Loading story…
Researchers identified a Windows wiper malware campaign using Tokyo Olympics-themed lures, including an executable disguised as an urgent cyberattack damage report. The malware, a UPX-packed x86 console application written in C/C++, selectively deletes files from the user profile rather than wiping the full disk, targeting Office documents, PDFs, text and log files, executables, CSVs, and Japanese Ichitaro formats such as .jtd and .jtt, indicating likely interest in Japanese systems. Analysts reported at least two related samples uploaded in July 2021, including one destructive variant and another without wiper functionality.
The malware includes multiple anti-analysis features, checking for debuggers, sandbox or virtual-machine artifacts, malware analysis tools, and modified functions associated with hooks or breakpoints; if such conditions are detected, it exits and can delete itself. After wiping files, the sample also launches a curl request to an adult website, a behavior researchers said may have been intended to mislead investigators into attributing the infection to adult-site browsing. Fortinet said the malware showed no worming or propagation capability, and available reporting found no confirmed victims, delivery mechanism, or evidence tying it to Olympic Destroyer or a nation-state actor.
Get the actors, campaigns, and ATT&CK mapping behind it.
8 events from the most recent confirmed update back to the earliest known activity.
Researchers reported that the destructive Tokyo Olympics-themed malware sample was uploaded on July 20, 2021, including to VirusTotal/public repositories. The sample masqueraded as a PDF-themed urgent damage report and selectively deleted files from users' Windows profiles.
Cyble's analysis said the wiper malware sample was compiled as a C/C++ x86 console application on July 20, 2021. The sample was packed with UPX and disguised as an urgent Tokyo Olympics cyberattack damage report executable.
FortiGuard Labs reported that a related Tokyo Olympics-themed file using a PDF icon was uploaded to a public file repository. This July 17 sample shared similar functionality with the later malware but lacked destructive file-deletion capability.
Cyble Research Labs published a detailed analysis of the Tokyo Olympics-themed wiper, including anti-analysis behavior, file-targeting logic, SHA-256 indicators, and a YARA rule named win32_tokyoolympicdeleter. Cyble assessed the malware's primary purpose as deleting user files and then deleting itself.
FortiGuard Labs published analysis covering both Tokyo Olympics-themed samples, including the July 20 wiper and the July 17 related file. The report said the malware was not code-similar to Olympic Destroyer and that there was insufficient evidence of nation-state involvement.
A second sample of the Olympics-themed malware was discovered after the initial article was published. FortiGuard later described this broader set as including both the July 17 related sample and the July 20 wiper sample.
The Record reported on the newly discovered Olympics-themed wiper targeting Japanese PCs two days before the Tokyo Olympics opening ceremony. At that time, only one sample had been found, and the report highlighted its focus on Japanese file types such as Ichitaro documents.
Mitsui Bussan Secure Directions discovered and analyzed the Windows wiper shortly before the Tokyo Olympics opening ceremony. MBSD found anti-analysis and anti-VM checks, self-deletion behavior, and access to an adult site intended to mislead investigators.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
4 references tracked. Mallory keeps watching after this page renders.
blog.cyble.com
Open sourcefortinet.com
Open sourcetherecord.media
Open sourcembsd.jp
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The malware dubbed **Olympic Destroyer** disrupted systems tied to the Pyeongchang Winter Olympics, knocking the Olympic website offline and degrading services including on-site Wi‑Fi for reporters during the opening ceremony. Researchers described it as a destructive, worm-like Windows malware built to maximize operational impact rather than steal data: it harvested browser and OS credentials, moved laterally with **WMI** and a legitimate signed **PsExec** binary, and spread through the environment using stolen administrative access. Once deployed, the malware deleted shadow copies, backup catalogs, and event logs, disabled services and recovery features, wiped writable files on mapped shares, and shut down infected systems; analysts also found self-deletion behavior intended to hinder forensics, including code injection into `notepad.exe`. Multiple reports noted similarities to tools and tradecraft associated with **Lazarus**, **APT3**, **APT10**, **NotPetya**, and **BadRabbit**, but concluded those overlaps were inconclusive and may have been planted as false flags, leaving attribution unresolved without intelligence beyond malware artifacts.
Aug 15, 2026
Multiple destructive malware campaigns struck Ukraine around the start of Russia’s invasion, with **HermeticWiper**, **IsaacWiper**, **CaddyWiper**, **WhisperGate**, and **DoubleZero** used against government, financial, and other organizations. Researchers reported that HermeticWiper corrupted boot records and partition data by abusing a legitimate EaseUS driver, while CaddyWiper and DoubleZero erased user data, partition information, and critical registry or boot components, often while deliberately sparing domain controllers to preserve attacker access. Several incidents appeared to follow prior compromise of victim networks, including abuse of **Active Directory**, scheduled execution, and in some cases worm-like spread via **HermeticWizard**; HermeticRansom was also deployed as a likely decoy alongside destructive activity. The destructive operations extended beyond enterprise Windows environments. **AcidRain** was used in the attack on Viasat’s **KA-SAT** network, wiping satellite modems in Ukraine and elsewhere in Europe by recursively destroying filesystems and storage devices, while the **Industroyer2** operation targeted a Ukrainian energy provider with malware built to communicate over **IEC-104** and cut power, paired with Windows, Linux, and Solaris wipers including **CaddyWiper**, **ORCSHRED**, **SOLOSHRED**, and **AWFULSHRED**. Across the reporting, defenders were urged to watch for mass file overwrites, shadow copy and event log deletion, MBR or partition changes, suspicious use of administrative tooling and group policy, and to maintain tested, isolated backups to recover from destructive attacks.
Aug 15, 2026
Cisco Talos disclosed a destructive intrusion against a Ukrainian critical infrastructure organization in which attackers deployed a newly identified wiper malware family, **PathWiper**, after allegedly gaining access to a legitimate endpoint administration framework. Talos said the operation bears strong similarities to prior Russia-linked attacks on Ukraine and assessed with high confidence that a Russia-nexus APT actor was responsible. The malware was launched via a dropped VBScript, `uacinstall.vbs`, which wrote `sha256sum.exe` to disk and then systematically corrupted physical drives, volumes, NTFS artifacts, and files with random data after attempting to dismount targeted volumes. The reporting indicates the attackers used enterprise administration mechanisms to issue malicious commands and likely relied on established lateral movement techniques before the destructive phase. Related defensive research has highlighted how Microsoft Excel can be abused through **DCOM** for remote execution and lateral movement, and Splunk has published detection guidance for suspicious cases where Excel spawns unusual child processes, a pattern that can indicate Office-based execution or command-and-control activity. Talos noted that PathWiper shares semantic similarities with **HermeticWiper** but uses a more methodical drive and network-share discovery process, including enumeration of removed shared drives through the Windows registry.
Aug 12, 2026