Global threat intelligence experts say rogue actors from Russia and Iran will target the Fifa World Cup as part of an ongoing anti-US position.
This year’s tournament takes place across the United States, Canada and Mexico, and is expected to face multiple acts of cyber terrorism during the competition.
Security experts have also warned that the use of drones could fuel domestic, physical terrorism alongside any digital threats targeting the event.
A report by Unit 42, titled “Discussing the world’s biggest game’s attack surface”, found that Russia-linked hack accounts have previously targeted NATO members and events including the Ukraine Peace Summit and the Paris and Milan Olympic Games.
Two of the three World Cup host nations are members of NATO, raising particular concern about the vulnerability of the tournament’s broader infrastructure.
Iranian hackers have reportedly been targeting “small municipal authorities”, which could impact “water, wastewater and energy infrastructure” across host cities during the competition.
Unit 42’s Justin Moore told City AM that “geopolitical tensions mean we are monitoring active interest from state-backed and proxy threat actors” connected to both countries.
Moore added that “Russia may have been banned from competition, but it’s been running cyber interference in global Sport since long before Ukraine.”
“Similarly, from destructive attacks to disinformation, Iran is running a full campaign, and the World Cup could be a target given the highly volatile geopolitical climate,” Moore said.
Iran will compete in the World Cup despite ongoing conflict in the Middle East, with their matches scheduled for the West Coast of the United States.
Russia remains banned from the tournament, though President Trump previously touted their potential return during the World Cup cycle amid Ukraine-related peace talks in Alaska.
Moore warned that “cybercriminals get excited by the mass exploitation of worldwide sporting events because they’re great at exploiting human psychology for financial gain.”
He added that hacktivists may attempt disruptive DDoS attacks to generate headlines, but the majority of anticipated cyber activity will come from financially motivated criminals deploying ransomware and ticketing scams.
“The risk isn’t about an inevitable disruption, but rather a reminder of why early, coordinated digital readiness across the entire host-city ecosystem is so critical,” Moore concluded.
The tournament, which begins next month, has already attracted controversy surrounding immigration, visas, tickets, transport and geopolitical stances from various competing nations.