Matrices

Enterprise
Mobile
ICS

Tactics

Enterprise
Mobile
ICS

Techniques

Enterprise
Mobile
ICS

Defenses

Data Sources

Mitigations

Enterprise
Mobile
ICS

Assets

CTI

Groups
Software
Campaigns

Resources

Get Started
Learn More about ATT&CK
ATT&CKcon
ATT&CK Data & Tools
FAQ
Engage with ATT&CK
Version History
Legal & Branding

Benefactors

Blog

Search

ATT&CKcon 5.0 returns October 22-23, 2024 in McLean, VA. Register for in-person participation here. Stay tuned for virtual registration!

SOFTWARE

Overview

3PARA RAT

4H RAT

AADInternals

ABK

AbstractEmu

ACAD/Medre.A

AcidRain

Action RAT

adbupd

AdFind

Adups

ADVSTORESHELL

Agent Smith

Agent Tesla

Agent.btz

AhRat

Akira

Allwinner

Amadey

Anchor

Android/AdDisplay.Ashas

Android/Chuli.A

AndroidOS/MalLocker.B

ANDROIDOS_ANSERVER.A

ANDROMEDA

AndroRAT

Anubis

AppleJeus

AppleSeed

Aria-body

Arp

Asacub

ASPXSpy

Astaroth

AsyncRAT

at

Attor

AuditCred

AuTo Stealer

AutoIt backdoor

Avaddon

Avenger

AvosLocker

Azorult

Babuk

BabyShark

BackConfig

Backdoor.Oldrea

BACKSPACE

Bad Rabbit

BADCALL

BADFLICK

BADHATCH

BADNEWS

BadPatch

Bandook

Bankshot

Bazar

BBK

BBSRAT

BendyBear

BISCUIT

Bisonal

BitPaymer

BITSAdmin

Black Basta

BlackCat

BLACKCOFFEE

BlackEnergy

BlackMould

BLINDINGCAN

BloodHound

BLUELIGHT

Bonadan

BONDUPDATER

BoomBox

BOOSTWRITE

BOOTRASH

BOULDSPY

BoxCaon

BrainTest

BRATA

Brave Prince

Bread

Briba

Brute Ratel C4

BS2005

BUBBLEWRAP

build_downer

Bumblebee

Bundlore

BUSHWALK

BusyGasper

Cachedump

CaddyWiper

Cadelspy

CALENDAR

Calisto

CallMe

Cannon

Carbanak

Carberp

Carbon

CarbonSteal

Cardinal RAT

CARROTBALL

CARROTBAT

Catchamas

Caterpillar WebShell

CCBkdr

ccf32

Cerberus

certutil

Chaes

Chameleon

Chaos

Charger

CharmPower

ChChes

Cheerscrypt

CHEMISTGAMES

Cherry Picker

China Chopper

Chinoxy

CHOPSTICK

Chrommme

Circles

Clambling

Clop

CloudDuke

cmd

COATHANGER

Cobalt Strike

Cobian RAT

CoinTicker

Comnie

ComRAT

Concipit1248

Conficker

ConnectWise

Conti

CookieMiner

CORALDECK

CORESHELL

Corona Updates

CosmicDuke

CostaBricks

CozyCar

CrackMapExec

CreepyDrive

CreepySnail

Crimson

CrossRAT

Crutch

Cryptoistic

CSPY Downloader

Cuba

Cyclops Blink

Dacls

DanBot

DarkComet

DarkGate

DarkTortilla

DarkWatchman

Daserf

DCSrv

DDKONG

DEADEYE

DealersChoice

DEATHRANSOM

DEFENSOR ID

Dendroid

Denis

Derusbi

Desert Scorpion

Diavol

Dipsind

Disco

DnsSystem

DOGCALL

Dok

Doki

Donut

DoubleAgent

down_new

Downdelph

DownPaper

DRATzarus

DressCode

Dridex

Drinik

DroidJack

DropBook

Drovorub

dsquery

Dtrack

DualToy

Duqu

DustySky

Dvmap

Dyre

Ebury

ECCENTRICBANDWAGON

Ecipekac

Egregor

EKANS

Elise

ELMER

Emissary

Emotet

Empire

EnvyScout

Epic

Escobar

esentutl

eSurv

EventBot

EvilBunny

EvilGrab

EVILNUM

Exaramel for Linux

Exaramel for Windows

Exobot

Exodus

Expand

Explosive

Fakecalls

FakeM

FakeSpy

FALLCHILL

FatDuke

Felismus

FELIXROOT

Ferocious

Fgdump

Final1stspy

FinFisher

FIVEHANDS

Flagpro

Flame

FLASHFLOOD

FlawedAmmyy

FlawedGrace

FlexiSpy

FLIPSIDE

FlixOnline

FluBot

FlyTrap

FoggyWeb

Forfiles

FRAMESTING

FrameworkPOS

FrozenCell

FruitFly

ftp

FunnyDream

FYAnti

Fysbis

Gazer

Gelsemium

GeminiDuke

Get2

gh0st RAT

Ginp

GLASSTOKEN

GLOOXMAIL

Gold Dragon

Golden Cup

GoldenEagle

GoldenSpy

GoldFinder

GoldMax

GolfSpy

Gooligan

Goopy

GPlayed

Grandoreiro

GravityRAT

Green Lambert

GreyEnergy

GRIFFON

GrimAgent

gsecdump

GuLoader

Gustuff

H1N1

Hacking Team UEFI Rootkit

HALFBAKED

