Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
Back to malware
MalwareUsed by 4 actorsExploits 1 CVE

OlympicDestroyer

OlympicDestroyer is a destructive self-propagating Windows network worm used in the cyberattack that disrupted infrastructure associated with the 2018 Winter Olympics in Pyeongchang, South Korea. Reported effects included outages affecting Wi-Fi, display systems, the Olympics website, and ticket printing, and the malware also impacted organizations working closely with the Games, including ski resort hotels, a ski resort automation software vendor, and Atos. One attacked ski resort server reportedly controlled ski gates and ski lifts, and researchers assessed that a dedicated ski resort automation server was used as patient zero for the destructive outbreak timed shortly before the opening ceremony on 2018-02-09.

The main malware module consisted of multiple components: a legitimate PsExec tool from SysInternals, credential-stealing modules, and a wiper. It collected passwords from browsers and Windows credential storage, generated new copies of itself containing stolen and newly collected credentials, and propagated laterally to accessible local network systems using PsExec, stolen credentials, and current user privileges. Investigators also observed manual lateral movement before worm deployment using PsExec, stolen credentials, Meterpreter, and PowerShell scriptlets.

The wiper attempted to destroy files on remote network shares for about 60 minutes. It then cleared Windows event logs, reset backups, deleted shadow copies, disabled recovery options and services, and rebooted systems into an unusable state. The malware reportedly did not use persistence, included protection against recurring reinfection, did not destroy local files, and did not wipe its own components.

Associated intrusion activity included spearphishing from at least December 2017 using Winter Olympics-themed malicious Office documents with gibberish text to induce users to enable macros. When enabled, the documents launched cmd.exe and PowerShell to download additional PowerShell stages and backdoor the system. A related victim communicated with an Argentinian command-and-control server over ports 443, 4443, 8080, 8081, 8443, and 8880. Reported infrastructure details included a suspicious domain microsoft******[.]com, use of MonoVM VPS infrastructure, and management of the Argentinian server through a NordVPN exit IP in Norway.

Attribution was heavily contested. Public reporting noted apparent overlaps with NotPetya, BadRabbit, Chinese APT activity, Sofacy, and Lazarus/BlueNoroff. Kaspersky concluded that some of the strongest Lazarus-linked artifacts, including a Rich header fingerprint, were deliberately forged as false flags. Separate retrospective reporting stated the operation was somehow related to Sofacy and that follow-on activity was tracked as a separate entity called Hades, linked to the Zebrocy subset and part of the BlackEnergy/GreyEnergy/Sandworm cluster. High-confidence characterization from the provided content is that OlympicDestroyer was a sophisticated false-flag operation designed both to disrupt Olympic-related infrastructure and to complicate attribution.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES
CVE-2017-0144EternalBlue SMBv1 Remote Code Execution

The main malware module is a network worm that consists of multiple components, including a legitimate PsExec tool from SysInternals’ suite, a few credential stealer modules and a wiper.

via securelistsecurelist.com
THREAT ACTORS

Groups observed using it

4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details
APT38

The main malware module is a network worm that consists of multiple components, including a legitimate PsExec tool from SysInternals’ suite, a few credential stealer modules and a wiper.

via securelistsecurelist.com
APT28

The main malware module is a network worm that consists of multiple components, including a legitimate PsExec tool from SysInternals’ suite, a few credential stealer modules and a wiper.

via securelistsecurelist.com
Lazarus

The main malware module is a network worm that consists of multiple components, including a legitimate PsExec tool from SysInternals’ suite, a few credential stealer modules and a wiper.

via securelistsecurelist.com
Hades

In the past, we have seen sophisticated attacks such as OlympicDestroyer confusing the industry and complicating attribution.

via securelistsecurelist.com
MITRE ATT&CK

Techniques & procedures

21 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique
T1566.001Spearphishing AttachmentEvidence1

Since December 2017 security researchers have been seeing samples of MS Office documents in spearphishing emails related to the Winter Olympics uploaded to VirusTotal. The documents contained nothing but slightly formatted gibberish ... encouraging the user to press a button to “Enable Content”.

