Loading story…
The malware dubbed Olympic Destroyer disrupted systems tied to the Pyeongchang Winter Olympics, knocking the Olympic website offline and degrading services including on-site Wi‑Fi for reporters during the opening ceremony. Researchers described it as a destructive, worm-like Windows malware built to maximize operational impact rather than steal data: it harvested browser and OS credentials, moved laterally with WMI and a legitimate signed PsExec binary, and spread through the environment using stolen administrative access.
Once deployed, the malware deleted shadow copies, backup catalogs, and event logs, disabled services and recovery features, wiped writable files on mapped shares, and shut down infected systems; analysts also found self-deletion behavior intended to hinder forensics, including code injection into notepad.exe. Multiple reports noted similarities to tools and tradecraft associated with Lazarus, APT3, APT10, NotPetya, and BadRabbit, but concluded those overlaps were inconclusive and may have been planted as false flags, leaving attribution unresolved without intelligence beyond malware artifacts.
See attribution, scope, and your downstream exposure.
6 events from the most recent confirmed update back to the earliest known activity.
Talos published a follow-up attribution analysis concluding that available technical evidence did not support unambiguous attribution of Olympic Destroyer to a specific threat actor. The report argued the attacker likely planted false flags and that overlaps with Lazarus, APT3, APT10, and NotPetya were inconclusive.
MBSD released a detailed technical analysis of Olympic Destroyer, documenting its dropped components, self-deletion via notepad.exe injection, and the embedding of stolen credentials into propagated binaries. The report also noted similarities to NotPetya and BadRabbit while cautioning that these were not conclusive for attribution.
Talos published technical analysis of malware believed to have been used in the Olympic attack and identified it as Olympic Destroyer with moderate confidence. The report described credential theft, PsExec and WMI-based lateral movement, and destructive actions including wiping files, deleting backups, and shutting down systems.
The PyeongChang Olympic organizing committee publicly announced that the disruptions were caused by a cyberattack. This was the first explicit confirmation from organizers about the nature of the incident.
Internal system troubles at the PyeongChang Olympic organizing committee began around February 9, preceding public confirmation of the incident. The disruptions were later tied to the Olympic Destroyer attack.
During the 2018 Winter Olympics in Pyeongchang, a cyberattack knocked the Olympic website offline, prevented some ticket printing, and degraded on-site WiFi for reporters during the opening ceremony. Officials later confirmed the incident was caused by malware now known as Olympic Destroyer.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 12 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
blog.talosintelligence.com
Open sourcembsd.jp
Open sourceblog.talosintelligence.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **OlympicDestroyer** malware disrupted IT systems tied to the 2018 Winter Olympics in Pyeongchang, knocking out Wi-Fi, display systems, the Olympics website, and ticket-printing services shortly before the opening ceremony. Investigators described the operation as a destructive self-propagating worm that used stolen credentials and `PsExec` for lateral movement, then wiped files on remote shares, deleted backups and shadow copies, cleared event logs, disabled services, and forced systems to reboot into an unusable state. The intrusion also affected organizations connected to the Games, including ski resort hotels, an automation software vendor, **Atos**, and potentially collateral networks in Europe, with one ski resort automation server identified as the likely patient zero for the destructive outbreak. Researchers found the attackers had conducted spearphishing against Olympic partners, moved manually through compromised networks before launching the worm, and operated command-and-control infrastructure through an Argentinian server bought via a Bulgarian reseller and accessed over **NordVPN**. The investigation concluded that several of the most prominent attribution clues were intentionally misleading: artifacts appeared to overlap with **NotPetya**, **BadRabbit**, Chinese threat actors, **Sofacy**, and **Lazarus/BlueNoroff**, but some of the strongest Lazarus-linked indicators, including a **Rich header** fingerprint, were assessed to have been deliberately forged. The attack was therefore seen not only as a sabotage campaign against Olympic infrastructure, but also as a deliberate effort to confuse investigators with sophisticated false-flag techniques.
Aug 14, 2026
Researchers identified a Windows wiper malware campaign using Tokyo Olympics-themed lures, including an executable disguised as an urgent cyberattack damage report. The malware, a UPX-packed x86 console application written in C/C++, selectively deletes files from the user profile rather than wiping the full disk, targeting Office documents, PDFs, text and log files, executables, CSVs, and Japanese Ichitaro formats such as `.jtd` and `.jtt`, indicating likely interest in Japanese systems. Analysts reported at least two related samples uploaded in July 2021, including one destructive variant and another without wiper functionality. The malware includes multiple anti-analysis features, checking for debuggers, sandbox or virtual-machine artifacts, malware analysis tools, and modified functions associated with hooks or breakpoints; if such conditions are detected, it exits and can delete itself. After wiping files, the sample also launches a `curl` request to an adult website, a behavior researchers said may have been intended to mislead investigators into attributing the infection to adult-site browsing. Fortinet said the malware showed no worming or propagation capability, and available reporting found no confirmed victims, delivery mechanism, or evidence tying it to **Olympic Destroyer** or a nation-state actor.
Aug 15, 2026
Multiple destructive malware campaigns struck Ukraine around the start of Russia’s invasion, with **HermeticWiper**, **IsaacWiper**, **CaddyWiper**, **WhisperGate**, and **DoubleZero** used against government, financial, and other organizations. Researchers reported that HermeticWiper corrupted boot records and partition data by abusing a legitimate EaseUS driver, while CaddyWiper and DoubleZero erased user data, partition information, and critical registry or boot components, often while deliberately sparing domain controllers to preserve attacker access. Several incidents appeared to follow prior compromise of victim networks, including abuse of **Active Directory**, scheduled execution, and in some cases worm-like spread via **HermeticWizard**; HermeticRansom was also deployed as a likely decoy alongside destructive activity. The destructive operations extended beyond enterprise Windows environments. **AcidRain** was used in the attack on Viasat’s **KA-SAT** network, wiping satellite modems in Ukraine and elsewhere in Europe by recursively destroying filesystems and storage devices, while the **Industroyer2** operation targeted a Ukrainian energy provider with malware built to communicate over **IEC-104** and cut power, paired with Windows, Linux, and Solaris wipers including **CaddyWiper**, **ORCSHRED**, **SOLOSHRED**, and **AWFULSHRED**. Across the reporting, defenders were urged to watch for mass file overwrites, shadow copy and event log deletion, MBR or partition changes, suspicious use of administrative tooling and group policy, and to maintain tested, isolated backups to recover from destructive attacks.
Aug 15, 2026