Log in Request a demo

Malware profile

Olympic Destroyer

Olympic Destroyer is a Windows wiper that was used against computers supporting the 2018 Winter Olympics in Pyeongchang, South Korea.

In short

Olympic Destroyer is a Windows wiper that was used against computers supporting the 2018 Winter Olympics in Pyeongchang, South Korea. MITRE ATT&CK says its main purpose was to render infected systems inoperable, and that it has worm-like features to spread across a network. The US Department of Justice and the UK government attribute the attack to the Russian GRU unit known as Sandworm.

Last updated 9 October 2026

Profile MapMalware
  1. Names1names in public reportsOlympic Destroyer
  2. Techniques14ATT&CK techniques listedCredential Access · Discovery · Execution
  3. Infection Steps6in the delivery chainBreach of the IT provider · Credential theft
  4. Linked Groups1groups that use itSandworm

In one minute

What it is
A Windows wiper used against IT systems of the 2018 Winter Olympics in Pyeongchang, South Korea.
What it does
Steals credentials, spreads across the network, deletes files, clears logs and recovery features, then shuts the machine down.
Who uses it
Attributed by the US Department of Justice (indictment announced 19 October 2020) and by the UK government (19 October 2020) to GRU Unit 74455, known as Sandworm. MITRE also lists Sandworm Team.
How it gets in
The sources read do not say how the first network was breached. The indictment says the attackers used a stolen domain administration account to deploy it.
What to do first
Protect admin and domain accounts, keep offline backups, and watch for tools that delete shadow copies or recovery settings.

What it does

The malware was run on 9 February 2018, the day of the opening ceremony. The US indictment says it was built to steal valid user credentials, use them to spread, delete files, force shutdowns and misconfigure BitLocker so that machines could not reboot or recover.

The UK government says the GRU unit tried to disguise itself as North Korean and Chinese hackers. The indictment says the code was crafted to look like malware of the Lazarus Group.

Names

Public sources use several names for this malware.

Names
NameWhere it appears
Olympic DestroyerMITRE ATT&CK software S0365, the US indictment, the UK FCDO page and the DOJ press release[1, 2, 3, 4]

What it can do

What MITRE ATT&CK lists this malware as doing, by tactic. Each id opens our technique page where one exists, otherwise MITRE.

Credential Access

  • OS Credential Dumping: LSASS Memory T1003.001

    A module tries to take credentials from LSASS, which are then used with PsExec and WMI to spread.[1]

  • Credentials from Password Stores: Credentials from Web Browsers T1555.003

    A module tries to take stored credentials from web browsers.[1]

Discovery

  • System Network Configuration Discovery T1016

    It calls system functions to list the ARP table of the infected computer.[1]

  • Remote System Discovery T1018

    It uses WMI to list all systems on the network.[1]

  • Network Share Discovery T1135

    It looks for mapped network shares so it can try to wipe the files on them.[1]

Execution

  • Windows Management Instrumentation T1047

    It uses WMI to help spread across a network.[1]

  • System Services: Service Execution T1569.002

    It uses PsExec to help spread across a network.[1]

Lateral Movement

  • Remote Services: SMB/Windows Admin Shares T1021.002

    It uses PsExec with the ADMIN$ share to run commands on other systems.[1]

  • Lateral Tool Transfer T1570

    It tries to copy itself to other machines on the network.[1]

Defense Impairment

  • Disable or Modify Tools: Clear Windows Event Logs T1685.005

    It tries to clear the System and Security event logs with wevtutil.[1]

Impact

  • Data Destruction T1485

    It overwrites files on the local machine and on remote shares.[1, 2, 3]

  • Service Stop T1489

    It calls ChangeServiceConfigW to disable all services on the system.[1]

  • Inhibit System Recovery T1490

    It uses vssadmin, wbadmin and bcdedit to delete or disable recovery features such as the backup catalog and Automatic Repair.[1]

  • System Shutdown/Reboot T1529

    It shuts the system down once it has finished changing configuration settings.[1, 3]

How it spreads

The US indictment says the malware was designed to steal valid user credentials from a victim computer and then spread and replicate itself across the network by using those credentials. MITRE ATT&CK adds that it uses PsExec and Windows Management Instrumentation to propagate and tries to copy itself to remote machines. The sources read do not say how the first IT company network was breached.

