Olympic Destroyer
Olympic Destroyer is a destructive Windows malware/wiper used in the February 9, 2018 attack on IT systems supporting the PyeongChang Winter Olympics opening ceremony. The operation has been attributed in the provided content to Sandworm, also tracked as APT44 and GRU Unit 74455, and U.S. government reporting and indictments are cited as officially linking Sandworm to the malware. The attack disrupted Olympic Wi-Fi, ticketing systems, the official app, the event website, and other digital infrastructure; the content also notes broadcast drones were disabled, more than 300 systems were compromised, and domain controllers were repeatedly wiped, rendering much of the network unusable.
Capabilities described in the content include credential theft, lateral movement, discovery, anti-recovery actions, log clearing, service disruption, and destructive wiping. Olympic Destroyer contains modules that attempt to obtain stored credentials from web browsers and credentials from LSASS memory. It uses stolen credentials with PsExec and Windows Management Instrumentation (WMI) to propagate across a network, attempts to copy itself to remote machines, enumerates systems via WMI, interacts with the ADMIN$ share, enumerates mapped network shares and ARP table information, and overwrites files locally and on remote shares. For defense evasion and impact, it attempts to clear Windows System and Security event logs with wevtutil, disables services via ChangeServiceConfigW, uses native Windows utilities vssadmin, wbadmin, and bcdedit to delete and disable recovery features including the Windows backup catalog and Windows Automatic Repair, and shuts down compromised systems after modifying system configuration.
The content states Sandworm conducted intrusions into Olympic-related systems from December 2017 through February 2018, including spearphishing campaigns and malicious mobile applications targeting South Korean citizens and officials, Olympic athletes, partners, visitors, and International Olympic Committee officials before deployment of the malware. The malware is also cited as an example of intentionally misleading attribution indicators during malware development. High-confidence behaviors and associated utilities explicitly mentioned in the content include WMI, PsExec, wevtutil, vssadmin, wbadmin, and bcdedit.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Sandworm (APT44/GRU Unit 74455) deployed the Olympic Destroyer wiper during the PyeongChang 2018 Winter Olympics opening ceremony, taking down Wi-Fi, ticketing systems, the official app, and the event website.
Pyeongchang Winter Olympics 2018 Olympic Destroyer wiper; attributed to Razing Ursa (aka GRU Unit 74455, Sandworm) ... Wi-Fi at opening ceremony, Olympics website, ticketing, broadcast drones disabled. 300+ systems compromised.
The GRU’s malign cyber activities include deployment of the NotPetya and Olympic Destroyer malware; intrusions targeting the Organization for the Prohibition of Chemical Weapons and the World Anti-Doping Agency; cyber attacks on government systems and critical infrastructure in Ukraine and the state of Georgia; and hack-and-leak operations targeting elections in the United States and France.
"...false flags were planted in the case of the Olympic Destroyer malware that was employed by the Russian-attributed Sandworm Advanced Persistent Threat (APT) group against the 2018 Winter Olympics in Pyeongchang, South Korea..."
Techniques & procedures
23 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniques
Initial Access
Execution
2 techniques
Execution
Persistence
1 technique
Persistence
Stealth
2 techniques
Stealth
Credential Access
4 techniques
Credential Access
Multiple actors and tools are described as using Mimikatz/Windows Credential Editor/LaZagne/ProcDump to “dump credentials,” often by targeting LSASS memory (e.g., “used Mimikatz to capture and use legitimate credentials,” “dumped the LSASS process memory using the MiniDump function,” “injecting itself into lsass.exe”).
Olympic Destroyer contains a module that tries to obtain credentials from LSASS, similar to Mimikatz. These credentials are used with PsExec and Windows Management Instrumentation to help the malware propagate itself across a network.
Discovery
3 techniques
Discovery
The content repeatedly describes malware and threat actors using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, nbtstat, netsh, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, domains, and network adapter/interface details.
Lateral Movement
3 techniques
Lateral Movement
Olympic Destroyer uses PsExec to interact with the ADMIN$ network share to execute commands on remote systems.
Impact
7 techniques
Impact
On March 11, 2026, the MOIS-affiliated Handala Hack Team (also tracked as Void Manticore) executed a destructive wiper attack against U.S. medical technology company Stryker, abusing the company’s own Microsoft Intune MDM platform to push the payload.
Olympic Destroyer uses the API call ChangeServiceConfigW to disable all services on the affected system.
Akira will delete system volume shadow copies via PowerShell commands. Avaddon deletes backups and shadow copies using native system tools. Babuk has the ability to delete shadow volumes using vssadmin.exe delete shadows /all /quiet. BlackCat can delete shadow copies using vssadmin.exe delete shadows /all /quiet and wmic.exe Shadowcopy Delete; it can also modify the boot loader using bcdedit /set {default} recoveryenabled No.
The Olympic Destroyer malware caused issues during the Opening Ceremony, including taking down Wi-Fi networks, ticketing systems, and contributing to flickering broadcast infrastructure.
The Olympic Destroyer malware caused issues during the Opening Ceremony, including taking down Wi-Fi networks, ticketing systems, and contributing to flickering broadcast infrastructure.
Recent activity
55 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Destructive wiper malware used to disrupt event operations, including Wi-Fi, ticketing systems, official apps, and websites during the PyeongChang 2018 Winter Olympics.
Destructive wiper malware used during the 2018 Pyeongchang Winter Olympics to disrupt Wi-Fi, ticketing, websites, and other event systems.
Destructive malware used to disrupt IT systems supporting the PyeongChang Winter Olympics.
Destructive malware referenced as a case study showing attackers can steal credentials and maintain footholds for months before activating operations during a major event.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.