Last week, CNBC gave me a chance to discuss Microsoft’s Friday-night news dump of a new breach by Russian intelligence services, in which I called for more details from Microsoft so that other organizations could defend themselves.

On Jauary 25th, we gained a bit more transparency in the form of a blog post from “Microsoft Security”, the commercial security division of Microsoft. Let me offer some reactions.

Microsoft Buries the Lede

“Using the information gained from Microsoft’s investigation into Midnight Blizzard, Microsoft Threat Intelligence has identified that the same actor has been targeting other organizations and, as part of our usual notification processes, we have begun notifying these targeted organizations.”

Translation: Since the techniques outlined in the blog only work on Microsoft-hosted cloud identity and email services, this means that other companies were compromised using the same flaws in Entra (better known as Azure Active Directory) and Microsoft 365.

Microsoft’s language here plays this up as a big favor they are doing the ecosystem by sharing their “extensive knowledge of Midnight Blizzard” when, in fact, what they are announcing is that this breach has affected multiple tenants of their cloud products.

Update: Joseph Menn of the Washington Post has several sources indicating that at least ten companies were breached and will be disclosing soon.

Microsoft Continues to Downplay the Attack By Abusing the Term “Legacy”

One of the big open questions from last week was how an attack against a “legacy non-production test tenant” could lead to access to the emails of key Microsoft executives. We get a bit more detail in this paragraph:

“Midnight Blizzard leveraged their initial access to identify and compromise a legacy test OAuth application that had elevated access to the Microsoft corporate environment. The actor created additional malicious OAuth applications. They created a new user account to grant consent in the Microsoft corporate environment to the actor controlled malicious OAuth applications. The threat actor then used the legacy test OAuth application to grant them the Office 365 Exchange Online full_access_as_app role, which allows access to mailboxes.”

I have seen this fundamental problem in multiple investigations, including the one that Microsoft worked so hard to label as the Solarwinds Incident*: AzureAD is overly complex, and lacks a UX that allows for administrators to easily understand the web of security relationships and dependencies that attackers are becoming accustomed to exploiting.

In many organizations, AzureAD is deployed in hybrid mode, which combines the vulnerability of cloud (external password sprays) and on-premises (NTLM, mimikatz) identity technologies in a combination that smart attackers utilize to bounce between domains, escalate privilege and establish persistence.

Calling this a “legacy” tenant is a dodge; this system was clearly configured to allow for production access as of a couple of weeks ago, and Microsoft has an obligation to secure their legacy products and tenants just as well as ones provisioned today. It’s not clear what they mean by “legacy”, but whatever Microsoft’s definition it is likely to be representative of how thousands of their customers are utilizing their products.

Microsoft does, however, offer all of us some solution…

Microsoft is Using Its Own Security Flaws as an Opportunity to Upsell

These sentences in the blog post deserve a nomination to the Cybersecurity Chutzpah Hall of Fame, as Microsoft recommends that potential victims of this attack against their cloud-hosted infrastructure:

• “Detect, investigate, and remediate identity-based attacks using solutions like Microsoft Entra ID Protection.
• Investigate compromised accounts using Microsoft Purview Audit (Premium).
• Enforce on-premises Microsoft Entra Password Protection for Microsoft Active Directory Domain Services.”

Microsoft is using this announcement as an opportunity to upsell customers on their security products, which are apparently necessary to run their identity and collaboration products safely!

This is morally indefensible, just as it would be for car companies to charge for seat belts or airplane manufacturers to charge for properly tightened bolts. It has become clear over the past few years that Microsoft’s addiction to security product revenue has seriously warped their product design decisions, where they hold back completely necessary functionality for the most expensive license packs or as add-on purchases.

While these two arrogant and circumspect posts do, at least, admit “the urgent need to move even faster” in securing their products, I would argue that Microsoft has a much deeper cultural problem to solve as the world’s most important IT company.

They need to throw away this poisonous idea of security as a separate profit center and rededicate themselves to shipping products that are secure-by-default while providing all security features to all customers. I understand the need to charge for log storage or human services, but we should no longer accept the idea that Microsoft’s basic enterprise offerings (including those paid for by the US taxpayer) should lack the basic features necessary to protect against likely attacks.

