This report explores the Olympic Destroyer cyberattack that targeted the 2018 Winter Olympics. It examines how the malware operated, the techniques used to spread through systems, and the damage it was designed to cause. This artifact demonstrates my ability to research a complex cyberattack and organize technical details into a clear, understandable report.
Olympic Destroyer
A rise in nation backed cyberattacks has been seen as the increase in importance of computer systems and networks increases. These cyberattacks are often sophisticated and designed to hide their tracks so the perpetrators cannot be traced. The damage of these attacks can vary based on the goal of the attack, whether the malware is there to find information discreetly for as long as possible or to wreak as much damage to the systems as possible. How much damage could be done to an event like the Olympics? The Olympics in South Korea in 2018 faced a cyberattack that disrupted the opening the of the Olympics and was designed to shut down as many critical systems that the malware could infect. This would be a big problem that the IT team would have a short amount of time to identify and fix to ensure the Olympics would be able to run smoothly. This cyberattack would later be named by researchers as the Olympic Destroyer.
In February 2018, the Winter Olympics were taking place in South Korea. An event that is meant for nations to peacefully come together and let their athletes compete for medals on a global stage watched by millions. It is during this peaceful event though that a malware known as the Olympic Destroyer would interrupt the event and look at derailing the event entirely. The attack would mess with crucial systems and applications used by the Olympics to help tickets and navigating the event is easier for attendees. The cyberattack would start by “shutting down display monitors, killing Wi-Fi, and taking down the Olympics website” completely disrupting important components for attendees (“OlympicDestroyer is here”). The app being used for the Olympics was also affected in this attack; this would affect those trying to use tickets to get into the venue. Important infrastructure in the network would be taken down making it difficult on the administrative side to properly operate the event. Investigations would go underway to find out who was behind the attack. These would show that not only was this sophisticated malware, but it was also layered with tricks to make it difficult to track down the attacker. Although all these false flags would make it harder to track the attacker it would later be discovered that Russia was behind the cyberattack.
Olympic Destroyer is a malware used by a Russian backed group known as Sandworm, the malware mainly worked “to render infected computer systems inoperable” (“Olympic Destroyer”). Olympic Destroyer would focus on using Windows utilities to do damage to the systems that it infected. The malware would be able to get into the network through a series of spearphishing campaigns designed to get into the network. The emails sent contained word documents that when opened would just show a string of characters, people reading this would be inclined to click the Enable Content button on the top of the screen to try and make sense of the characters on screen. This would however enable the malware to get on the system, when the button is clicked “the document starts a cmd.exe with a command line to execute a PowerShell scriptlet” that would allow the attackers to gain backdoor access into the system (“OlympicDestroyer is here”).
Once it is on the system, Olympic Destroyer contains a module that would try to steal credentials from web browsers. That was not the only module the malware contained to look for credentials either, it contained another module that would try to steal credentials from the Local Security Authority Subsystem Service (LSASS). Once the malware is able to retrieve credentials from use of the modules, it can then use the credentials “with PsExec and Windows Management Instrumentation to help the malware propagate itself across a network” (“Olympic Destroyer”). By using stolen credentials to move across the network, it is able to avoid security measures because “this malware does not use an exploit to spread”, it is using valid credentials with valid windows tools to do the work (Sheridan). By using it allowed the attacker to the access to execute commands on a remote system. It used Server Message Block to perform actions as a logged user from the stolen credentials; by taking advantage of this they were able to “interact with file shares, allowing them to move laterally throughout a network” (“Remote Services: SMB”). Olympic Destroyer would also take advantage of Windows Management Instrumentation (WMI) to move across the network. With WMI they would be able to find other devices on a network, they may be able to find IP addresses or another form of identifier to use for lateral movement. With WMI and Remote System Discovery the attackers would be able “to enumerate all systems in the network” and increase the systems they would infect (“Olympic Destroyer”).
While it is also looking for credentials on systems to help it move across the network, it is at the same time dropping the malicious files on the systems it infects. Olympic Destroyer will use a technique called data destruction to help destroy data and files on a system; by overriding files and rewriting them it can complicate the systems original services and make recovery difficult. Olympic Destroyer will use API to change the “ChangeServiceConfigW to disable all services on the affected system” to disable critical services on a system to make them useless in the operations (“Olympic Destroyer”). Once it deletes critical files on the system it has another module designed to “clear the System and Security event logs using wevtutil” (“Olympic Destroyer”). By doing this it can help cover the tracks of the intrusion and reduce the chances of the malware being caught on the infected system. By clearing logs and using stolen credentials to navigate the network it will help hide the malware and traverse to infect more systems more effectively.
