Loading story…
The OlympicDestroyer malware disrupted IT systems tied to the 2018 Winter Olympics in Pyeongchang, knocking out Wi-Fi, display systems, the Olympics website, and ticket-printing services shortly before the opening ceremony. Investigators described the operation as a destructive self-propagating worm that used stolen credentials and PsExec for lateral movement, then wiped files on remote shares, deleted backups and shadow copies, cleared event logs, disabled services, and forced systems to reboot into an unusable state. The intrusion also affected organizations connected to the Games, including ski resort hotels, an automation software vendor, Atos, and potentially collateral networks in Europe, with one ski resort automation server identified as the likely patient zero for the destructive outbreak.
Researchers found the attackers had conducted spearphishing against Olympic partners, moved manually through compromised networks before launching the worm, and operated command-and-control infrastructure through an Argentinian server bought via a Bulgarian reseller and accessed over NordVPN. The investigation concluded that several of the most prominent attribution clues were intentionally misleading: artifacts appeared to overlap with NotPetya, BadRabbit, Chinese threat actors, Sofacy, and Lazarus/BlueNoroff, but some of the strongest Lazarus-linked indicators, including a Rich header fingerprint, were assessed to have been deliberately forged. The attack was therefore seen not only as a sabotage campaign against Olympic infrastructure, but also as a deliberate effort to confuse investigators with sophisticated false-flag techniques.
TTPs, infrastructure, and targeting history in one profile.
7 events from the most recent confirmed update back to the earliest known activity.
Subsequent analysis found that several strong attribution clues, especially artifacts suggesting Lazarus involvement such as a Rich header fingerprint, were likely deliberately planted to mislead investigators.
U.S. officials told The Washington Post that Russian military intelligence was behind the Olympic cyberattack and had tried to make it appear as though North Korea was responsible. The report marked an early public attribution shift in the aftermath of the Pyeongchang disruption.
Investigators determined that a ski resort automation software server was the initial infection point for one destructive outbreak tied to the OlympicDestroyer operation.
The malware propagated using stolen credentials and PsExec, wiping files on remote shares, deleting backups and shadow copies, clearing logs, disabling services, and rebooting systems into an unusable state across multiple organizations.
Just before the opening ceremony of the 2018 Winter Olympics in Pyeongchang, OlympicDestroyer was launched, disrupting Wi-Fi, display systems, the Olympics website, and ticket-printing infrastructure.
Investigators found evidence that the operators gained access to multiple Olympic-related environments and performed manual lateral movement before deploying the worm component.
Before the 2018 Winter Olympics, attackers conducted spearphishing campaigns against Olympic-related organizations and partners as part of the preparation for the later destructive operation.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 77 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
6 references tracked. Mallory keeps watching after this page renders.
darknetdiaries.com
Open sourcesecurelist.com
Open sourcecyber.wtf
Open sourcewashingtonpost.com
Open sourceblog.talosintelligence.com
Open sourcevirusbulletin.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The malware dubbed **Olympic Destroyer** disrupted systems tied to the Pyeongchang Winter Olympics, knocking the Olympic website offline and degrading services including on-site Wi‑Fi for reporters during the opening ceremony. Researchers described it as a destructive, worm-like Windows malware built to maximize operational impact rather than steal data: it harvested browser and OS credentials, moved laterally with **WMI** and a legitimate signed **PsExec** binary, and spread through the environment using stolen administrative access. Once deployed, the malware deleted shadow copies, backup catalogs, and event logs, disabled services and recovery features, wiped writable files on mapped shares, and shut down infected systems; analysts also found self-deletion behavior intended to hinder forensics, including code injection into `notepad.exe`. Multiple reports noted similarities to tools and tradecraft associated with **Lazarus**, **APT3**, **APT10**, **NotPetya**, and **BadRabbit**, but concluded those overlaps were inconclusive and may have been planted as false flags, leaving attribution unresolved without intelligence beyond malware artifacts.
Aug 15, 2026
Italian authorities said they blocked Russian-linked cyberattacks aimed at websites tied to the Winter Olympics, preventing disruption as organizers prepared for the games. The activity revived concerns first underscored by the 2018 Winter Olympics opening ceremony attack, when a destructive operation sought to interrupt a high-profile international sporting event and demonstrated how cyber operations can be used to undermine global broadcasts, logistics, and public confidence. Threat intelligence reporting also described a broader surge in hacktivist activity ahead of the 2026 Winter Olympics, alongside protests and suspected sabotage risks. The combined reporting indicates that Olympic infrastructure, public-facing sites, and related organizations faced a heightened threat environment in which politically motivated actors and state-linked operators appeared poised to use cyberattacks to disrupt services, shape narratives, and embarrass host institutions.
Jul 12, 2026
Researchers identified a Windows wiper malware campaign using Tokyo Olympics-themed lures, including an executable disguised as an urgent cyberattack damage report. The malware, a UPX-packed x86 console application written in C/C++, selectively deletes files from the user profile rather than wiping the full disk, targeting Office documents, PDFs, text and log files, executables, CSVs, and Japanese Ichitaro formats such as `.jtd` and `.jtt`, indicating likely interest in Japanese systems. Analysts reported at least two related samples uploaded in July 2021, including one destructive variant and another without wiper functionality. The malware includes multiple anti-analysis features, checking for debuggers, sandbox or virtual-machine artifacts, malware analysis tools, and modified functions associated with hooks or breakpoints; if such conditions are detected, it exits and can delete itself. After wiping files, the sample also launches a `curl` request to an adult website, a behavior researchers said may have been intended to mislead investigators into attributing the infection to adult-site browsing. Fortinet said the malware showed no worming or propagation capability, and available reporting found no confirmed victims, delivery mechanism, or evidence tying it to **Olympic Destroyer** or a nation-state actor.
Aug 15, 2026