My current employer competes against some of these products, but if Microsoft did a better job by default then that would actually reduce the need for SentinelOne and other security vendors to provide basic safety protections.

For all the language about the sophistication of the SVR hackers behind this attack, there is nothing here that is outside the norm for ransomware groups attacking Microsoft technologies, and Microsoft customers of all sizes should be concerned that these techniques will be deployed against them if they do not pay extra for the secure version of Microsoft’s cloud products.

Twenty one years after the Trustworthy Computing memo, it’s once again time for some soul searching in Redmond.

Note

* While the breach of Solarwinds was a critical part of the SVR campaign to break into around 200 organizations, weaknesses in the deployed configuration of AzureAD also played an important role, which Microsoft effectively papered over in their Congressional testimony and written statements.

The Good | TrickBot Developer Jailed for Five Years

Developer and distributor of the notorious TrickBot malware, Russian national Vladimir Dunaev, was handed down 5 years and 4 months of prison time this week. According to the DoJ, TrickBot caused tens of millions of dollars in losses and was used to attack hospitals, schools and businesses with ransomware in the U.S.

TrickBot started out in life as a dedicated banking trojan but over time evolved into a complex malware framework, shifting focus to enterprise environments and incorporating a suite of features including network profiling, mass data collection and lateral traversal exploits. At its height, TrickBot was believed to be in use by both APTs and crimeware actors.

Dunaev was arrested in South Korea back in 2021 and subsequently extradited to the U.S. that October. He finally stood trial in November of 2023, when he pleaded guilty to conspiracy to commit computer fraud and identity theft, and conspiracy to commit wire fraud and bank fraud. According to the DoJ, Dunaev had created programs to bypass AV software and developed credential harvesting and data mining tools.

He is the second member of the gang behind TrickBot to be sentenced to jail time: A Latvian woman, Alla Witte, received 2 years and 8 months in June of last year. A number of other individuals have been indicted and sanctioned by U.S. authorities.

The Bad | Researchers Warn of Risks with Google Search

Security researchers are raising concerns about Google Search in the wake of increasing abuse of Google Ads – a service which promotes paid advertisements above organic search results – by various threat actors.

In one report this week, researchers noted how Chinese-speaking Googlers were being served Remote Administration Trojans (RATs) through malicious adverts shown at the top of search results for messaging apps like Telegram, which are restricted in China.

Closer to home, KrebsOnSecurity said U.S and other English-speaking users were being targeted when searching with Google for software. In one recent example, searches for the (legitimate) FreeCAD graphic design program were returning links to the malicious freecad-us[.]org domain above the real freecad.org site. Searches for other popular software that have been seen returning malicious paid advertisements include Corel Draw, GitHub Desktop, RoboForm and TeamViewer.

According to SentinelLabs’ Tom Hegel, threat actors behind the malvertising schemes rotate serving malware with serving legitimate software as a means to escape detection by Google. Krebs quoted Hegel as noting that “In the malicious ad campaigns we’ve seen…they would wait until the domains gain legitimacy on the search engines, and then flip the page [to serve malware] for a day or so and then flip back.”

In addition, the malicious sites use scripts to fingerprint visitors and determine whether they should serve malware based on criteria such as geolocation, browser or language. This allows the sites to target, say, users from the United States while ignoring users from other locations. An earlier report into this kind of malvertising suggested that many of these sites are used to deliver infostealers and trojans like IcedID, Formbook and others.

In response, Google said that it had removed the ads brought to its attention by the report, but researchers remain concerned that the problem is beyond Google’s ability to fully control. Users are advised to exercise caution when clicking sponsored links returned in Google searches.

The Ugly | Russian APT Strolls Into Microsoft and HP Networks

Both Microsoft and Hewlett Packard Enterprise revealed this week that they had separately become victims of Russian state-sponsored intrusions by APT 29, also known as Midnight Blizzard, The Dukes, Nobelium and NobleBaron. The same threat actor was held responsible for the SolarWinds supply chain attack in 2021.

