Skip to main content
Meet us at Black Hat USA 2026— Las Vegas, August 1–6Book a Meeting
Mallory
Back to malware
MalwareUsed by 4 actors

Olympic Destroyer

Olympic Destroyer is a destructive Windows malware/wiper used in the February 9, 2018 attack on IT systems supporting the PyeongChang Winter Olympics opening ceremony. The operation has been attributed in the provided content to Sandworm, also tracked as APT44 and GRU Unit 74455, and U.S. government reporting and indictments are cited as officially linking Sandworm to the malware. The attack disrupted Olympic Wi-Fi, ticketing systems, the official app, the event website, and other digital infrastructure; the content also notes broadcast drones were disabled, more than 300 systems were compromised, and domain controllers were repeatedly wiped, rendering much of the network unusable.

Capabilities described in the content include credential theft, lateral movement, discovery, anti-recovery actions, log clearing, service disruption, and destructive wiping. Olympic Destroyer contains modules that attempt to obtain stored credentials from web browsers and credentials from LSASS memory. It uses stolen credentials with PsExec and Windows Management Instrumentation (WMI) to propagate across a network, attempts to copy itself to remote machines, enumerates systems via WMI, interacts with the ADMIN$ share, enumerates mapped network shares and ARP table information, and overwrites files locally and on remote shares. For defense evasion and impact, it attempts to clear Windows System and Security event logs with wevtutil, disables services via ChangeServiceConfigW, uses native Windows utilities vssadmin, wbadmin, and bcdedit to delete and disable recovery features including the Windows backup catalog and Windows Automatic Repair, and shuts down compromised systems after modifying system configuration.

The content states Sandworm conducted intrusions into Olympic-related systems from December 2017 through February 2018, including spearphishing campaigns and malicious mobile applications targeting South Korean citizens and officials, Olympic athletes, partners, visitors, and International Olympic Committee officials before deployment of the malware. The malware is also cited as an example of intentionally misleading attribution indicators during malware development. High-confidence behaviors and associated utilities explicitly mentioned in the content include WMI, PsExec, wevtutil, vssadmin, wbadmin, and bcdedit.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

THREAT ACTORS

Groups observed using it

4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details
Sandworm

Sandworm (APT44/GRU Unit 74455) deployed the Olympic Destroyer wiper during the PyeongChang 2018 Winter Olympics opening ceremony, taking down Wi-Fi, ticketing systems, the official app, and the event website.

via socradar blogsocradar.io
razing_ursa

Pyeongchang Winter Olympics 2018 Olympic Destroyer wiper; attributed to Razing Ursa (aka GRU Unit 74455, Sandworm) ... Wi-Fi at opening ceremony, Olympics website, ticketing, broadcast drones disabled. 300+ systems compromised.

via palo alto networks unit 42 blogunit42.paloaltonetworks.com
GRU

The GRU’s malign cyber activities include deployment of the NotPetya and Olympic Destroyer malware; intrusions targeting the Organization for the Prohibition of Chemical Weapons and the World Anti-Doping Agency; cyber attacks on government systems and critical infrastructure in Ukraine and the state of Georgia; and hack-and-leak operations targeting elections in the United States and France.

via us treasury newshome.treasury.gov
Lazarus

"...false flags were planted in the case of the Olympic Destroyer malware that was employed by the Russian-attributed Sandworm Advanced Persistent Threat (APT) group against the 2018 Winter Olympics in Pyeongchang, South Korea..."

via osint team blogosintteam.blog
MITRE ATT&CK

Techniques & procedures

23 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques
T1133External Remote ServicesEvidence1

the defendants and their co-conspirators deployed destructive malware and took other disruptive actions, for the strategic benefit of Russia, through unauthorized access to victim computers (hacking).

T1190Exploit Public-Facing ApplicationEvidence1

The GRU’s malign cyber activities include deployment of the NotPetya and Olympic Destroyer malware; intrusions targeting the Organization for the Prohibition of Chemical Weapons and the World Anti-Doping Agency

Execution

2 techniques
T1047Windows Management InstrumentationEvidence2

Olympic Destroyer uses WMI to help propagate itself across a network.

T1569.002Service ExecutionEvidence2

Olympic Destroyer utilizes PsExec to help propagate itself across a network.

