Blogs

Blog

How Mergers and Acquisitions Expand Your Attack Surface Overnight

This post details how M&A activity can turn an acquisition target into an entry point into your environment and how to identify and reduce that exposure before it’s leveraged by threat actors.

M&A activity introduces immediate external exposure.

As soon as a deal is announced, the target’s infrastructure, access points, and identity footprint become relevant to a larger organization. Threat actors track acquisition activity and begin probing newly relevant environments quickly, often before integration planning is complete.

In one recent case, an external assessment of an acquisition target identified a publicly accessible VPN management interface tied to known exploited vulnerabilities. The configuration allowed session hijacking without credentials and had not been identified during internal reviews or due diligence. It was remediated within 24 hours of discovery.

The issue was reachable from the internet and aligned with active exploitation.

What Changes During an Acquisition

From a security perspective, the environment does not change at announcement. The context around it does.

The same systems, credentials, and configurations now sit within:

• A higher-value organization
• A broader identity and access ecosystem
• A timeline where ownership and responsibility are shifting

That shift is enough to change how the environment is targeted.

Threat actors monitor acquisition activity because it helps them prioritize. A smaller organization with uneven controls becomes more valuable once it is tied to a larger parent. Access pathways that previously led to a limited environment may now provide a stepping stone into something much larger.

How Adversaries Approach M&A Activity

Observed behavior around acquisitions is consistent across sectors.

Actors look for environments that:

• Expose remote access infrastructure (VPN, RDP, administrative interfaces)
• Contain credentials already circulating from infostealer infections
• Run edge devices tied to known exploited vulnerabilities
• Maintain assets that are reachable but not actively monitored

They do not need full network visibility. They work from what can be discovered externally and validated quickly.

In several cases, ransomware operators and access brokers have been observed scanning for specific device types or software versions shortly after acquisition announcements, aligning targeting with known exposure patterns.

Why Traditional Due Diligence Doesn’t Surface This

Due diligence produces a structured view of security posture. External exposure requires a different lens.

Most diligence processes rely on:

• Self-reported controls
• Point-in-time vulnerability data
• Documentation of architecture and policy

They rarely include:

• Direct validation of internet-facing systems
• Mapping of externally reachable assets
• Alignment with current exploitation activity

This creates a gap between what is documented and what is accessible.

The exposure that matters most during this phase tends to sit outside formal reporting: edge infrastructure, unmanaged assets, and access points that have not been recently validated.

The Role of Identity in M&A Risk

Identity expands alongside infrastructure. Employee credentials tied to the target organization may already be compromised through infostealer infections. Those credentials often include:

• Corporate email and password combinations
• Session cookies tied to SaaS platforms
• Autofill data and device metadata

Once an acquisition is announced, those credentials become more valuable. They are tested against:

• VPN gateways
• Cloud platforms
• Internal applications exposed through remote access

Where Exposure Persists

Across M&A activity, a few categories show up consistently when environments are assessed externally.

Remote access remains one of the most reliable entry points. VPN gateways and administrative interfaces are frequently exposed and often lag behind patch cycles tied to active exploitation.

Edge devices introduce additional risk. Firewalls, load balancers, and network appliances are commonly targeted when they run software associated with known exploited vulnerabilities.

Untracked infrastructure also plays a role. Smaller organizations often maintain systems outside formal asset inventories. These systems remain reachable and are rarely monitored closely.

These conditions are present before integration begins and remain in place until they are actively addressed.

Timing and Execution

The period immediately following an announcement carries the highest concentration of unknowns.

• Security ownership is in transition.
• Monitoring coverage may not extend across the target environment.
• External exposure remains unchanged.

At the same time, the environment is receiving more attention.

In the earlier example, remediation occurred within a day of discovery. Without that visibility, the same exposure would have remained available during a period of increased interest.

What This Looks Like in Practice

The teams that manage M&A risk effectively start from the outside and move inward.

The first step is establishing visibility into the target’s external footprint as soon as a deal becomes public. This includes identifying internet-facing infrastructure, exposed services, and access points that can be validated directly.

From there, the focus shifts to prioritization. Exposure is evaluated based on exploitability and alignment with current attacker behavior. Systems tied to known exploited vulnerabilities, remotely accessible services, and credential-based access paths rise to the top quickly.

