Olympic Destroyer TARGETS South Korea
The attack targeted the Winter Olympics in South Korea.
Explicit Confidence 99% · Jack Rhysider EP 77 Details
“the Winter Olympics in 2018 which was in South Korea”
Incident
incident:olympic_destroyer
Cyberattack against the Pyeongchang Winter Olympics that disrupted authentication, WiFi, ticketing, websites, and other systems.
Cyberattack against the Pyeongchang Winter Olympics that disrupted authentication, WiFi, ticketing, websites, and other systems.
“Malware ripped through the IT infrastructure of the Winter Olympics in South Korea”
“who was responsible for this attack on the Olympics”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | TARGETS | South Korea | Explicit | 77 |
| outgoing | INVOLVES | winlogon.exe | Explicit | 77 |
| outgoing | INITIAL_ACCESS_VIA | phishing | Explicit | 77 |
| outgoing | INVOLVES | false flag | Explicit | 77 |
| outgoing | ATTRIBUTED_TO | Sandworm | Attributed | 77 |
| outgoing | ATTRIBUTED_TO | Russia | Attributed | 77 |
Olympic Destroyer TARGETS South Korea
The attack targeted the Winter Olympics in South Korea.
Explicit Confidence 99% · Jack Rhysider EP 77 Details
“the Winter Olympics in 2018 which was in South Korea”
Olympic Destroyer INVOLVES winlogon.exe
The Olympic attack involved the malicious file winlogon.exe, which repeatedly wiped systems.
Explicit Confidence 99% · Andy Greenberg EP 77 Details
“they’re being wiped again by some piece of malware in their system. They are able to figure out that it’s this one malicious file called winlogon.exe.”
Olympic Destroyer INITIAL_ACCESS_VIA phishing
The initial infection appears to have begun with phishing emails containing malicious Word documents.
Explicit Confidence 99% · Jack Rhysider EP 77 Details
“the initial infection of the Olympic network began with a phishing e-mail”
Olympic Destroyer INVOLVES false flag
The attack involved numerous false flags and clues pointing toward different countries.
Explicit Confidence 98% · Andy Greenberg EP 77 Details
“the hackers, instead of trying to simply cover their tracks, they had built-in tracks pointing in every direction at once”
Olympic Destroyer ATTRIBUTED_TO Sandworm
The episode ultimately identifies Sandworm as the group responsible for the Olympic attack, while earlier forensic clues were deliberately deceptive.
Attributed Confidence 98% · Jack Rhysider EP 77 Details
“this was the same group that conducted NotPetya, one of the most extreme cyber-attacks the world has ever seen. This was the hacking group known as Sandworm.”
Olympic Destroyer ATTRIBUTED_TO Russia
The DOJ indictment attributed the Olympic sabotage to officers of Russia’s military intelligence unit 74455.
Attributed Confidence 99% · Doj EP 77 Details
“The defendants in this case were all members of the military unit 74455 of the Russia main intelligence directorate, known as the GRU.”