Olympic Destroyer

Olympic Destroyer is a notorious malware that wreaked havoc during the 2018 Winter Olympics in Pyeongchang, South Korea. The malicious software was deployed by Sandworm, a cyber-espionage group believed to be associated with APT28, a Russian cyber threat actor with a long history of high-profile cyber offensives, including US election interference in 2016 and the NotPetya attacks. The Olympic Destroyer attack caused significant disruption to the event's IT infrastructure, affecting broadcasting, ticketing, various Olympics websites, and Wi-Fi at the host stadium. This interference temporarily disabled key systems, including Wi-Fi at the stadium, IOC worker monitors, and the event's ticketing website, during the opening ceremony. The Olympic Destroyer malware showcased advanced capabilities such as system credential stealing and lateral movement using legitimate tools from Microsoft. Specifically, it dropped and executed a system stealer, using SQLite embedded in its sample. Additionally, the malware dropped a legitimate, digitally signed, PsExec file to facilitate lateral movement within the compromised network. These sophisticated features enabled the malware to cause extensive damage and disruption. This incident marked a significant escalation in cyberattacks targeting major international events. It followed a serious data leak at the World Anti-Doping Agency (WADA) in 2016, which exposed the medical information of numerous global sports personalities. The Olympic Destroyer attack was cleverly designed to pin the blame on North Korea's Lazarus group, demonstrating the increasing sophistication of cyber threat actors. Since this watershed moment, similar attacks have become more common, underscoring the need for robust cybersecurity measures at all levels of international event organization.