January 12th, Microsoft discloses that they were compromised by APT29 a/k/a/ Midnight Blizzard and state the group got access to emails for corporate leadership, cyber security personnel, and legal.

January 24th, Hewlett-Packard discloses that they were compromised by APT29…

— vx-underground (@vxunderground) January 24, 2024

In a statement released Thursday, Microsoft said that it had detected a nation-state attack on January 12, 2024. The threat actor used password spray attacks to compromise a vulnerable account. They then used this initial access to create multiple OAuth applications and target Microsoft corporate email accounts.

The company has released few further details about the nature of the compromise, other than to note that the attackers used residential proxies to obfuscate the source of the attack. The technique involves routing traffic through a large number of IP addresses that are also used by legitimate users. The high change over rate of IP addresses makes it difficult for non-behavioral solutions to detect malicious traffic.

Meanwhile, in a filing to the SEC last Friday, HP said that a suspected nation-state actor it also believed to be Midnight Blizzard had gained unauthorized access to its cloud-based email environment.

The filing says that the company believes the activity is related to an intrusion from at least May 2023 in which a number of SharePoint files had been exfiltrated. It further stated that it had “determined that such activity did not materially impact the Company”, although again further details around the compromise remain undisclosed.

Over the last month a number of interesting leaks have occurred within the ransomware-market ecosystem pertaining to the likes of BlackCat and Zeppelin. We saw some familiar names dominate the ransomware landscape in terms of volume and visibility, among them Play, BlackCat/AlphV, LockBit, Phobos (8base) and Akira.

In this month’s update we also discuss some of the vulnerabilities being weaponized by these actors over the last month below, with high profile enterprises Microsoft SQL and SharePoint among the targets.

Crypto drainers, DaaS, and associated scams came to the forefront over the last few weeks with associated hacks being observed across multiple high-profile social media accounts. We will touch base on these recent scams and discuss how these attacks are occurring.

We will round out our discussion this month covering a short update on access-brokers and malicious tools targeting EDR platforms along with some positive news around law enforcement and the release of a Babuk decryptor.

Ongoing Exploitation of N-Day and 0-Day Vulnerabilities

Multiple threat actors have been observed targeting CVE-2023-29357, a critical privilege escalation vulnerability in Microsoft SharePoint. The ongoing exploitation of this flaw, along with the emergence of public PoC code, motivated CISA to add this flaw to its Known Exploited Vulnerabilities Catalog.

In early January, details began to emerge regarding the ongoing exploitation of at least two zero day flaws in the Ivanti platforms (Ivanti Connect Secure and Ivanti Policy Secure Gateways). The newly identified vulnerabilities, CVE-2023-46805 and CVE-2024-21887, allow for unauthorized command-injection attacks, exposing the systems to (unauthenticated) attackers.

According to initial reports, the Ivanti vulnerabilities have been targeted by an espionage-focused threat group (UNC5221) and used to drop a variety of malware including backdoors, webshells and credential harvesters, along with post-exploitation tools such as PySoxy (tunneling proxy) and BusyBox. Almost 20,000 vulnerable instances of the various Ivanti products have been identified as publicly exposed.

It should be noted that PoC code and MetaSploit modules for these flaws are now available.

Recommendations

These flaws should rank high on the priority list if they have not already been addressed. Defenders are encouraged to review guidance provided by Ivanti and CISA. The CISA guidance also provides explicit requirements for Federal Agencies (per current Federal cybersecurity directives).

Ransomware Updates

This month we saw a number of interesting developments in the ransomware ecosystem. An alleged prior affiliate of the now-defunct Zeppelin RaaS advertised the sale of the associated builder and support files on an underground market. The seller, known as “RET”, offered the package for 500.00 USD. This same seller has a history of selling “AV/EDR-killer” style tools as well.

This sale lowers the previous barrier to entry for Zeppelin-derived RaaS offerings. Prior to this leak (hosted on the well-established RAMP forum), Zeppelin ransomware builders were offered at a fee starting at at least 2000.00 USD. Malicious actors looking to get a discounted form of a “road tested” builder are highly attracted to these types of offers.