How an infection runs

The order of steps in a typical infection, as the sources describe it.

  1. Breach of the IT provider

    The attackers compromised the network of an IT company supporting the Games and moved through it looking for user credentials and information on the Olympic IT services.[3]

  2. Credential theft

    They stole credentials with an open-source tool on 22 December 2017 and later used PowerShell scripts to dump credentials from more than 16,000 computers and servers.[3]

  3. Access to the Olympic environment

    Using a network architect's credentials they reached the computers that supported the Games.[3]

  4. Domain administrator access

    With a compromised domain administration account they had what they needed to deploy and run the malware.[3]

  5. Deployment of the wiper

    On 9 February 2018 they uploaded the malware, then used a deployer account to run the wiper component on many computers at once during the opening ceremony.[3]

  6. Spread to the organizing committee

    They used a link between a second IT company and the PyeongChang Organizing Committee to reach it, and the malware rebooted and wiped 30 of its computers.[3]

Timeline

  1. December 5, 2017

    IOC sanctions Russia

    The IOC suspended the Russian Olympic Committee and barred Russian athletes from competing under the Russian flag. The indictment says the attackers then designed a campaign against the Olympics.[3]

  2. December 21, 2017

    Network reconnaissance begins

    The indictment says the attackers began reconnaissance and lateral movement across the IT company network by this date.[3]

  3. January 12, 2018

    Domain administration account taken

    The attackers used stolen credentials to access a domain administration account and fully compromised the domain.[3]

  4. February 9, 2018

    Wiper run during the opening ceremony

    The malware was uploaded at about 6:24 p.m. Korea Standard Time and the wiper component was run at about 7:42 p.m., during the opening ceremony. IT staff saw laptops reboot with BitLocker recovery prompts.[3]

  5. February 9, 2018

    Organizing committee hit

    From about 7:33 p.m. to 10:23 p.m. the malware was deployed to 30 computers of the PyeongChang Organizing Committee, which it rebooted and wiped.[3]

  6. October 19, 2020

    US charges six GRU officers

    The Department of Justice announced charges that include the Olympic Destroyer attack against the 2018 Winter Olympics.[2, 3]

  7. 19 October 2020

    UK exposes the attack as GRU work

    The UK government said for the first time that GRU unit GTsST was responsible, and the NCSC assessed that the intent was almost certainly sabotage.[4]

Detection and defense

  1. Keep backups the attacker cannot reach

    MITRE advises regular backups and disaster recovery plans, stored off the system and protected from methods used to destroy them. This is the main answer to a wiper.[7, 6]

    Counters: T1485 T1490

  2. Protect system recovery settings

    MITRE advises technical controls that stop services being disabled and recovery files being deleted. Application control can also block unneeded tools such as diskshadow.[6]

    Counters: T1490

  3. Harden LSASS and admin accounts

    MITRE advises Attack Surface Reduction rules to secure LSASS and not placing domain accounts in local administrator groups unless tightly controlled. The indictment shows a domain administration account was how the wiper was deployed.[8, 3]

    Counters: T1003.001

  4. Restrict admin shares and SMB

    MITRE advises disabling Windows administrative shares where possible and using the host firewall to limit file sharing.[9]

    Counters: T1021.002

  5. Limit WMI use

    MITRE advises Attack Surface Reduction rules to block processes created by WMI commands, noting that many legitimate tools use WMI.[10]

    Counters: T1047

  6. Watch for recovery tampering

    MITRE detection strategies describe process chains that use vssadmin, wbadmin or bcdedit to delete shadow copies, and mass file overwrite or deletion.[6, 7]

    Counters: T1490 T1485

  7. Official detection resources

    We found no government advisory or malware analysis report with signatures for Olympic Destroyer. The DOJ indictment is the official account of the attack, and MITRE lists detection strategies DET0329 and DET0146.[3, 6, 7]

    Counters: T1490 T1485

Questions

What is Olympic Destroyer?

