OlympicDestroyer
OlympicDestroyer is a destructive self-propagating Windows network worm and wiper used in the 2018 Winter Olympics attack in Pyeongchang, South Korea. During the opening ceremony period, it disrupted Olympic-related IT systems including ticketing systems, wireless networks, internet connectivity, display systems, the Olympics website, and other operational services; reporting in the provided content also states it affected broadcast drone operations, compromised more than 300 systems, and required roughly 12 hours to restore affected systems. The malware also impacted organizations closely tied to the Games, including ski resort hotels, a ski resort automation software vendor, and Atos, with one ski resort automation server assessed as patient zero for the destructive outbreak timed shortly before the opening ceremony.
The main malware module is described as a network worm composed of multiple components: a legitimate PsExec tool from SysInternals, credential-stealing modules, and a wiper. It collected passwords from browsers and Windows credential storage, generated new copies of itself containing stolen credentials, and propagated laterally to accessible local network computers using PsExec, stolen credentials, and current user privileges. Investigators also observed manual lateral movement before worm deployment using PsExec, stolen credentials, Meterpreter, and PowerShell scriptlets.
Its destructive behavior focused on remote systems and shares. The wiper attempted to destroy files on remote network shares for about 60 minutes, then cleared Windows event logs, reset backups, deleted shadow copies, disabled recovery options and services, and rebooted systems into an unusable state. The malware reportedly did not use persistence, included protection against recurring reinfection, did not destroy local files, and did not wipe its own components.
The infection chain described in the content includes spearphishing activity observed from December 2017 onward using Winter Olympics-themed malicious Office documents. These documents used gibberish text to induce users to enable macros; when enabled, they launched cmd.exe and PowerShell to download additional PowerShell stages and backdoor victim systems. The spearphishing campaign targeted Olympic partner networks across government, enterprise, energy, semiconductor, transport, hospital, media, advertising, and resort sectors.
The content describes command-and-control and infrastructure linked to the operation, including an affected server in Pyeongchang communicating with an Argentinian C2 server over ports 443, 4443, 8080, 8081, 8443, and 8880; a suspicious domain microsoft******[.]com; and attacker management of infrastructure through a NordVPN exit IP in Norway. A weaponized Word document reportedly contained readable references to a NordVPN OpenVPN configuration file.
Attribution in the provided material is presented as contested and deliberately complicated by false-flag tradecraft. The malware is repeatedly characterized as a highly sophisticated false-flag operation designed to confuse attribution. The content notes conflicting apparent overlaps with NotPetya, BadRabbit, Chinese APTs, Sofacy, Lazarus/BlueNoroff, and Sandworm. Kaspersky is cited as concluding that Lazarus-linked artifacts, including a Rich header fingerprint, were deliberately forged. Other provided content states the operation was related to Sofacy, while another report attributes OlympicDestroyer to Sandworm. High-confidence characterization from the content is therefore that OlympicDestroyer was designed both to disrupt Olympic infrastructure and to complicate attribution.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The main malware module is a network worm that consists of multiple components, including a legitimate PsExec tool from SysInternals’ suite, a few credential stealer modules and a wiper.
Groups observed using it
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
During the opening ceremony, the OlympicDestroyer malware disrupted portions of the Olympic environment, affecting ticketing systems, wireless networks, internet connectivity, and supporting operational services.
The main malware module is a network worm that consists of multiple components, including a legitimate PsExec tool from SysInternals’ suite, a few credential stealer modules and a wiper.
The main malware module is a network worm that consists of multiple components, including a legitimate PsExec tool from SysInternals’ suite, a few credential stealer modules and a wiper.
The main malware module is a network worm that consists of multiple components, including a legitimate PsExec tool from SysInternals’ suite, a few credential stealer modules and a wiper.
In the past, we have seen sophisticated attacks such as OlympicDestroyer confusing the industry and complicating attribution.
Techniques & procedures
21 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Since December 2017 security researchers have been seeing samples of MS Office documents in spearphishing emails related to the Winter Olympics uploaded to VirusTotal. The documents contained nothing but slightly formatted gibberish ... encouraging the user to press a button to “Enable Content”.
Execution
3 techniques
Execution
When the victim “enables content”, the document starts a cmd.exe with a command line to execute a PowerShell scriptlet that, in turn, downloads and executes a second stage PowerShell scriptlet and, eventually, backdoors the system.
Stealth
4 techniques
Stealth
As standalone fileless backdoors, they were built and obfuscated using the same tool.
As standalone fileless backdoors, they were built and obfuscated using the same tool.
Credential Access
2 techniques
Credential Access
Discovery
1 technique
Discovery
Lateral Movement
3 techniques
Lateral Movement
They seemed to be moving through the network via Psexec and stolen credentials, opening a default meterpreter port (TCP 4444) and downloading and running a backdoor (meterpreter).
Command and Control
2 techniques
Command and Control
Impact
4 techniques
Impact
Sandworm directly deployed the OLYMPICDESTROYER wiper at the 2018 Pyeongchang Winter Olympics, disabling Wi-Fi at the opening ceremony, taking down the official ticketing system, disrupting broadcast drone operations, and compromising over 300 systems, requiring 12 hours to restore.
IOCs tracked for this family
29 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Wiper malware used in disruptive attacks against the 2018 Pyeongchang Winter Olympics, impacting ticketing, Wi-Fi, connectivity, and operational services.
Destructive self-propagating malware used in the Pyeongchang Winter Olympics attack. It steals credentials from browsers and Windows storage, propagates laterally using PsExec and stolen credentials, delivers a wiper payload to remote systems and shares, deletes backups and shadow copies, clears event logs, disables services, and reboots systems into an unbootable state.
Destructive malware referenced as an example of a sophisticated false-flag operation complicating attribution.
Referenced as a destructive malware incident affecting the Olympic Games organization; no additional technical details provided in this content.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.