Olympic Destroyer is even more dangerous because of the steps taken to complicate the recovery process of a system. After infecting the system and doing data destruction and stealing credentials it also “uses native Windows utilities vssadmin, wbadmin, and bcdedit to delete and disable operating system recovery” to make it difficult to properly restore the systems after they have been discovered (“Olympic Destroyer”). Using vssadmin will clear shadow copies, wbadmin will delete the backup catalog, and bcedit will change the boot configuration to disable recovery features on a Windows device. Because of this Olympic Destroyer hinders the recovery process of Windows devices once the infection has been found. After the configuration settings have been changed, Olympic Destroyer will take the next step and “shut down the compromised system”, shutting down the system and making it useless (“Olympic Destroyer”).
Finding the perpetrator in this attack proved to be difficult because of the number of false flags found in the malware. Investigators knew it was a sophisticated piece of malware, and one designed to deal damage. They came to this conclusion because of the length Olympic Destroyer went through to navigate the network, change configuration files, and disable critical services on a system. One of the first attributions of the attack was towards a group named Lazarus of North Korean affiliation. It was believed this because the attackers left false flags to trick investigators “by using North Korean IP addresses and other false flags” (Higgins). The group had used techniques used by other nation-backed groups to draw attention to other countries as the attackers. It was during investigation that they found that “one of the headers had been forged: it didn’t belong to Lazarus” (Higgins). The fingerprint of the malware did not match that of malware used by Lazarus before, they had forged a header and forgot to encrypt some of the coding exposing a false flag that stopped people from pointing fingers at North Korea. The malware had fingerprints pointed towards another known group backed by Russia and had traces to Chinese hacker groups making it hard for investigators to point who was behind the attack. While it proved to be difficult officials were able to pinpoint it to Russia as the ones behind the attack, using known tools from other cyberattacks to make it look like another group was behind the attack.
Olympic Destroyer proved to be a very sophisticated malware with many false flags to hide the tracks of who was behind this cyberattack on the Olympics. Olympic Destroyer would use a spearphishing method to get itself into networks to self-propagate. Once it got onto a system it would change configuration on critical files in the system and change the Windows recovery system to make recovery more difficult for the victims. It would also go through the system and steal any credentials to use so the malware could go through the system avoiding security measures. By using legitimate tools like Psexec, wevtutil, vssadmin and many more it was able to make changes without use of other malware tools. Paired with the malware deleting security logs making it hard to detect the malware. All of this together proved to be a worm capable of dealing a lot of damage to the Olympics, and further investigation made it a malware that changed the way cybersecurity looked at malware because of the amount of false flags found.
Works Cited
“Data Destruction” Mitre, 15 April, 2025. https://attack.mitre.org/techniques/T1485/ Accessed 18 April, 2025.
Global Research & Analysis Team Kaspersky “OlympicDestroyer is here to trick the industry” SecureList, 8 March, 2018. https://securelist.com/olympicdestroyer-is-here-to-trick-the-industry/84295/ Accessed 18 April, 2025.
Higgins, Kelly “Olympic Destroyer’s ‘False Flag’ Changes the Game” Dark Reading, 8 March, 2018. https://www.darkreading.com/cyberattacks-data-breaches/olympic-destroyer-s-false-flag-changes-the-game Accessed 18 April, 2025.
“Olympic Destroyer” Mitre 16 April, 2025. https://attack.mitre.org/software/S0365/ Accessed 19 April, 2025.
“Remote Services: SMB/Windows Admin Shares” Mitre 15 April, 2025. https://attack.mitre.org/techniques/T1021/002/ Accessed 23 April, 2025.
Sheridan Kelly, “Cyberattack Aimed to Disrupt Opening of Winter Olympics” Dark Reading https://www.darkreading.com/cyberattacks-data-breaches/cyberattack-aimed-to-disrupt-opening-of-winter-olympics Accessed 23 April, 2025.