that content to to to disseminate into social media. Is it what we expected? It's more muted, I guess, instead on the covert side than recent suggest than recent events might suggest. I mentioned before that, you know, Russia has historically been very active in, you know, Milan Cortina 2026, Paris 2024 with, physical influence operations activities. But, the the Ukraine Ukraine's failure to qualify likely, at least from an influence operations perspective, limits Russia's intent to target the tournament in the same way that they've been targeting the games. China's posture is generally what we've expected. It's positive. It's commercial, focusing on Chinese prestige, focusing on their commercial successes. And then Iranian activity, again, overt, but it's also centered on its political participation, the wartime symbolism, you know, such as, designating, the the team that's Manav one hundred and sixty eight in reference to the, the school bombing that killed 168 civilians, during Operation Epic Fury. But we do assess that covert influence operations activity could, could increase closer to the event. And I know we're getting closer to the event, but so it could, over a month time, it could still continue to progress. So especially around geopolitical flashpoints or viral moments, but now that has not materialized. And what should what should we look for that might be a sign that covert activity is increasing? Yeah. So there's there's a few there's a few different indicators that we listed out by Acura. We talk about in the report, but, like, just generally from Russia, the clearest signal of that would be corporate now operate influence operations that we're already tracking such as CopyCOP or doppelganger, Operation Undercut, others, that are rapidly shifting content to focus on the World Cup. Instead of talking about Armenia or talking about French politics or Germany, they're then vendor creating content, that we've seen in the past for for Olympic games or high profile media events or or large, just general international events, fabricating security threats, particularly blaming these fabricated security threats on Ukrainian migrants or refugees or some, something along that existing template they've been using time and time again. You may also see, emergence on social media of a person's, of FIFA officials, brands, participating organizations. There are you know, to kinda loop back to some of the hacktives discussion prior, one of the popularly coined terms is the idea of perception hacking. Taking something that is very, very minor, such as like a web defacement or recycling a data breach, advertising that as new or something far beyond, like, the the significance and the public perception to that or the the media coverage around that far outweighs the actual impact of the incident itself. So all of those different activities emerging, is what we would see as something that will be evidence of an escalating, influence environment. Great. Thank you so much, Brian, and thank you to all of our panelists for that very informative discussion. If you would like to learn more, there is lots more information, detail, case studies in our, new report that is out today and shared in the chat. So now I'd like to ask, Meche to come out, and give us a brief demo on how you can use the Recorded Future platform to monitor and, prevent mitigate some of these threats that we just discussed. Of course. Thank you so much, Megan. Over the next eight to, ten minutes, I will try to focus and cover some of the product specifics and product areas that are corresponding and fully aligned with the main topic that was covered by, Alex, Brandon, Paul. I divided into the three main demo episodes, starting with cyber operations, following with influence operations, and also, last but not least, the fan perspective. Initially, let's start with cyber operations. So because I would like to know what are the top cyber translated to FIFA World Cup twenty twenty six and what are the key threat actors to monitor, I use Recorded Future AI to brief me on this one just with using the prompt. So just very important to remark, Recorded Future AI is plugged to multiple numerous tools, including, of course, intelligence graph. So our entire collection of, intelligence, also web search if needed, intelligence cards, easy reporting, and much more. Based on this, it produced me a quite nice briefing covering the top cyber threats. And if we quickly go through some of them, they are perfectly aligned to what was covered by our panelists today. So the number one cyber threat highlighted here are brand impersonations, phishing, and financial fraud, followed by some of the examples of suspicious infrastructure that was already create created that is trying to mimic, either FIFA ticketing systems, FIFA hiring for, volunteers, and so on, and many, many more. Another one, of course, is credential theft followed by espionage, disruptive attacks that was also covered, during the today's today's webinar, ransomware and extortion, and also third party and supply chain compromise. Focusing on staffing, travel, sponsors, and other infrastructure, delivery companies that are part of the very big supply chain to successfully organize World Cup in those three countries. The key trajectories to monitor here are very nicely divided by, we call it future AI, into the highest priority monitoring set and also a more secondary monitoring set depending on their probability, their intent, and the capabilities. And one of the honorable mention that was already here is Handala Hakting, a proposed senior group linked to Iran's Ministry of Intelligence and Security that was, and is quite active, due to some recent political events. And right now, starting from this, if, I'm a security analyst and I would like to learn more about them, Depending on what