Execution

3 techniques
T1059.001PowerShellEvidence1

When the victim “enables content”, the document starts a cmd.exe with a command line to execute a PowerShell scriptlet that, in turn, downloads and executes a second stage PowerShell scriptlet and, eventually, backdoors the system.

T1059.003Windows Command ShellEvidence1

When the victim “enables content”, the document starts a cmd.exe with a command line to execute a PowerShell scriptlet...

T1204.002Malicious FileEvidence1

When the victim “enables content”, the document starts a cmd.exe with a command line to execute a PowerShell scriptlet...

Stealth

4 techniques
T1027Obfuscated Files or InformationEvidence1

As standalone fileless backdoors, they were built and obfuscated using the same tool.

T1027.011Fileless StorageEvidence1

As standalone fileless backdoors, they were built and obfuscated using the same tool.

T1036MasqueradingEvidence1

The sender address imitates the South Korean NCTC (National Counter-Terrorism Center), while the sender’s server IP originates from a server in Singapore.

T1070.001Clear Windows Event LogsEvidence1

Once the wiper has run for 60 minutes it cleans Windows event logs...

Credential Access

2 techniques
T1555Credentials from Password StoresEvidence1

the main module collects user passwords from browser and Windows storage

T1649Steal or Forge Authentication CertificatesEvidence1

Meanwhile, the main module collects user passwords from browser and Windows storage and crafts a new generation of the worm that contains old and freshly collected compromised credentials.

Discovery

1 technique
T1016System Network Configuration DiscoveryEvidence1

The attackers also checked the network configuration, potentially searching for servers attached to multiple networks or VPN links... They used three types of PowerShell scriptlets: TCP 4444 port opener, ipconfig launcher and a downloader.

Lateral Movement

3 techniques
T1021Remote ServicesEvidence1

They seemed to be moving through the network via Psexec and stolen credentials, opening a default meterpreter port (TCP 4444) and downloading and running a backdoor (meterpreter).

T1021.002SMB/Windows Admin SharesEvidence1

The malware is to deliver and start the wiper payload which attempts to destroy files on the remote network shares... The malware was spread as a network worm via Windows network shares

T1570Lateral Tool TransferEvidence1

The new generation of the worm is pushed to accessible local network computers and starts using the PsExec tool...

Command and Control

2 techniques
T1071Application Layer ProtocolEvidence1

we confirmed the presence of malicious traffic to a malicious command and control server at IP 131.255.*.* ... The infected host established multiple connections to this server on ports from the following list: 443 4443 8080 8081 8443 8880

T1105Ingress Tool TransferEvidence1

...downloads and executes a second stage PowerShell scriptlet and, eventually, backdoors the system.

Impact

4 techniques
T1485Data DestructionEvidence1

the purpose of the malware is to deliver and start the wiper payload which attempts to destroy files on the remote network shares over the next 60 minutes.

T1489Service StopEvidence1

...disables all the services on the system and reboots the computer.

T1490Inhibit System RecoveryEvidence1

Once the wiper has run for 60 minutes it ... resets backups, deletes shadow copies from the file system, disables the recovery item in the Windows boot menu...

T1529System Shutdown/RebootEvidence1

...disables all the services on the system and reboots the computer.

Other

1 technique
T1562.001Disable or Modify ToolsEvidence1

If ($PSVersionTable.PSVersion.Major -Ge 3) ... ScriptBlockLogging ... set to 0 ... AmsiUtils ... amsiInitFailed ... $TRUE

INDICATORS OF COMPROMISE

IOCs tracked for this family

27 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app
Hashes
27 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting
hash.md5●●●●●●●●●●●●View more in app5 years ago
hash.md5●●●●●●●●●●●●View more in app5 years ago
hash.md5●●●●●●●●●●●●View more in app5 years ago
hash.md5●●●●●●●●●●●●View more in app5 years ago
hash.md5●●●●●●●●●●●●View more in app5 years ago
hash.md5●●●●●●●●●●●●View more in app5 years ago
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching27

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution4

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping21

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.