Who Wasn’t Responsible for Olympic Destroyer?
Summary: Cisco Talos found the evidence linking Olympic Destroyer, the malware behind the Pyeongchang Olympics attack that knocked the website offline and degraded WiFi for reporters, to any specific threat actor contradictory and inconclusive. The clues pointed at Lazarus/Bluenoroff, APT3 and APT10, but each rested on publicly available code or techniques - a filename check, a wiper routine, Mimikatz-derived code, unused EternalBlue structures - that the author could have planted as false flags.
Key Takeaway: Talos notes the actor deliberately left artifacts to provoke false attribution, and that every misattribution gives adversaries something to hide behind - including a country denying an attack by citing an unwitting third party's evidence.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026