Validation follows. Exposed systems are confirmed, configurations are reviewed, and access pathways are tested to determine what is actually reachable.

Once confirmed, response is immediate. High-risk exposure is remediated or restricted without waiting for integration milestones or broader security alignment.

This sequence is consistent across environments:

• Establish visibility into internet-facing assets early
• Validate exposed services and access points directly
• Prioritize based on exploitability and active targeting
• Act on confirmed exposure as soon as it is identified

Teams are at an advantage when they start this work while the environment is still limited in scope and before external attention translates into access.

See It in Your Environment

M&A activity introduces risk on a compressed timeline. External exposure does not wait for integration plans, and neither do attackers. If you’re supporting acquisitions, the first step is understanding what is already visible and reachable from the outside.

Flashpoint helps security and threat intelligence teams map internet-facing assets, identify exposed access points, and prioritize risk based on real-world exploitation and adversary activity.

Request a demo to see how Flashpoint supports acquisition-driven risk assessments, so you can identify and reduce exposure before it becomes an incident.

Request a demo today.

Blogs

Blog

The Evolution of the Geotag: How AI is Bridging the Gap in Location-Based OSINT

In this post, we explore how the decline of geotagged data is reshaping location-based OSINT, the intelligence gaps it creates for analysts, and how AI-driven keyword generation and geofencing are restoring visibility into real-world events.

For years, location-based open-source intelligence (OSINT) has relied heavily on a steady stream of user-generated geographic data. Geotagged social media posts with embedded latitude and longitude coordinates have long been a goldmine for tracking regional trends, monitoring real-time events, and understanding on-the-ground public sentiment. Intelligence professionals and data scientists have historically used this passively-generated location-based data to aggregate real-time insights for everything from tracking public sentiment to monitoring natural disasters.

However, the era of effortless geographic tracking is coming to an end. Geotagged social media data is becoming increasingly scarce, making it significantly harder for security teams to gather a complete picture of location-based intelligence.

The Decline of Location Sharing

The primary driver behind the diminishing use of geotags is a massive shift in digital privacy standards. For instance, major platform-level policy interventions, such as Apple’s November 2021 iOS privacy update, changed the default consent model for device tracking. Instead of requiring users to actively opt out of location tracking, iPhone users must now explicitly opt in.

As a result of these strengthened privacy controls, a massive behavioral shift occurred: within a year of the iOS update, 62% of affected users chose to opt out of location tracking entirely. This platform-mediated behavioral barrier has drastically reduced the availability and visibility of granular location traces, creating complex new blind spots for researchers and intelligence analysts.

The Intelligence Gap

With precise coordinates disappearing from social feeds, security practitioners and OSINT investigators are left facing a major data void. Relying purely on traditional keyword or hashtag searches to find location-specific events is highly inefficient. In fact, as little as 7% of social media posts actually contain hashtags. If an analyst is scanning 10,000 posts a day looking for a specific hashtag, they could be missing up to 9,300 posts that hold critical intelligence.

To compensate for missing geotags, security practitioners have traditionally had to spend valuable time performing manual, tedious searches for specific local details like street names, landmarks, and local businesses to figure out where an event is taking place.

Bridging the Gap with AI

To overcome the increasing scarcity of explicit location data, the intelligence industry is leveraging artificial intelligence and spatial technologies.

AI-powered keyword optimization tools like Echosec’s new AI-powered “Optimize” feature are designed specifically to bridge this data gap. Instead of relying on users to share their precise coordinates, AI automatically generates hyper-relevant, location-based keywords for an investigator’s search. If an analyst is looking into a specific neighborhood, the AI will suggest relevant landmarks, tourist attractions, schools, government buildings, and businesses to monitor. This instantly converts manual, time-consuming research into an automated process, significantly increasing the volume and relevance of the data collected.

Geo-Based OSINT 2.0

Geo-based search combined with AI keyword generation is taking OSINT to the next level. Geofencing allows teams to draw virtual perimeters around physical sites, such as corporate offices, foreign meeting sites, or public gatherings, to monitor digital activity strictly within those areas. This means you don’t need to know what keywords or hashtags you are looking for; you only need to know where to look. This is incredibly valuable for real-time executive protection and monitoring civil unrest, as it surfaces visual intelligence and early warnings directly from the scene, cutting out irrelevant noise.

