winlogon.exe SAME_AS Olympic Destroyer
Cisco Talos named the malicious winlogon.exe worm Olympic Destroyer.
Explicit Confidence 98% · Jack Rhysider EP 77 Details
“it was Talos that gave this worm a name; Olympic Destroyer.”
Malware
malware:olympic_destroyer
Also: winlogon.exe
Destructive malware that spread through and disrupted the IT infrastructure of the 2018 Winter Olympics.
Destructive malware that spread through and disrupted the IT infrastructure of the 2018 Winter Olympics.
“it was Talos that gave this worm a name; Olympic Destroyer.”
“The malware was called winlogon.exe”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | AFFECTS | Microsoft Windows | Explicit | 77 |
| outgoing | AFFECTS | Domain controller | Explicit | 77 |
| outgoing | USES | wiper | Explicit | 77 |
| outgoing | USES | lateral movement | Explicit | 77 |
| outgoing | ASSOCIATED_WITH | Lazarus | Uncertain | 77 |
| outgoing | ASSOCIATED_WITH | APT3 | Attributed | 77 |
| outgoing | ASSOCIATED_WITH | XData | Attributed | 77 |
| outgoing | DISCOVERED_BY | Cisco Talos | Explicit | 77 |
| outgoing | DISCOVERED_BY | AhnLab | Explicit | 77 |
| outgoing | DISCOVERED_BY | Igor Sumenkov | Explicit | 77 |
| incoming | SAME_AS | winlogon.exe | Explicit | 77 |
winlogon.exe SAME_AS Olympic Destroyer
Cisco Talos named the malicious winlogon.exe worm Olympic Destroyer.
Explicit Confidence 98% · Jack Rhysider EP 77 Details
“it was Talos that gave this worm a name; Olympic Destroyer.”
Olympic Destroyer AFFECTS Microsoft Windows
Olympic Destroyer disabled Windows services and rendered Windows-based servers unusable.
Explicit Confidence 98% · Andy Greenberg EP 77 Details
“disabling all of their Windows services and shutting the computer down so it couldn’t be rebooted”
Olympic Destroyer AFFECTS Domain controller
The malware repeatedly wiped the Olympic domain controllers.
Explicit Confidence 98% · Andy Greenberg EP 77 Details
“they find that as they’re rebuilding domain controllers, for instance, they’re being wiped again by some piece of malware in their system”
Olympic Destroyer USES wiper
The malware used destructive wiping behavior, deleting data and disabling systems.
Explicit Confidence 96% · Andy Greenberg EP 77 Details
“a component that would use those stolen passwords with remote access features to spread among computers and destroy all of the data on them”
Olympic Destroyer USES lateral movement
The worm used stolen passwords and remote-access features to spread among computers.
Explicit Confidence 98% · Andy Greenberg EP 77 Details
“use those stolen passwords with remote access features to spread among computers”
Olympic Destroyer ASSOCIATED_WITH Lazarus
Researchers found wiper-code similarities between Olympic Destroyer and malware associated with Lazarus, but the episode presents this as one potentially misleading clue.
Uncertain Confidence 95% · Andy Greenberg EP 77 Details
“There were, for instance, code matches with malware from the North Korean group called Lazarus”
Olympic Destroyer ASSOCIATED_WITH APT3
Intezer reported that part of Olympic Destroyer’s password-stealing code matched APT3, which is described as widely understood to be Chinese.
Attributed Confidence 97% · Andy Greenberg EP 77 Details
“Intezer pointed out that a chunk of the password-stealing code in Olympic Destroyer matched with a different hacker group called APT3”
Olympic Destroyer ASSOCIATED_WITH XData
CrowdStrike found similarities between Olympic Destroyer and the ransomware XData used by Russian hackers.
Attributed Confidence 97% · Andy Greenberg EP 77 Details
“CrowdStrike found similarities in parts of Olympic Destroyer with a piece of ransomware that Russian hackers had used called XData”
Olympic Destroyer DISCOVERED_BY Cisco Talos
Cisco Talos analyzed winlogon.exe and assigned it the name Olympic Destroyer.
Explicit Confidence 98% · Jack Rhysider EP 77 Details
“Cisco Talos analyzed winlogon.exe, that malicious file that wiped the computers”
Olympic Destroyer DISCOVERED_BY AhnLab
AhnLab helped isolate the malware and create a signature for it.
Explicit Confidence 98% · Andy Greenberg EP 77 Details
“with the help of this Korean security company AhnLab – isolate and create a signature for this automated piece of malware”
Olympic Destroyer DISCOVERED_BY Igor Sumenkov
Igor Sumenkov identified that the apparent Lazarus Rich Header had been forged.
Explicit Confidence 97% · Andy Greenberg EP 77 Details
“What Igor Sumenkov had found though was that this means someone was trying to make it look like North Korea”