Andy Greenberg AUTHORED Sandworm
Andy Greenberg says he is the author of Sandworm, which contains this story.
Explicit Confidence 99% · Andy Greenberg EP 77 Details
“I’m still the author of Sandworm because this is a story from Sandworm.”
Episode
27 October 2020 Official episode · Official transcript
advanced persistent threat
The episode examines the 2018 cyberattack against the Pyeongchang Winter Olympics, the Olympic Destroyer malware, its deceptive forensic clues, and the attribution of the attack to Russia’s GRU Unit 74455, also identified as Sandworm.
Topics: Destructive malware and wiper behavior, Malware attribution and forensic analysis, False flags and deceptive malware artifacts, Phishing with malicious Word documents and macros, Password theft and remote-access-based lateral movement, Rich Header forgery, Domain-controller disruption and recovery from backups, Cyberattacks against the Olympic Games, GRU and state-sponsored cyber operations
Links published on the Darknet Diaries episode page. Not LLM output.
Qualified statements from this episode, not graph facts.
Andy Greenberg AUTHORED Sandworm
Andy Greenberg says he is the author of Sandworm, which contains this story.
Explicit Confidence 99% · Andy Greenberg EP 77 Details
“I’m still the author of Sandworm because this is a story from Sandworm.”
Olympic Destroyer TARGETS South Korea
The attack targeted the Winter Olympics in South Korea.
Explicit Confidence 99% · Jack Rhysider EP 77 Details
“the Winter Olympics in 2018 which was in South Korea”
Olympic Destroyer INVOLVES winlogon.exe
The Olympic attack involved the malicious file winlogon.exe, which repeatedly wiped systems.
Explicit Confidence 99% · Andy Greenberg EP 77 Details
“they’re being wiped again by some piece of malware in their system. They are able to figure out that it’s this one malicious file called winlogon.exe.”
winlogon.exe SAME_AS Olympic Destroyer
Cisco Talos named the malicious winlogon.exe worm Olympic Destroyer.
Explicit Confidence 98% · Jack Rhysider EP 77 Details
“it was Talos that gave this worm a name; Olympic Destroyer.”
Olympic Destroyer AFFECTS Microsoft Windows
Olympic Destroyer disabled Windows services and rendered Windows-based servers unusable.
Explicit Confidence 98% · Andy Greenberg EP 77 Details
“disabling all of their Windows services and shutting the computer down so it couldn’t be rebooted”
Olympic Destroyer AFFECTS Domain controller
The malware repeatedly wiped the Olympic domain controllers.
Explicit Confidence 98% · Andy Greenberg EP 77 Details
“they find that as they’re rebuilding domain controllers, for instance, they’re being wiped again by some piece of malware in their system”
Olympic Destroyer USES wiper
The malware used destructive wiping behavior, deleting data and disabling systems.
Explicit Confidence 96% · Andy Greenberg EP 77 Details
“a component that would use those stolen passwords with remote access features to spread among computers and destroy all of the data on them”
Olympic Destroyer USES lateral movement
The worm used stolen passwords and remote-access features to spread among computers.
Explicit Confidence 98% · Andy Greenberg EP 77 Details
“use those stolen passwords with remote access features to spread among computers”
Olympic Destroyer INITIAL_ACCESS_VIA phishing
The initial infection appears to have begun with phishing emails containing malicious Word documents.
Explicit Confidence 99% · Jack Rhysider EP 77 Details
“the initial infection of the Olympic network began with a phishing e-mail”
phishing USES Malicious Macro Generator
The phishing documents used macros created with the Malicious Macro Generator.
Explicit Confidence 98% · Jack Rhysider EP 77 Details
“these macros were created with a tool called Malicious Macro Generator”
Olympic Destroyer INVOLVES false flag
The attack involved numerous false flags and clues pointing toward different countries.
Explicit Confidence 98% · Andy Greenberg EP 77 Details
“the hackers, instead of trying to simply cover their tracks, they had built-in tracks pointing in every direction at once”
Olympic Destroyer ASSOCIATED_WITH Lazarus
Researchers found wiper-code similarities between Olympic Destroyer and malware associated with Lazarus, but the episode presents this as one potentially misleading clue.
Uncertain Confidence 95% · Andy Greenberg EP 77 Details
“There were, for instance, code matches with malware from the North Korean group called Lazarus”
Olympic Destroyer ASSOCIATED_WITH APT3
Intezer reported that part of Olympic Destroyer’s password-stealing code matched APT3, which is described as widely understood to be Chinese.
Attributed Confidence 97% · Andy Greenberg EP 77 Details
“Intezer pointed out that a chunk of the password-stealing code in Olympic Destroyer matched with a different hacker group called APT3”
Olympic Destroyer ASSOCIATED_WITH XData
CrowdStrike found similarities between Olympic Destroyer and the ransomware XData used by Russian hackers.
Attributed Confidence 97% · Andy Greenberg EP 77 Details
“CrowdStrike found similarities in parts of Olympic Destroyer with a piece of ransomware that Russian hackers had used called XData”
Olympic Destroyer DISCOVERED_BY Cisco Talos
Cisco Talos analyzed winlogon.exe and assigned it the name Olympic Destroyer.
Explicit Confidence 98% · Jack Rhysider EP 77 Details
“Cisco Talos analyzed winlogon.exe, that malicious file that wiped the computers”
Olympic Destroyer DISCOVERED_BY AhnLab
AhnLab helped isolate the malware and create a signature for it.
Explicit Confidence 98% · Andy Greenberg EP 77 Details
“with the help of this Korean security company AhnLab – isolate and create a signature for this automated piece of malware”
Olympic Destroyer DISCOVERED_BY Igor Sumenkov
Igor Sumenkov identified that the apparent Lazarus Rich Header had been forged.
Explicit Confidence 97% · Andy Greenberg EP 77 Details
“What Igor Sumenkov had found though was that this means someone was trying to make it look like North Korea”
Olympic Destroyer ATTRIBUTED_TO Sandworm
The episode ultimately identifies Sandworm as the group responsible for the Olympic attack, while earlier forensic clues were deliberately deceptive.
Attributed Confidence 98% · Jack Rhysider EP 77 Details
“this was the same group that conducted NotPetya, one of the most extreme cyber-attacks the world has ever seen. This was the hacking group known as Sandworm.”
Olympic Destroyer ATTRIBUTED_TO Russia
The DOJ indictment attributed the Olympic sabotage to officers of Russia’s military intelligence unit 74455.
Attributed Confidence 99% · Doj EP 77 Details
“The defendants in this case were all members of the military unit 74455 of the Russia main intelligence directorate, known as the GRU.”
Unit 74455 PART_OF GRU
Unit 74455 is described as a unit of the GRU, Russia’s main intelligence directorate.
Explicit Confidence 99% · Doj EP 77 Details
“military unit 74455 of the Russia main intelligence directorate, known as the GRU”
Sandworm ASSOCIATED_WITH Unit 74455
The episode says the Mueller Report identified Unit 74455 as Sandworm; this is presented as the working identification of the group.
Attributed Confidence 98% · Jack Rhysider EP 77 Details
“it was the first time we learned that Unit 74455 was Sandworm”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T06:42:27.785375+00:00