The Future of OSINT for Situational Awareness

The decline of the geotag is a victory for consumer privacy, but it isn’t the end of location-based intelligence. By leveraging AI-driven keywords and hyper-local geofencing, security teams can move beyond broad geographic searches. These smart tools alleviate research bottlenecks, allowing analysts to redirect their expertise away from exhaustive data hunting and toward the critical analysis needed to respond to threats before they escalate. The geotag may be fading, but our situational awareness remains sharper than ever.

Don’t let the intelligence gap compromise your situational awareness. Ready to move from tedious manual searches to immediate, actionable insights? Book your Echosec demo today and empower your team with the next generation of location-based insight.

Request a demo today.

Blogs

Blog

Navigating the Threat Landscape of the 2026 FIFA World Cup

In this blog, we break down emerging threat activity, protest movements, cyber risks, and operational challenges shaping the security environment for the 2026 FIFA World Cup.

Updated June 2026

The 2026 FIFA World Cup will be unlike any tournament before it.

Set to run starting next month from June 11th to July 19th across the United States, Canada, and Mexico, this will be the first World Cup co-hosted by three nations and expanded to 48 teams across 16 host cities. More than five million fans are expected to attend matches in person, with billions more engaging globally.

That scale introduces a different class of risk. The World Cup is a distributed, high-visibility global operation spanning stadiums, transit systems, hotels, fan festivals, and digital infrastructure.

At the time of writing, Flashpoint analysts have not identified any specific, credible threats targeting the tournament. However, recent extremist propaganda and geopolitical tensions continue to reinforce the need for heightened vigilance across host nations.

A Converging Threat Environment

The risks surrounding the 2026 World Cup intersect across multiple domains.

Physical security, cyber activity, geopolitical tensions, and social movements all operate against the same infrastructure and audiences. Activity in one area can quickly affect another.

Flashpoint assesses that the most persistent risks across all host nations include:

• Crimes of opportunity targeting visitors unfamiliar with local environments
• Lone-actor attacks, including those driven by extremist ideologies
• Overcrowding, fan conflicts, and unmanaged gatherings
  

These risks are amplified by the tournament’s scale and geographic distribution.

Civil Unrest and Protest Activity

World Cup tournaments routinely become platforms for protest.

For 2026, multiple movements are already organizing around the event:

• “Boycott USA 2026” campaigns and groups like CODEPINK are calling for relocation of matches
• The “50501 Movement” has signaled intent to leverage the tournament’s visibility for national demonstrations
• Coalitions of civil society organizations have raised concerns around immigration enforcement, surveillance, and civil rights
  

Recent organizing activity has expanded beyond traditional anti-FIFA campaigns. Civil rights organizations, labor groups, anti-ICE coalitions, and community organizations in multiple host cities have announced or promoted demonstrations tied to immigration enforcement, displacement concerns, labor issues, and the broader social impacts of the tournament.

In the United States, Flashpoint analysts assess with high confidence that protests will occur across all host cities, with messaging tied to immigration policy, labor issues, and geopolitical tensions.

In Canada and Mexico, protests tied to environmental concerns, infrastructure impact, and global conflicts are also expected.

At this stage, most campaigns remain organizational rather than operational. But the scale of the event means even localized demonstrations can escalate quickly, especially around stadiums, transit hubs, and fan zones.

Physical Security and Crowd Risk

No specific terrorist plots have been identified. But that does not reduce the risk.

Large gatherings remain attractive targets for:

• Lone actors seeking high visibility
• Opportunistic criminals
• Disruptive fan groups
  

Online chatter continues to reference potential attacks, including decentralized calls for violence from extremist-linked media outlets. Recently, a pro-ISIS media outlet released World Cup-themed propaganda that appeared designed to portray major football venues and international sporting events as symbolic targets, underscoring the continued threat posed by lone actors and extremist-inspired violence.

Beyond intentional threats, crowd dynamics pose a persistent risk. Past sporting events have shown how quickly panic, overcrowding, or pyrotechnics can trigger dangerous conditions, including crowd crush incidents.

Fan culture adds another layer. Organized groups such as Ultras and hooligan firms increasingly operate with coordination, using encrypted messaging, reconnaissance (“spotting”), and off-site meetups to avoid security controls.

