Olympic Destroyer

MITRE ATT&CK: S0365 View on attack.mitre.org

Aliases: SOURGRAPE, Olympic Destroyer

First seen
2018-02-09 00:00:00
Malware type
wiper, worm
Family
Malware family
Operating systems
windows
Profile updated
2026-07-07 12:44:44

Targeted industries: government-and-public-sector media-and-entertainment

Targeted regions: country_code:kr

Context

Olympic Destroyer is malware that was used by Sandworm Team against the 2018 Winter Olympics, held in Pyeongchang, South Korea. The main purpose of the malware was to render infected computer systems inoperable. The malware leverages various native Windows utilities and API calls to carry out its destructive tasks. Olympic Destroyer has worm-like features to spread itself across a computer network in order to maximize its destructive impact.

Detection coverage

  • 310 Sigma rules

Malware & tools used

  • System Network Configuration Discovery (attack-pattern)
  • Credentials from Web Browsers (attack-pattern)
  • Service Stop (attack-pattern)
  • System Shutdown/Reboot (attack-pattern)
  • Clear Windows Event Logs (attack-pattern)
  • Data Destruction (attack-pattern)
  • Lateral Tool Transfer (attack-pattern)
  • Windows Management Instrumentation (attack-pattern)
  • Remote System Discovery (attack-pattern)
  • Network Share Discovery (attack-pattern)
  • Service Execution (attack-pattern)
  • SMB/Windows Admin Shares (attack-pattern)
  • Inhibit System Recovery (attack-pattern)
  • LSASS Memory (attack-pattern)

Used by threat actors

Reports & references

  • MITRE ATT&CK — G0034 (report)
  • services.google.com — Apt44 Unearthing Sandworm (report)
  • Kaspersky — 91897 (report)
  • Kaspersky — 97937 (report)
  • justice.gov — Download (report)
  • fortinet.com — The Increasing Wiper Malware Threat (report)
  • youtube.com — Watch (report)
  • CrowdStrike — The Anatomy Of Wiper Malware Part 1 (report)
  • enterprise.verizon.com — 2019 Data Breach Investigations Report (report)
  • riskint.blog — Revisited Fancy Bear S New Faces And Sandworms Too (report)
  • wired.com — Us Indicts Sandworm Hackers Russia Cyberwar Unit (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Olympic Destroyer (report)
  • Kaspersky — 84348 (report)
  • Kaspersky — 84295 (report)
  • youtube.com — Watch (report)
  • youtube.com — Watch (report)
  • lastline.com — Olympic Destroyer South Korea (report)
  • mbsd.jp — 20180215 (report)
  • cyber.wtf — Dissecting Olympic Destroyer A Walk Through (report)
  • Cisco Talos — Olympic Destroyer (report)
  • youtube.com — Watch (report)
  • lastline.com — Attribution From Russia With Code (report)
  • Kaspersky — 86169 (report)
  • Cisco Talos — Who Wasnt Responsible For Olympic (report)
  • wired.com — Untold Story 2018 Olympics Destroyer Cyberattack (report)

External references