Persistence

1 technique
T1133External Remote ServicesEvidence1

the defendants and their co-conspirators deployed destructive malware and took other disruptive actions, for the strategic benefit of Russia, through unauthorized access to victim computers (hacking).

Stealth

2 techniques
T1036.005Match Legitimate Resource Name or LocationEvidence1

During malware development, adversaries may intentionally include indicators aligned with other known actors in order to mislead attribution by defenders.

T1070.001Clear Windows Event LogsEvidence2

Olympic Destroyer will attempt to clear the System and Security event logs using wevtutil.

Credential Access

4 techniques
T1003OS Credential DumpingEvidence1

Multiple actors and tools are described as using Mimikatz/Windows Credential Editor/LaZagne/ProcDump to “dump credentials,” often by targeting LSASS memory (e.g., “used Mimikatz to capture and use legitimate credentials,” “dumped the LSASS process memory using the MiniDump function,” “injecting itself into lsass.exe”).

T1003.001LSASS MemoryEvidence3

Olympic Destroyer contains a module that tries to obtain credentials from LSASS, similar to Mimikatz. These credentials are used with PsExec and Windows Management Instrumentation to help the malware propagate itself across a network.

T1555Credentials from Password StoresEvidence1

Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers.

T1555.003Credentials from Web BrowsersEvidence8

The content repeatedly describes threat actors and malware stealing usernames, passwords, cookies, session tokens, and other saved credentials from web browsers such as Chrome, Firefox, Internet Explorer, Edge, Opera, Safari, and Yandex.

Discovery

3 techniques
T1016System Network Configuration DiscoveryEvidence4

The content repeatedly describes malware and threat actors using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, nbtstat, netsh, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, domains, and network adapter/interface details.

T1018Remote System DiscoveryEvidence2

Olympic Destroyer uses Windows Management Instrumentation to enumerate all systems in the network.

T1135Network Share DiscoveryEvidence1

Olympic Destroyer will attempt to enumerate mapped network shares to later attempt to wipe all files on those shares.

Lateral Movement

3 techniques
T1021.002SMB/Windows Admin SharesEvidence2

Olympic Destroyer uses PsExec to interact with the ADMIN$ network share to execute commands on remote systems.

T1021.003Distributed Component Object ModelEvidence1

Examples include 'Aquatic Panda used WMI for lateral movement in victim environments,' 'Deep Panda group is known to utilize WMI for lateral movement,' and 'Cinnamon Tempest has used Impacket for lateral movement via WMI.'

T1570Lateral Tool TransferEvidence1

Olympic Destroyer attempts to copy itself to remote machines on the network.

Impact

7 techniques
T1485Data DestructionEvidence7

On March 11, 2026, the MOIS-affiliated Handala Hack Team (also tracked as Void Manticore) executed a destructive wiper attack against U.S. medical technology company Stryker, abusing the company’s own Microsoft Intune MDM platform to push the payload.

T1489Service StopEvidence1

Olympic Destroyer uses the API call ChangeServiceConfigW to disable all services on the affected system.

T1490Inhibit System RecoveryEvidence4

Akira will delete system volume shadow copies via PowerShell commands. Avaddon deletes backups and shadow copies using native system tools. Babuk has the ability to delete shadow volumes using vssadmin.exe delete shadows /all /quiet. BlackCat can delete shadow copies using vssadmin.exe delete shadows /all /quiet and wmic.exe Shadowcopy Delete; it can also modify the boot loader using bcdedit /set {default} recoveryenabled No.

T1498Network Denial of ServiceEvidence1

The Olympic Destroyer malware caused issues during the Opening Ceremony, including taking down Wi-Fi networks, ticketing systems, and contributing to flickering broadcast infrastructure.

T1499Endpoint Denial of ServiceEvidence1

The Olympic Destroyer malware caused issues during the Opening Ceremony, including taking down Wi-Fi networks, ticketing systems, and contributing to flickering broadcast infrastructure.

T1529System Shutdown/RebootEvidence2

Olympic Destroyer will shut down the compromised system after it is done modifying system configuration settings.

T1561.001Disk Content WipeEvidence1

Malware had repeatedly wiped the domain controllers rendering a lot of the network unusable.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution4

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping23

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.