Olympic Destroyer (2018)

From International cyber law: interactive toolkit

Jump to navigation
Jump to search

Date

December 2017 through February 2018 (culmination on February 9, 2018)[1][2]

Suspected actor

Russian Federation (official attribution made by the US[2] and the UK[3][4])

Target

The Winter Olympics hosted in Pyeongchang, South Korea.[1] In particular, the operation targeted computers supporting the 2018 PyeongChang Winter Olympic Games, South Korean citizens and officials, Olympic athletes, partners, and visitors, and International Olympic Committee (IOC) officials.[2]

Method

From December 2017 through February 2018 by spear-phishing campaigns and malicious mobile applications, culminating on February 9, 2018 into destructive malware attack against the opening ceremony, using malware known as Olympic Destroyer.[2] This malware was designed to knock computers offline by deleting critical system files, which would render the machines useless.[5][6]

Olympic Destroyer malware was very sophisticated with respect to its traceability as it contained layers of false clues pointing at multiple potential culprits.[1] Within the few days after its discovery, research teams from all over the world detected a number of features previously attributed to cyber-espionage and sabotage actors allegedly based in (or working for) China, Russia and North Korea.[7] For example, the malware code seems to be designed to match the fingerprint used by the North Korean group Lazarus.[7]

Consequently, experts recognize the fingerprint of Olympic Destroyer as a very sophisticated false flag, intentionally placed inside the malware in order to give the impression of finding a ‘smoking gun’ evidence leading to attribution to a different actor.[7] Also the UK National Cyber Security Centre confirmed that "the GRU’s cyber unit attempted to disguise itself as North Korean and Chinese hackers when it targeted the opening ceremony."[8]

Purpose

Disruption seems to be primary objective in this type of attack, causing embarrassment of the Olympic committee during the opening ceremony.[6] Therefore, it is believed that this cyber operation did not pursue financial gains or exfiltration of data, but rather to cause chaos.[9] One of the motivations behind this cyber operation might be the retaliation against the International Olympic Committee for its decision to ban Russia from competing under its own flag at Pyeongchang 2018 because of allegations of state-sponsored doping.[10]

Result

Due to the deletion of critical system files, some of the Winter Games' internal servers, including the Olympic website, display monitors as well as the public Wi-Fi, crashed. This led to some people being unable to print out their tickets or watch the opening ceremony.[6][9] However, the Olympic organizers were able to get systems working again within several hours[9] (in contrast to damage caused by NotPetya to victims who in many cases permanently lost tens of thousands of computers, taking weeks to fully recover.[11]

Aftermath

Initially, the organizers declined to name any potential suspects or motives behind the attack.[11] Later on, the cyber operation was followed namely by condemnations and accusations towards Russia and its GRU organisation. Especially the UK and the US put a pressure on Russia. The UK publicly exposed this and other attacks as the work of the GRU.[3] Six Russian GRU officers were even charged by the US in connection with worldwide deployment of destructive malware and other disruptive actions in cyberspace, which included the Olympic Destroyer incident.[2]

It is believed that the same author (GRU) is behind a cyber reconnaissance against officials and organisations affiliated to the 2020 Olympic and Paralympic Games to take place in Tokyo before they were postponed.[4]

Analysed in

Scenario 21: Misattribution caused by deception

Collected by: Petr Stejskal & Martin Faix

↑ Jump up to: 1.0 1.1 1.2 Andy Greenberg, ‘The Untold Story of the 2018 Olympics Cyberattack, the Most Deceptive Hack in History’ (Wired, 17 October 2019)

↑ Jump up to: 2.0 2.1 2.2 2.3 2.4 U.S. Department of Justice, ‘Six Russian GRU Officers Charged in Connection with Worldwide Deployment of Destructive Malware and Other Disruptive Actions in Cyberspace’ (justice.gov, 19 October 2020)

↑ Jump up to: 3.0 3.1 Foreign, Commonwealth & Development Office, ‘UK exposes series of Russian cyber attacks against Olympic and Paralympic Games’ (gov.uk, 19 October 2020)

↑ Jump up to: 4.0 4.1 See also Kim Sengupta, ‘Britain accuses Russia of cyberattacks on Tokyo 2020 Olympics’ (Independent, 20 October 2020)

↑ Jim Finkle, ‘'Olympic Destroyer' malware targeted Pyeongchang Games: firms’ (Reuters, 12 February 2018).

↑ Jump up to: 6.0 6.1 6.2 On more technical aspects of the cyber operation, see Chirstopher Kanaracus, ‘‘Olympic Destroyer’ Malware Behind Winter Olympics Cyberattack, Researchers Say’ (threatpost, 12 February 2018) and Warren Mercer, Paul Rascagneres, ‘Olympic Destroyer Takes Aim At Winter Olympics’ (Talos, 12 February 2018).

↑ Jump up to: 7.0 7.1 7.2 ‘The Olympic False Flag: How infamous OlympicDestroyer malware was designed to confuse cybersecurity community’ (kaspersky, 8 March 2018)

↑ National Cyber Security Centre, ‘UK and partners condemn GRU cyber attacks against Olympic and Paralympic Games’ (ncsc.gov.uk, 19 October 2020)

↑ Jump up to: 9.0 9.1 9.2 Alfred Ng, Daniel van Boom, ‘Winter Olympics cyberattack designed to cause chaos’ (cnet, 12 February 2018)

↑ Karolos Grohmann, ‘Russia banned from Pyeongchang Winter Olympics’ (Reuters, 5 December 2017); Ippolito Forni, ‘2020 Tokyo Summer Olympics From a CTI Perspective’ (EclecticIQ, 12 August 2019)

↑ Jump up to: 11.0 11.1 Andy Greenberg, ‘'Olympic Destroyer' Malware Hit Pyeongchang Ahead of Opening Ceremony’

Retrieved from "https://cyberlaw.ccdcoe.org/wiki/Olympic_Destroyer_(2018)?oldid=2649"

Categories:

Example

2018

Cookies help us deliver our services. By using our services, you agree to our use of cookies.

More informationOK

Navigation menu

Personal tools

Not logged in

Talk

Dark mode

Contributions

Create account

Log in

Namespaces

Page

Discussion

English

Views

Read

Edit

Edit source

View history

More

Purge

Search

Navigation

Main page

Recent changes

Random page

Help

Tools

What links here

Related changes

Special pages

Printable version

Permanent link

Page information

Cite this page

Get shortened URL

This page was last edited on 17 August 2021, at 14:57.

Content is available under Creative Commons Attribution-ShareAlike 4.0 International (CC BY-SA 4.0) unless otherwise noted.

Privacy policy

About International cyber law: interactive toolkit

Disclaimers

Terms of Use

Donate to Miraheze