Olympic Destroyer

Olympic Destroyer is a notorious malware that was deployed by Sandworm, a cyber-espionage group, during the 2018 Pyeongchang Winter Olympics. The malware caused significant disruption to the event's IT infrastructure, including broadcasting, ticketing, various Olympics websites, and Wi-Fi at the host stadium. Designed to exploit and damage computer systems, Olympic Destroyer infiltrates through suspicious downloads, emails, or websites, often unbeknownst to the user. Once inside, it can steal personal information, disrupt operations, or even hold data hostage for ransom. The attack was sophisticated, as it was engineered to falsely implicate North Korea's Lazarus group. The malware sample contained an embedded SQLite system credential stealer. In addition to stealing browser credentials, Olympic Destroyer also drops and executes a system stealer. To facilitate lateral movement within the infected system, the malware deploys a legitimate, digitally signed PsExec file, a tool from Microsoft. This attack was not isolated; there have been other instances where prominent international sports organizations were targeted, such as the serious data leak at the World Anti-Doping Agency (WADA) in 2016 that exposed the medical information of numerous global sports personalities. In response to these threats, agencies like ANSSI, CISA, and private-sector partners such as Cisco France have developed ready-to-use crisis exercises based on past attacks against previous Olympic Games, including the 2018 hack dubbed "Olympic Destroyer." The hacking group behind this, most commonly known as APT28, has a long history of high-profile cyber offensives, including US election interference in 2016, the NotPetya attacks, and others. Officials are keen to avoid a repeat of the massive disruptions caused by suspected Russian attackers during the opening ceremony of the 2018 Winter Olympics in Pyeongchang, South Korea.