In addition, we saw a similar attempt at marketing of a RaaS with a posting to a well-known forum offering BlackCat/ALPHV source code for sale. The posting was accompanied with screenshots of what appears to be affiliate tools for delivery and management of BlackCat payloads.

It will take time before the full reach and repercussions of these particular leaks are understood. Any lowering-of-the-bar around these tool sets inevitably attracts more enterprising criminals for whom these tools may have been out of reach prior.

Elsewhere, a portal for the creatively named “Going Insane Ransomware” emerged this month. For those that recall the late 1990s, “Going Insane” appears to embrace the GeoCities aesthetic with a decidedly ‘90’s’ take on the layout of their site.

The group is actively recruiting and advertises its affiliate program (RaaS) with the following feature set (quoted):

• Military-grade AES encryption
• Encrypts All Files, Every single one, under lock and key.”
• Spreads in network, Infects every device in the network.”
• Wallet Stealer
• Browser Stealer
• System Info Stealer
• Auto Parsed Cookies
• Fully Undetected, bypasses all AVs
• FUD (0 detects) forever ig

Recommendations

SentinelOne Singularity Endpoint detects and prevents attacks associated with known Zeppelin/Buran, ALPHV and Insane RaaS. Defenders and threat hunters may find the following additional indicators useful for GIR ransomware.

nv5lbsrr4rxmewzmpe25nnalowe4ga7ki6yfvit3wlpu7dfc36pyh4ad[.]onion
gfksiwpsqudibondm6o2ipxymaonehq3l26qpgqr3nh4jvcyayvogcid[.]onion
r2ad4ayrgpf7og673lhrw5oqyvqg4em2fpialk7l7gxkasvqkqow4qad[.]onion
insane[@]cock[.]lu

Drainers and Accounts Takeovers

Recently, a swath of account takeover attacks has swept through Twitter/X, leading to the compromise of several high-profile accounts. These accounts have been manipulated to disseminate content centered on cryptocurrency scams, orchestrated by groups known as crypto-drainers, or Drainers as a Service (DaaS).

Victims of these attacks include prominent entities such as CertiK, the SEC and cybersecurity vendor Mandiant.

The methods used to compromise accounts vary, ranging from brute-forcing credentials in cases without Multi-Factor Authentication (MFA) to SIM-swapping where MFA is enabled.

While the concept of Drainers and DaaS is not new, the recent high-profile breaches have cast a renewed spotlight on these malicious activities. The attackers are evidently motivated to target high-traffic accounts, aiming to redirect more users to their malevolent sites, as indicated by the increased click-through rates on the fraudulent posts linked to these hijacked accounts.

The initial vector for these attacks is typically via phishing followed by device takeovers through techniques such as SIM swapping.

Ultimately these attacks have a far reaching effect beyond just the financial loss of those that fall victim to the scam. Reputable brands that have accounts taken over by these criminals are at risk of reputational harm which could in turn have a financial impact.

Access Brokering and Tools

We continue to see the market for corporate and enterprise-level access flourish, to the point where buyers are soliciting for an opportunity to purchase from the plentiful well of providers. Buyers are currently trying to outbid each other for access either by offering greater fees or taking lower percentages.

Those that are selling such access are profiting from targeting unprotected services such as IAM and reaping great rewards. It truly is a seller’s market out there at the moment, which is a worrying sign for defenders.

Concurrently, we continue to observe the marketing and use of customized “AV/EDR-killer” style tools. Tools like auKill and BackStab are frequently found amongst the artifacts left behind after a long-term ransomware attack or even an ATP campaign.

Recommendations

So-called AV/EDR “killer” tools typically rely on BYOD (Bring your own driver) functionality and additional components such as Process Explorer, Zemana and others. This makes them highly visible to well tuned platforms like SentinelOne Singularity. Ensuring that the organization has good visibility into endpoint processes along with anomaly detection can provide additional safeguards against such tools.

For more information on Drainers and DaaS, defenders are encouraged to review The Rise of Drainer-as-a-Service | Understanding DaaS.