my priority intelligence requirements are, I can deep dive and pivot into numerous different of, sections available in a central profile for this threat actor. So if my basic interest is to get a rough understanding on how do they operate and who they are, Recorded Future AI Insights is producing for me a very nice one paragraph brief covering all of the most important elements, like their motivations, their linkage to Iranian Ministry of Intelligence and Security, their recent cyber attacks, for instance, including Stryker, infrastructure in UAE, and more. However, if I'm responsible to create and build any kind of strategy for security controls and the mitigation, I can follow more in terms of their Mitra Tech metrics to understand how they operate, what kind of tools do they use, and what is their modus operandi. And, of course, let's not forget about EASI reporting that is nicely presenting to us all the key, all the key, actions, operations, campaigns, followed by detailed analysis about the group itself. So this quite nicely allows me to go deep into understanding them, followed by creating specific security controls that will help my me securely plan p four World Cup. If I want to quickly add this as a quite important threat actor to my monitoring list, I'm literally a few clicks away. Because if this is a threat actor that I would like to track and monitor constantly because they introduce an intent and have abilities to damage, people who have scab, I can add them to the list with one and two clicks. That will ensure that all of my analyzers, all of my introductory maps, and everything that is being delivered for by the platform to me is fully automated. Wrapping this up, let's go to the influence operations. And explicitly for this, I created another prompt that where I asked to brief me on influence operations with the two twenty twenty six FIFA World Cup. Here, this specific query that I provided here summoned the dedicated AI agent called influence operations agent that is tuned to perform and conduct such analysis. Then as the outcome of of this, it get access to tons of state media with the my precise focus on narratives in Russian and Iranian state media to help me understand what those influence operations are. We have all of those capabilities because that allows us, with our natural language processing, recorded feature AI, big collection and being constantly plugged and constantly collecting into those sources to provide a very good results that help us track this. And, again, to convert it into the outcome and go one step ahead with the in terms of the automation, I can schedule the dedicated report that will brief me on the last week's influence operations we did to FIFA World Cup with my specific subject, with my specific instructions, with my specific time frame that I can schedule to be delivered on my desk every single week, every single day at a specific time to help me orchestrate and be on top of what those operations are. And last but not least, let's imagine how the fans are also concerned about both physical security threats and cyber threats related to FIFA World Cup. So let's imagine that I would like to participate in this on-site. First of all, I'm quite concerned about the physical safety that is related to, specifically, in my my case, the final game that will be hosted in New York slash New Jersey. To conduct this, I created a quick query using the advanced query builder that searched for specific physical security threats related to MetLife Stadium and so on. And all of the results produced me everything that should concern me and, also briefed me on a couple of very important elements, like NJ, New Jersey Transit officials have decided to hold all the trains departing from New York four hours before the game begins. That, from me as a fan perspective, allows me to better plan my trip to be on the stadium when the game starts. So after I overcome all of those physical threats and I'm aware of them and I'm fine with accepting the risk, Now there's another case. I need to get the tickets. And to get those, and knowing also what are the financially motivated threats and risks related to big sports events, I need to get them from the legitimate source. And also thanks to the Recorded Future, we are constantly monitoring all the new domain registrations that are thousands of them on the course of the last few weeks. Monitoring the fraudulent content and fraudulent domains, phishing content, phishing domains. And that can briefly, provide me a list of which shops to avoid. And, right now what you're seeing on the screen is a very nice dashboard for our from our payment fraud intelligence module, that is focusing on the scam merchants related to scam cluster of World Cup twenty twenty six. And, as you can see, many of those domains are already scored with the proper proper suspicious score as recently suspected fraudulent content. And, also, if I'm interested in the more details related to this, I can see all the scam indicators, like brand abuse, online ads, payment redirects, fraud, and more. So right now, with that helps with the help of Recorded Future, I'm quite good to join the World Cup, accept the risk, know what to watch out in terms of the physical security, and also get a tickets from the legitimate source not to get scammed and enjoy the games. Enjoy the show. Thank you, and back to you, Megan. Apologies. Thank you so much, Mache. I think that's very helpful for learning how to operationalize the intelligence that we heard today. I'd like to thank our panelists and, of course, Mache for that very helpful demonstration. And we'd like to, of course, thank all of you for coming today. We will be sharing a recording of this webinar with all registrants shortly after this call ends. So once again, thank you so much, and, go team USA. Thank you.