How Soccers 2022 World Cup in Qatar Was Nearly Hacked

A China-linked threat actor had access to a router configuration database that could have completely disrupted coverage, a security vendor says.

About six months before the 2022 FIFA World Cup soccer tournament in Qatar, a threat actor — later identified as China-linked BlackTech — quietly breached the network of a major communications provider for the games and planted malware on a critical system storing network device configurations.
The breach remained undetected until six months after the games, when researchers at NetWitness spotted it during a routine audit for the service provider. During that period, the cyber-espionage group gathered up an unknown volume of data from targeted customers of the telecommunications provider — including those associated with the World Cup and vendors providing services for it.
But its the what else could have happened thats the really scary part, says Stefano Maccaglia, global practice manager, incident response, at NetWitness, discussing the incident for the first time with Dark Reading recently.
The access that BlackTech had on the telecom providers system would have allowed the threat actor to completely disrupt key communications — including all streaming services associated with the game. The fallout from such a disruption would have been substantial in terms of geopolitical implications, brand damage, national reputation, and potentially hundreds of millions of dollars in losses from the licensing rights and ads negotiated prior to the World Cup, Maccaglia says.
We are normally very collected, but in this case, we were terrified, Maccaglia says of NetWitness discovery. The threat actor literally had their finger on the button but didnt push it.
NetWitness involvement in the Qatar World Cup began in 2022, about six months before the event, when several local service providers hired the company to assess the cybersecurity preparedness of some of the supporting IT infrastructure for the games. Like with other security vendors involved in the effort, the telecom provider gave NetWitness access to a substantial portion of its tech stack and environment — but not to all of it.
According to Maccaglia, the NetWitness team detected and remediated several issues on parts of the providers tech stack to which the company had access. But it wasnt until early 2023 that the service provider finally opened up the rest of the environment to NetWitness for additional auditing. This was when NetWitness unearthed log activity suggesting that someone had gained access to the providers network.
The companys subsequent investigation showed the attacker had planted a sophisticated rootkit and a backdoor, dubbed Waterbear, on a critical configuration management database (CMDB) storing device configurations for the providers customers. NetWitness found the attackers had used PLEAD — a remote access Trojan commonly associated with the BlackTech APT — to target additional systems within the environment.
The attacker aimed to control this database [from] the beginning, because it would allow him/her to swap configurations on the fly and revert them back, once finished, leaving no traces, Maccaglia says.
BlackTech is a threat actor that the US Cybersecurity and Infrastructure Security Agency (CISA) last year identified as a threat to organizations in the telecommunications, technology, media, electronics, and industrial sectors. In an advisory, CISA described the threat actor (aka Radio Panda, Circuit Panda, Temp.Overboard, and Palmerworm) as particularly
adept at modifying router malware without detection
and the exploiting routers domain-trust relationships to gain access to victim networks. BlackTech actors TTPs include developing customized malware and tailored persistence mechanisms for compromising routers, CISA noted. These TTPs allow the actors to disable logging and abuse trusted domain relationships to pivot between international subsidiaries and domestic headquarters networks.
In the attack on the telecom provider in Qatar, BlackTech actors used their access to the CMDB to change configurations on Asus routers associated with various organizations in such a manner as to make systems belonging to these organizations become accessible over the Internet. They then uploaded PLEAD — concealed in legitimate looking software updates from Asus — to these systems by modifying the DNS resolution of asus.com. The threat actor then leveraged PLEAD to steal data from the victim organizations. Among the systems infected in this manner were those associated with the World Cup games. The attackers would change the router config details for a few hours at a time and then revert back to the original rules to minimize the chances of detection, Maccaglia says.
The fact that no one was able to spot the intrusion in the months leading up to the World Cup, during the event, or for months later is worrisome, Maccaglia says. With the countdown for the 2024 Summer Olympics well underway, it is imperative that the entire technology stack supporting the games be vetted for security issues, he says.
The Olympics, like other major sporting events, such as the
Super Bowl
, have become huge cyberattack targets in recent years. In 2019, for instance, a threat group later identified and
linked to Russias military intelligence
also attempted to disrupt the opening of the
Winter Olympics
in South Korea after Russian athletes were banned from participating over doping concerns.
As we saw with the World Cup, threats can live in obscure places and keep a very low profile, Maccaglia says, adding, You cant find what you arent allowed to look for, in advocating for broader visibility for companies like NetWitness into the entire supporting infrastructure for the game.
When you behave as if theres always a threat present, you put yourself in a position to mitigate damage and, potentially, get ahead of the threat in the environment, he says. This will be critical for the 2024 Summer Games.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
How Soccers 2022 World Cup in Qatar Was Nearly Hacked