Law Enforcement and Disruption

It’s not all doom and gloom! Fortunately, there have been some important disruptions in the cybercrime landscape over late December and throughout January.

The main figurehead of the ShinyHunters threat group, Sebastien Raoult, was sentenced to 3 years in prison, along with having to pay requisite restitution. The group has an extended history of compromising developer repositories to steal API keys and other credentials. Raoult (alias “Sezyo Kaizen’) was found guilty of selling or facilitating the sale of breached company data across multiple platforms and markets. This includes well-known markets such as Alpha and Empire as well as forums like XSS and RaidForums.

Also this past month, a new decryption tool for the Tortilla variant of Babuk (aka Babuk Tortilla) has been released. The tool is the result of a collaboration between Cisco Talos, the Dutch Police and Avast. Following the apprehension of the actor associated with this particular variant of Babuk, Talos was able to work with Avast to expand the existing decryptor to accommodate the newly gained insight into other Babuk variants.

The Babuk Tortilla decryptor tool is available for download via the NoMoreRansom project.

Conclusion

The first month of 2024 has seen a continuation of the trends we’ve been highlighting across the last quarter of 2023. The increasing availability of tools that lower the barrier to entry for cybercriminals continues to fuel a crimeware ecosystem in which relatively unskilled threat actors can carry out low-risk/high-reward attacks on unprepared organizations.

The uptick in ‘Drainer-as-a-Service’ offerings and attacks is an extension of the service model popularized by ‘Ransomware-as-a-Service’ to target the widespread use and popularity of cryptocurrency, a model that seeks to steal from individuals but harnesses corporate assets to reach a large audience through social media account takeovers. As we often note, where there is money, an enterprising criminal will look for a way.

Organizations can improve their security posture, protect their assets, and avoid being the next victim on the list through awareness, training and suitable security technology. To stay informed and receive our next update, follow us on social media. To see how SentinelOne can help secure your business, contact us or request a free demo.

As the opening ceremony of the 2024 Paris Summer Olympics fast approaches, organizers are immersed in intense preparations on the cyber front. Such a prominent, international event makes for a vast attack surface that holds enticing opportunities for cybercriminals.

As it stands, the 2024 Olympic and Paralympics are currently projected to boast a count of 9.7 million spectators across 40 official sites. While France will enjoy the global spotlight for nearly two months, every aspect of planning and hosting the Games requires cybersecurity to be a top priority for the organizers.

In this blog post, we discuss the evolution of cyber threats that have played out over the last two decades and how they will inform the digital security of this year’s Games, including threat techniques, current geopolitical motivations, and effective countermeasures available.

A Timeline of Attacks

The spirit of competition and athletic celebration may unfold on Olympic grounds, but another type of race between threat actors and cybersecurity teams runs parallel, away from the main stages. Cybersecurity threats and attacks have loomed over the past two decades’ worth of Games, affecting athletes, attendees, and the underlying digital infrastructure that sustains the Olympics. Here are some of the most infamous cyber activities from the past seven Games showcasing various cyber challenges that Paris game planners may face:

2008 Summer Olympics (Beijing, China)

The Beijing 2008 Olympic Games marked the first instance of publicly reported malicious cyber operations during the Olympics. A cyber espionage campaign known as “Operation Shady Rat” targeted the International Olympic Committee (IOC) and various Western and Asian Olympic Committees. Possibly focused on information gathering, this campaign spanned from 2006 to 2011 and included the targeting of the World Anti-Doping Agency (WADA) in August 2009. Although the ultimate goal is still unclear, the operation has been associated with Chinese state-sponsored cyber activities.

The Beijing Olympics also witnessed lucrative malicious operations, including fraudulent ticket websites, spear phishing, and deceptive streaming platforms. These activities were attributed to opportunistic intrusion efforts, all capitalizing on the illicit money-making opportunities presented by the major event.

