Champions League Final faces hacking threat: VPNFilter malware could bring down the Real Madrid versus Liverpool game

Bobby Hellard Read more May 24, 2018

Russia is preparing a large-scale cyberattack on Saturday’s Champions League final in Kiev, according to Ukrainian state security.

Champions League Final faces hacking threat: VPNFilter malware could bring down the Real Madrid versus Liverpool game

The Ukrainian Security Service (SBU) accused the Russian government of “cyber aggression”, with the aim of infecting hardware and “destabilising” Ukraine’s hosting of the match between Real Madrid and Liverpool.

The statement came just hours after networking giant Cisco’s cybersecurity division, Talos, warned that hackers had infected some 500,000 internet routers and storage devices, mainly focusing on Ukraine, with state-developed malware called VPNFilter.

Talos said it was releasing the information before fully completing its investigation because of the urgent need to prevent the potential attack.

“Both the scale and the capability of this operation are concerning,” Talos said. “The malware has a destructive capability that can render an infected device unusable, which can be triggered on individual victim machines or en masse, and has the potential of cutting off internet access for hundreds of thousands of victims worldwide.”

VPNFilter is a multi-stage, modular platform, the first stage of which can survive a device reboot, which sets it apart from other malware, Talos said. Once it gains a foothold in a device, it deploys other stages of the malware, which can steal website credentials and even cause infected devices to self-destruct.

While Talos didn’t say who was behind VPNFilter, it did say the malware shared similarities with BlackEnergy, which destroyed a huge part of Ukraine’s power grid in 2015, an attack Ukraine linked to Russia at the time.

“The type of devices targeted by this actor are difficult to defend,” Talos added, saying VPNFilter had grown quietly since 2016. “They are frequently on the perimeter of the network, with no intrusion protection system (IPS) in place, and typically do not have an available host-based protection system such as an anti-virus (AV) package.”

As yet, no details have been released as to how the attack would affect the final.

Earlier in the year, Russian spies were accused of hacking South Korea’s hosting of the 2018 Winter Olympics in South Korea. The attack caused large disruption to the opening ceremony, affecting TV and web broadcasting, knocked out display monitors, Wi-Fi networks and the Winter Olympics official website.