Union of European Football Associations (UEFA) Champions League Final

A-2022-05-25a

TLP: GREEN

In this assessment, ZeroFox Intelligence provides an in-depth analysis of possible physical and cyber security concerns associated with the 2022 UEFA Champions League Final.

Standing Intelligence Requirements

GEO

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full assessment here.

Executive Summary

The 2022 UEFA Champions League Final (“the Final”) between Liverpool Football Club (FC) and Real Madrid will take place at 8:00 PM on May 28, 2022, at Stade de France in Paris, France. The Final’s move from Russia to France over Russia’s invasion of Ukraine increases the likelihood of Russian-affiliated cyber and political proxies finding ways to disrupt the match, amplify negative messaging, and promote more direct, violent action. Additionally, ZeroFox Intelligence assesses that major violent protests in the run-up to the Final are unlikely; however, the wave of election-related protests across Paris could exacerbate any peaceful march or protests pertaining to the most recent change to the Champions League format. Although ZeroFox Intelligence has not observed any chatter in Clear, Deep, or Dark Web platforms calling for the circumvention of security measures in place at Stade de France, ZeroFox posits that any operational systems with internet connectivity at the Stade de France venue are susceptible to a disruptive cyber attack.

Key Points

The Final’s move from Russia to France in late February 2022 over Russia’s invasion of Ukraine makes the event a likely target of Russian cyber threat actors, who also reportedly targeted the 2018 final in Kyiv. Scenes of pro-Ukraine solidarity are expected at the event, although there are no Ukrainian or Russian players. Russian-affiliated threat actor groups have recently attempted to disrupt European competitions but have not expressed intent to target the Final as of this writing.
ZeroFox Intelligence assesses that major physical protests at the Final are unlikely; however, they are possible given the wave of election-related protests across Paris each weekend during the election cycle and recent protests across stadiums in Europe against UEFA for attempts to change the Champions League format. Liverpool supporters have been among the most vocal opponents of previous non-UEFA reforms.
Although ZeroFox Intelligence has not observed any chatter in Clear, Deep, or Dark Web platforms calling for the circumvention of security measures in place at Stade de France, ZeroFox posits that any operational systems with internet connectivity at the Stade de France venue are susceptible to a disruptive cyber attack. A compromise of an Internet of Things (IoT)-connected lighting system has perhaps the most potential to disrupt the Final.
Although no chatter about planned terrorist attacks has been identified, lone-wolf attackers are of the utmost concern. One form of inspiration could be the ongoing trial of Abdeslam, which attracts widespread media attention on key dates.