Olympic Destroyer Olympic Destroyer

  • First known sample

    2017

  • Discovery

    2018

  • Number of targets

    Unknown

  • Current status

    Active

  • Type

    Cyber-espionage malware

  • TOP targeted countries

    France , Germany , Netherlands , Russia , Switzerland , Ukraine
OLYMPIC DESTROYER

More about the Olympic Destroyer malware, its infection chain and capabilities

Learn more

  • The way of propagation

    Unknown

  • Targets

    Organizations related to Winter Olympic Games 2018 , biological and chemical threat prevention organizations in EU , financial institutions in Russia
  • Description

    A destructive malware attack on the Olympic infrastructure a few days after the opening ceremony of the 2018 Winter Olympics in Pyeonchang, South Korea. The attack temporarily paralyzed IT systems, shutting down display monitors, killing Wi-Fi, and taking down the Olympics website so that visitors were unable to print tickets. The attack was attributed to Hades.

    Additional information

© 2024 AO Kaspersky Lab. All Rights Reserved. Privacy Policy Cookies
  1. Adding detection for known modules
  2. Collecting samples
  3. Reversing the samples
  4. Decrypting sophisticated encryption and compression schemes
  5. Understanding lateral movement
  6. Outlining multiple attack stages in the correct order
  7. Mapping C&C infrastructure
  8. Setting up sinkholes
  9. Analyzing collected traffic and communication protocols
  10. Crawling other hosts that understand the same protocol
  11. Taking down and acquiring images of C&C servers
  12. Identifying victims, sending out notifications to victims and global CERTs
  13. Applying forensic analysis and extracting logs, stolen files, other components
  14. Collecting and analyzing data from KSN, C&C servers, individual victims who are willing to work with us, sinkholes, crawlers, etc.
  15. Writing a comprehensive report
Read more
Mitigation is where enterprises need to start, prevention being significantly more effective and more cost-efficient than remediation after an attack Read more
For any inquiries, please contact apt.securelist@kaspersky.com If you are looking for more detailed information about an APT, please contact intelreports@kaspersky.com