2012 Summer Olympics (London, United Kingdom)

While cyber incidents had been observed in previous editions, the 2012 London Olympics brought the notion of cyber threats into sharp focus for the Olympic community. Of the 212 million cyberattacks mounted during the event, a notable 40-minute distributed denial-of-service (DDoS) attack disrupted the power systems of the Olympic Park on the second day of the Games.

Opportunistic actors also engaged in lucrative malicious operations that impacted the public, employing phishing campaigns that enticed individuals with a chance to win free airline tickets for the London Summer Olympic Games by participating in a fake survey.

2014 Winter Olympics (Sochi, Russia)

Leading up to the Sochi Olympics, there were indications of cyber threats, raising concerns about the security of IT systems. Reports shortly surfaced that cyber espionage activities were targeting various organizations associated with the Olympics. The U.S. State Department issued a travel alert for the 2014 Sochi Winter Olympics, cautioning U.S. travelers about cybersecurity threats in the region. The alert specifically advised individuals to exercise caution when sharing sensitive or personal information on Russian electronic communication networks.

Following the Winter Olympics in Russia, an open-source report highlighted a cyber espionage campaign, accusing Russian intelligence services of gathering information on Olympic organizations, judges, journalists, spectators, and athletes.

2016 Summer Olympics (Rio de Janeiro, Brazil)

Before the Rio Olympics, concerns were voiced regarding the security of IT systems, including the potential for DDoS attacks. While the event itself did not witness any significant cybersecurity incidents reported, affiliated organizations saw a series of long-duration (540 Gbps) DDoS attacks in the months leading up to the Games.

Also of note, a sophisticated cyberespionage campaign orchestrated by APT28, an intrusion set associated with Russian military intelligence (GRU), was revealed by the World Anti-Doping Agency (WADA) two months after the Games. Hacktivist groups, including Anonymous Brazil, played a role in campaigns targeting the Brazilian Federal government and the Ministry of Sports, resulting in the exposure of personal and financial data.

Anonymous Brazil voiced grievances against the Games, citing insufficient investments in favelas and excessive spending on Rio 2016. Additionally, cybercrime operations targeted the public and organizations affiliated with the Rio Olympics, with security analysts noting an 83% increase in phishing URLs in Brazil before the Olympics, compared to a 13% increase globally.

2018 Winter Olympics (Pyeongchang, South Korea)

The opening ceremony of the Pyeongchang Winter Olympics witnessed a significant cyber attack that disrupted the event’s IT systems, including Wi-Fi, ticketing, and the official website. This attack was strategically designed to create chaos by destroying data and disrupting essential operations.

Executed through the malicious worm dubbed “Olympic Destroyer”, the official Olympic website was taken offline and the Wi-Fi service within the stadium was rendered inoperable. As well, live broadcast systems faced disruptions, leading to the denial of access to ticket printing for many spectators during the opening ceremony.

2021 Summer Olympics (Tokyo, Japan)

The Tokyo Olympics, rescheduled by a year due to the COVID-19 pandemic, emerged as a lucrative target for cyber attacks. The event witnessed a staggering 450 million cyber threats, a figure two and a half times higher than the reported number of cyberattacks during the London Olympics in 2012. Most notably, researchers uncovered a phishing attempt during the Tokyo Olympics, where cybercriminals were selling the “Olympic Games Official Token”. Invention of this fake “token” revealed that cyber criminals were testing new and sophisticated schemes to target individuals.

A year before the Games, reports of an espionage campaign attributed to the GRU-linked Sandworm APT, targeting officials and organizations involved in the Tokyo Olympics. In addition, threat actors sought to deploy wipers configured to specifically target Japanese-set computers and erase sensitive files.

2022 Winter Olympics (Beijing, China)

Prior to the Winter Olympics, the FBI recommended that athletes use temporary cell phones instead of personal devices, cautioning against the use of personal data on these temporary devices. Researchers identified vulnerabilities in the Chinese application My2022, mandatory for all attendees to install on their mobile devices during the Olympics. Exploiting these vulnerabilities could potentially grant access to personal and medical data.

Understanding the Geopolitical Discord Amongst Olympic Participants

Geopolitical tensions cast a profound shadow of influence on the Olympic Games, significantly impacting both the event’s dynamics and its cybersecurity landscape. Since the Olympics provide a global stage, it often becomes a battleground for nations to express political ideologies, ambitions, and conflicts.