Security concerns extend beyond traditional supporter culture. Some organized fan groups have evolved increasingly sophisticated tactics, including coordinated reconnaissance, plain-clothes scouting, encrypted communications, and deliberate efforts to move confrontations away from stadium security zones and into “soft zones” like bars, transit hubs, and other gathering locations.

Geopolitical Tensions and High-Risk Matches

Geopolitics will shape the security environment throughout the tournament.

The ongoing tensions involving the United States, Israel, and Iran are expected to influence both protest activity and threat perceptions. Iran’s participation—particularly matches held in U.S. cities—has already sparked debate, travel concerns, and increased security planning.

The issue extends beyond match security. Visa policies, travel restrictions, diaspora activism, and ongoing debate surrounding Iranian participation have already generated significant discussion among supporters, advocacy groups, and government stakeholders.

Certain matches carry elevated risk due to:

• Historical rivalries
• National identity tensions
• Known fan group activity
  

These matches require heightened monitoring not just inside stadiums, but across surrounding areas where supporters gather.

The Expanding Cyber Threat Surface

The World Cup is also a large-scale digital event.

Even without identified active campaigns, Flashpoint analysts expect the tournament to function as a stress test for global infrastructure.

Key cyber risks include:

• Ticketing fraud: Fake domains impersonating official FIFA platforms
• Phishing and social engineering: Targeting fans, vendors, and staff
• Ransomware and DDoS attacks: Disrupting transit systems, stadium operations, and hospitality networks
• Infrastructure targeting: Exploiting vulnerabilities in public-facing systems
  

Researchers have already identified thousands of fraudulent domains impersonating FIFA-related services, alongside phishing campaigns designed to harvest credentials, hijack accounts, and resell legitimate tickets purchased by victims.

Threat actors are also expected to monetize the event through:

• Fraudulent housing and rental listings
• Rideshare and transportation scams
• Sports betting manipulation and extortion
  

Even minor disruptions to digital infrastructure can have cascading effects on physical operations that cause delayed transportation, overwhelming venues, or other safety concerns.

Operational Security Gaps

Some of the most overlooked risks are also the simplest.

Attendees, staff, and media frequently post images of credentials like press passes, security badges, and access tokens on public social media. These images can be used to replicate credentials and bypass controls.

Similarly, fans often attempt to:

• Access team hotels
• Enter restricted areas
• Interact directly with players

These behaviors create additional pressure on venue and hospitality security teams, particularly in high-profile locations.

Beyond the Stadium: Distributed Risk

The World Cup extends far beyond match venues. Security teams must account for:

• Team base camps and training facilities
• Fan festivals and unofficial gatherings
• Hotels, tourist destinations, and transit systems
• Cross-border travel between host nations
• Increased human trafficking and exploitation risks associated with large-scale international travel and temporary workforces

Unauthorized fan festivals and spontaneous gatherings remain a persistent concern, often drawing large crowds without coordinated security planning.

At the same time, environmental factors including extreme heat, severe storms, flooding, air quality concerns from wildfires, and other weather-related disruptions may affect operations, travel, and crowd safety across host regions.

Getting Ready for the Tournament

The absence of identified threats should not be misinterpreted as low risk.

Events of this scale require continuous monitoring across physical, cyber, and social domains. Threat indicators often emerge early in:

• Online forums and messaging platforms
• Local protest planning
• Fraudulent domain registrations
• Changes in adversary behavior

Effective preparation depends on:

• Broad, multilingual monitoring across open and closed sources
• Correlation between physical and cyber indicators
• Visibility into both high-profile targets and “soft zones”
• Close coordination between public and private sector partners

Flashpoint recommends monitoring key terms such as “World Cup,” “FIFA,” “Fan Festival,” and related hashtags across intelligence platforms to maintain situational awareness.

Preparing for the Whistle

Building a robust threat monitoring architecture is a continuous process. Host cities and law enforcement often use smaller-scale international competitions as test runs to prepare for the scale and complexity of events like the FIFA World Cup.

By leveraging Flashpoint’s advanced search capabilities—including broad keyword coverage, wildcard operators, and visibility into deep and dark web communities—organizations can maintain awareness of emerging risks tied to large-scale events. From stadium infrastructure to digital ticketing platforms, actionable intelligence supports more informed, timely decisions.

To see how Flashpoint enables this level of visibility and monitoring in practice, request a demo.

Request a demo today.