MITRE ATT&CK describes it as malware used by Sandworm Team against the 2018 Winter Olympics in Pyeongchang. Its main purpose was to render infected computer systems inoperable.

Who was behind it?

The US Department of Justice charged six GRU officers of Unit 74455 on 19 October 2020, and the indictment includes the Olympic Destroyer attack. The UK government on the same day attributed it to the GRU unit GTsST.

What did it affect?

The indictment says thousands of computers used by an IT company and the PyeongChang Organizing Committee were compromised, and that 30 committee computers were wiped. The UK says disruption could have been greater without administrators who isolated the malware and replaced computers.

Did the attackers hide their identity?

The indictment says the code was crafted to emulate Lazarus Group malware. The UK says the unit tried to disguise itself as North Korean and Chinese hackers.

How should defenders prepare for wipers?

Keep offline backups, protect admin and domain credentials, and restrict admin shares. MITRE also advises controls that stop recovery features being disabled.

In our research

  1. Sandworm (APT44): Russia’s Most Destructive Cyber Weapon November 2025
  2. SandWorm APT Group Cyber Intelligence Report September 2023
  3. HermeticWiper Malware Technical Analysis Open Report May 2023
  4. Sandworm Threat group

Sources

  1. Olympic Destroyer, Software S0365 MITRE ATT&CKSupports: Description, platform, techniques and how each is used.
  2. Six Russian GRU Officers Charged in Connection with Worldwide Deployment of Destructive Malware US Department of JusticeSupports: Charges announced 19 October 2020, impact on thousands of computers.
  3. Indictment, United States v. Andrienko et al. (Military Unit 74455) US Department of JusticeSupports: Attack timeline, how it spread, victims, false flag, Unit 74455 and Sandworm.
  4. UK exposes series of Russian cyber attacks against Olympic and Paralympic Games UK Foreign, Commonwealth and Development Office and NCSCSupports: UK attribution to GTsST, sabotage assessment, 19 October 2020.
  5. Sandworm Team, Group G0034 MITRE ATT&CKSupports: MITRE ties Olympic Destroyer to Sandworm Team and Unit 74455.
  6. Data Destruction, T1485 MITRE ATT&CKSupports: Backup mitigation and detection strategy.
  7. Inhibit System Recovery, T1490 MITRE ATT&CKSupports: Recovery mitigations and detection strategy.
  8. LSASS Memory, T1003.001 MITRE ATT&CKSupports: LSASS and privileged account mitigations.
  9. SMB/Windows Admin Shares, T1021.002 MITRE ATT&CKSupports: Admin share and SMB mitigations.
  10. Windows Management Instrumentation, T1047 MITRE ATT&CKSupports: WMI mitigation.

Browse the threat library

Keep exploring

Knowledge Hub

Article

SandWorm APT Group Cyber Intelligence Report

Intelligence report on the Sandworm APT group — threat actor profile, historical campaigns, toolset analysis, geopolitical targeting patterns, and defensive

Read more

Glossary term

MITRE ATT&CK

MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.

Read more

Threat group

Lazarus Group

Lazarus Group is the name used by MITRE, the US Treasury and the US Department of Justice for North Korean hacking units that, they say, work for the Reconnaissance General Bureau. The US charged three RGB members in 2020 and 2021 with attempts to steal or extort more than $1.3 billion, and the FBI attributed the 2025 Bybit theft to North Korean actors it tracks as TraderTraitor.

Read more