Heightened geopolitical tensions amplify the attractiveness of the Olympics as a target for cyber threats. State-sponsored actors often exploit vulnerabilities in digital infrastructures to extend their target far beyond the organizing committees to reach athletes, spectators, and affiliated organizations, too.

Impact of the Russian War on Ukraine

Between 2018 and 2022, Russia faced an Olympic ban, preventing its participation under its national flag due to a state-sponsored doping scheme involving Russian athletes during the 2014 Sochi Games. This ban mirrored the decision taken by the International Olympic Committee (IOC) and the World Anti-Doping Agency (WADA) in 2014, which resonates in the 2024 Paris Olympics ban on Russia and Belarus following their 2022 invasion of Ukraine.

The suspension of the Russian Olympic Committee resulted from its oversight of sport organizations in four occupied Ukrainian regions. While Russia and Belarus athletes are permitted by the IOC to compete as “Neutral Individual Athletes”, geopolitical tensions raise concerns about potential retaliatory cyber operations.

Amidst France’s support for Ukraine in its defensive stance against Russia, there’s a looming possibility that the 2024 Paris Olympics could become a target for Russian and/or Belarus cyber operations. These operations, acting as potential retaliation measures, might come to pass as acts of disruption and sabotage with the aim of undermining France’s international reputation.

Impact of the Azerbaijan-Armenia Border Conflict

France’s involvement in the Azerbaijan-Armenia (Nagorno-Karabakh) conflict has faced criticism from Azerbaijan for its perceived bias towards Armenia. In November 2023, French state digital watchdog, Vignium, linked a disinformation campaign smearing the Paris 2024 Olympic games to Azerbaijani-based actors. Their investigation in late July was prompted by the widespread sharing on X of visuals urging a boycott of the 2024 Olympics.

The campaign utilized images depicting riots, the city of Paris, and the Olympic Games logo, employing three official X accounts of the Games and two hashtags, #paris2024 and #boycottparis2024. Between July 26 and 27, over 1,600 posts featuring these visuals or hashtags surfaced on X, with around 90 accounts believed to be involved in what the report called “artificial amplification”.

The Risks Targeting the Olympic Podium

Since at least Beijing 2008, past Olympic Games have become targets for offensive cyber operations, driven by motives ranging from cyber espionage, destabilization, or economic gain. The upcoming Paris 2024 Games could face a spectrum of malicious cyber operations, ranging from campaigns focused on destabilization, through influence campaigns, malware, and data extortion, to those centered on disruption, including DDoS attacks and disinformation.

Persistent cyber crimes also pose an ongoing risk to the Olympics. These opportunistic crimes exploit the event’s popularity, targeting diverse victims, from the general public to partners and organizers. Lucrative campaigns enticing spectators are much more likely to dish out Olympics-themed phishing, malicious apps, and typosquatted websites mimicking platforms related to reselling, ticketing, or betting activities.

What Solutions Are In Place to Protect the Paris 2024 Games?

To counter the growing concerns for cyberattacks, French authorities are taking concerted measures to secure this year’s Games. Notably, the ANSSI cybersecurity agency is set to collaborate with its Japanese counterpart, the NISC (National Center of Incident Readiness and Strategy for Cybersecurity). This partnership fosters improved dialogue and the exchange of cybersecurity insights, drawing from experiences in other major sporting events.

