Also known as: tracked as, YoroTrooper, Mustang Panda, T-APT-04, RattleSnake, Voldemort, reportedly sent around 20, they used Voldemort distri, AMOS, CVE-2022-0543, amvinfe at SuspectFile, Snake, Venomous Bear, Group 88, Waterbug, Turla Team, Krypton, Uroburos, SIG23, MAKERSMARK, IRON HUNTER, SnappyClient, Bronze President, Lynx, India, SideWinder, Rattlesnake, APT-C-17
Researchers uncovered a massive fraud ecosystem targeting the 2026 FIFA World Cup, identifying over 4,300 fraudulent domains impersonating FIFA's official website since August 2025. At the center operates GHOST STADIUM, a Chinese-speaking threat actor running a sophisticated phishing campaign across 300+ domains using a pixel-perfect clone of FIFA's authentication system. The operation harvests credentials, sells fake tickets, and processes payments through five distinct channels including cryptocurrency. Estimated losses from premium ticket fraud alone range from $71 million to $474 million, with total campaign losses potentially reaching billions. Six distinct fraud schemes operate in parallel: credential phishing, fake ticket sales, counterfeit merchandise, fake streaming platforms, fraudulent betting sites, and infostealer-driven credential theft. Over 2,513 FIFA account credentials are already circulating on dark-web markets. The campaign exploits Facebook advertising as its primary distribution chann...
Targeted Sectors
Targeted Countries / Regions
No AI analysis yet.
No techniques linked yet.
Satellite Turla
Epic Turla
The 'Penquin' Turla
Witchcoven
RUAG hack
Mosquito
Moonlight Maze
No observed data linked yet.
0
Techniques
44
Tools
7
Campaigns
74
IOCs
0
Observed Data
0
Tactics