Qatar 2022 World Cup Event Assessment

Qatar 2022 World Cup Event Assessment

Product Serial: A-2022-10-25a

TLP:CLEAR

In this assessment, ZeroFox Intelligence covers a variety of topics surrounding the Qatar 2022 World Cup, including betting & ticketing scams, hacktivism, potential protests, strained local infrastructure, and more.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 5:00 PM (EDT) on October 21, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

The 2022 Qatar FIFA World Cup runs from November 20 until December 18, 2022. Qatar has been a controversial host since corruption allegations emerged shortly after both Russia and Qatar were awarded hosting rights for the 2018 and 2022 World Cups, respectively, at a ceremony in 2010. Controversies have continued, with the tournament needing to be moved from the traditional Northern Hemisphere off-season summer period to the mid-season winter period to accommodate Qatar's climate. However, the greatest controversies surround the infrastructure projects needed to host the event, which are vast in a small nation not accustomed to hosting international sporting events. Allegedly, 6,500 largely-migrant workers have died building the stadiums, and thousands more continue to be mistreated according to Amnesty International. This prompted calls for a boycott of the event, which have not materialized to date. However, symbolic acts of protests by teams and spectators inside stadiums are likely during the event, which could harm sponsor reputations and lead to a crackdown by security forces that have little tolerance for dissent. Protests against the politics of a participating nation could lead to geopolitical disputes that impact the tournament as well. The Human Rights record of Qatar and Iran, as well as the war in Ukraine, remain the likeliest causes of geopolitical disruptions during the event. A month prior to the tournament, hacktivists from Anonymous collective launched an operation calling for Ukraine to replace Iran at the tournament over Iran's military support to Russia. The group also called for political pressure to be applied.

While Qatar is considered overall to be a safe country—and major acts of terrorim or violence are unlikely—there are still physical security concerns. An estimated 1. million visitors are expected in Qatar; this amounts to a 50 percent increase in the local population and could lead to stresses on transportation infrastructure and the close grouping of eight stadiums. This will also put pressure on Qatar's limited accomodation facilities, where prices have quickly become unaffordable.

During the World Cup, there will likely be threat actors aiming to acquire personal information or monetary value through phishing and scams. Cyber threat actors may target the confluence of logistical issues with accommodation, ticketing, and betting scams. These will range in complexity from basic mass SMS scams to attacks on specific individuals and organizations. Many scams will leverage the wide array of sponsors and impersonate well-known brands operating logistics and accomodations in Doha. Qatar itself requires visitors to download two apps that could expose personally-identifiable information (PII) and other sensitive data; other fraudulent mobile and payment apps will likely be leveraged by threat actors throughout.

Key Findings

• Threats will be modified as the tournament goes on, depending on which nations advance.
• Accommodations are sparse and extremely expensive, but the limitations could ease as fewer teams advance.
• Acts of symbolic protests inside stadiums are likely.
• Qatar's housing and transportation infrastructure will be strained during the tournament, particularly at the beginning.
• The threat of terrorism during the games is currently considered low.
• Betting and ticketing scams are highly likely.
• Politically-motivated hacktivism is highly likely. in the lead up to and during the World Cup
• Social engineering leveraging tournament-related lures is anticipated as threat actors will aim to capitalize on heightened global interest to harvest credentials, deploy follow-on payloads, and conduct financial fraud.