The COJO (Organizing Committee for the Olympic Games) has also rolled out a cybersecurity strategy based on four pillars: education, training, anticipation, and coordination. Other key parts of their defenses include:

• Awareness-raising events – According to Franz Regul, CISO for the Paris 2024 Games, training courses promoting cyber awareness will be set to combat phishing, spam, online scams which represent the initial means of compromise to 80% of cyberattacks.
• Security Operations Center (SOC) – The newly established SOC will be tasked with continuously monitoring all Olympic digital ecosystems. SO far, ANSSI has budgeted 17 million euros towards SOC services, which will revolve around nearly 12000 workstations spread across security sites for the duration of the Games.
• AI-based tools – The SOC will use AI-based tools to detect signs of suspicious or malicious activity, track signs of compromise, and orchestrate incident response.
• Olympic Management System (OMS) – The OMS manages access to events with all requests submitted to the Service National des Enquêtes Administratives de Sécurité (SNEAS) for final approval and badge issuing.
• Olympic Diffusion Systems (ODS) – This application is dedicated to disseminating information and results in real time to the media and spectators to avoid any misinformation.
• Improved ticket sales policies –
  • A hopeful buyer has only 48 hours to buy their ticket after being selected by random draw in order to streamline online traffic. Only 30 tickets may be purchased per account to mitigate mass resales.
  • All resales must be conducted via the official resale site to prevent forgery and manage existing tickets.
  • Tickets are 100% digital and will only be sent to purchasers a few weeks before the start of the event.

Applying Cybersecurity Lessons Learned for Paris 2024

For Paris 2024, preparing for cybersecurity threats involves a multi-faceted approach combining a mix of infrastructure security, data protection, and collaboration.

Infrastructure & Network Security

The IT infrastructure of the Paris 2024 Olympics includes a complex network of systems handling everything from scoring and timing to broadcasting and ticketing. Protecting this infrastructure involves deploying advanced network security solutions, including intrusion detection systems, firewalls, and real-time monitoring tools through security operation centers (SOCs).

Data Protection & Privacy

With the vast amount of personal data processed during the Olympics, including that of athletes, officials, and spectators, data protection and privacy are critical. This involves implementing stringent data security measures, such as advanced encryption, robust access controls, and continuous monitoring for data breaches. Compliance with international data protection regulations, such as the GDPR, is also crucial.

Global Cybersecurity Alliances

Cybersecurity for such a massive event cannot be siloed. Collaboration among various international entities, including cybersecurity firms, government agencies, and international sports bodies, is essential. This collaboration involves sharing intelligence on emerging cyber threats and best practices for mitigation.

The organizing committee of Paris 2024 is working in tandem with international cybersecurity organizations, leveraging their expertise and resources. These alliances enable the sharing of intelligence on emerging cyber threats and coordinated responses to potential attacks.

Advanced Cyber Defense Technologies

In anticipation of the 2024 Summer Olympics, Paris is gearing up for heightened, AI-based technological surveillance. The French government will be deploying an extensive network of cameras integrated with artificial intelligence (AI) tasked to closely watch over crowds and public areas and alert authorities to any signs of suspicious activity.

The recently approved Loi JO 2024 legislation, enacted earlier in 2023 permits the real-time application of algorithmic analysis to camera footage, enabling the identification of predetermined events that may pose a threat to public order. The surveillance system is slated to operate until March 2025, extending its functionality for six months after the close of the Games.

Simulation & Response Planning

GICAT (Group of French Industries for Land and Air-land Defense and Security), one of many tech solution providers associated with the Games, has confirmed nearly eight billion cybersecurity tests. These simulations, often referred to as red teaming, involve mimicking real-world cyberattacks to test the resilience of the cybersecurity infrastructure. This proactive approach allows the cybersecurity team to identify vulnerabilities and refine their response strategies, ensuring they are well-prepared for various attack scenarios.

Conclusion

The cybersecurity framework for Paris 2024 is not just about safeguarding IT infrastructure; it’s about protecting the very essence of the Olympic spirit — fair play, honor, and global unity. Cyber threats not only pose a risk to the operational aspects of the Games but also threaten the safety and privacy of the participants and spectators.

The Paris 2024 Olympics presents a unique set of challenges and opportunities in cybersecurity. As we move closer to this international spectacle, security leaders and game organizations will continue to glean the lessons learned from past Olympics and prepare for both opportunities and advanced persistent threats.

SentinelOne is trusted by global enterprises and organizations responsible for safeguarding large-scale events with complex security requirements. To learn more about how SentinelOne protects digital ecosystems through AI-driven detection and response capabilities, deep visibility, and data enrichment, contact us today or book a demo.