Olympic Destroyer Takes Aim At Winter Olympics
Summary: Cisco Talos identified, with moderate confidence, malware samples used in the attack on the Pyeongchang Winter Olympics, which officials confirmed on February 11 after technical issues during the opening ceremony that were resolved in about 12 hours. The samples perform only destructive functionality - deleting shadow copies, event logs and backups via vssadmin, wbadmin and bcdedit, disabling services, wiping writable files on mapped shares, and using a legitimate signed PsExec for lateral movement - with no evidence of data exfiltration and an infection vector still unknown.
Why it matters: The malware carried 44 individual accounts and browser and LSASS credential stealers, then rewrote itself with newly harvested credentials to spread - so the attack's reach grew with every machine it touched. Recovery was deliberately made non-trivial: shadow copies, backups, the recovery console and event logs were all removed before the system was shut down.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026