HAMMERTOSS

Hancitor

HAPPYWORK

HARDRAIN

Havij

HAWKBALL

hcdLoader

HDoor

HELLOKITTY

Helminth

HenBox

HermeticWiper

HermeticWizard

Heyoka Backdoor

Hi-Zor

HiddenWasp

HIDEDRV

Hikit

HilalRAT

Hildegard

HOMEFRY

HOPLIGHT

Hornbill

HotCroissant

HTRAN

HTTPBrowser

httpclient

HUI Loader

HummingBad

HummingWhale

Hydraq

HyperBro

HyperStack

IceApple

IcedID

ifconfig

iKitten

Imminent Monitor

Impacket

INCONTROLLER

Industroyer

Industroyer2

InnaputRAT

INSOMNIA

InvisiMole

Invoke-PSImage

ipconfig

IronNetInjector

ISMInjector

Ixeshe

Janicab

Javali

JCry

JHUHUGIT

JPIN

jRAT

JSS Loader

Judy

KARAE

Kasidet

Kazuar

Kerrdown

Kessel

Kevin

KeyBoy

Keydnap

KEYMARBLE

KEYPLUG

KeyRaider

KGH_SPY

KillDisk

Kinsing

Kivars

Koadic

Kobalos

KOCTOPUS

Komplex

KOMPROGO

KONNI

KOPILUWAK

Kwampirs

LaZagne

LightNeuron

LIGHTWIRE

Linfo

Linux Rabbit

LiteDuke

LitePower

LITTLELAMB.WOOLTEA

Lizar

LockerGoga

LoFiSe

LoJax

Lokibot

LookBack

LoudMiner

LOWBALL

Lslsass

Lucifer

Lurid

Machete

MacMa

macOS.OSAMiner

MacSpy

Mafalda

MailSniper

Mandrake

Marcher

MarkiRAT

Matryoshka

MazarBOT

Maze

MCMD

MechaFlounder

meek

MegaCortex

Melcoz

MESSAGETAP

metaMain

Metamorfo

Meteor

Micropsia

Milan

Mimikatz

MimiPenguin

Miner-C

MiniDuke

MirageFox

Mis-Type

Misdat

Mispadu

Mivast

MobileOrder

MoleNet

Mongall

Monokle

MoonWind

More_eggs

Mori

Mosquito

MURKYTOP

Mythic

Naid

NanHaiShu

NanoCore

NativeZone

NavRAT

NBTscan

nbtstat

NDiskMonitor

Nebulae

Neoichor

Nerex

Net

Net Crawler

NETEAGLE

netsh

netstat

NetTraveler

Netwalker

NETWIRE

NGLite

ngrok

Nidiran

NightClub

Ninja

njRAT

NKAbuse

Nltest

NOKKI

NotCompatible

NotPetya

OBAD

ObliqueRAT

OceanSalt

Octopus

Okrum

OLDBAIT

OldBoot

Olympic Destroyer

OnionDuke

OopsIE

Orz

OSInfo

OSX/Shlayer

OSX_OCEANLOTUS.D

Out1

OutSteel

OwaAuth

P.A.S. Webshell

P2P ZeuS

P8RAT

PACEMAKER

Pacu

Pallas

Pandora

Pasam

Pass-The-Hash Toolkit

Pay2Key

Pcexter

PcShare

Pegasus for Android

Pegasus for iOS

Peirates

Penquin

Peppy

Phenakite

PHOREAL

Pillowmint

PinchDuke

Ping

PingPull

PipeMon

Pisloader

PITSTOP

PJApps

PLAINTEE

PLC-Blaster

PLEAD

PlugX

pngdowner

PoetRAT

PoisonIvy

PolyglotDuke

Pony

POORAIM

PoshC2

POSHSPY

Power Loader

PowerDuke

PowerLess

PowerPunch

PowerShower

POWERSOURCE

PowerSploit

PowerStallion

POWERSTATS

POWERTON

PowGoop

POWRUNER

Prestige

Prikormka

ProLock

Proton

Proxysvc

PS1

PsExec

Psylo

Pteranodon

PULSECHECK

PUNCHBUGGY

PUNCHTRACK

Pupy

pwdump

PyDCrypt

Pysa

QakBot

QUADAGENT

QuasarRAT

QUIETCANARY

QUIETEXIT

QuietSieve

Ragnar Locker

Raindrop

RainyDay

Ramsay

RAPIDPULSE

RARSTONE

RATANKBA

RawDisk

RawPOS

Rclone

RCSAndroid

RCSession

RDAT

RDFSNIFFER

Reaver

Red Alert 2.0

RedDrop

RedLeaves

Reg

RegDuke

Regin

Remcos

Remexi

RemoteCMD

RemoteUtilities

Remsec

Responder

Revenge RAT

REvil

RGDoor

Rifdoor

Riltok

RIPTIDE

Rising Sun

ROADTools

RobbinHood

ROCKBOOT

RogueRobin

ROKRAT

RotaJakiro

Rotexy

route

Rover

Royal

RTM

Rubeus

Ruler

RuMMS

RunningRAT

Ryuk

S-Type

S.O.V.A.

Saint Bot

Sakula

SamSam

Samurai

Sardonic

schtasks

SDBbot

SDelete

SeaDuke

Seasalt

SEASHARPEE

ServHelper

Seth-Locker

ShadowPad

Shamoon

Shark

SharkBot

SharpDisco

SharpStage

SHARPSTATS

ShiftyBug

ShimRat

ShimRatReporter

SHIPSHAPE

SHOTPUT

SHUTTERSPEED

Sibot

SideTwist

SILENTTRINITY

SilkBean

Siloscape

SimBad

Skeleton Key

Skidmap

Skygofree

SLIGHTPULSE

Sliver

SLOTHFULMEDIA

SLOWDRIFT

SLOWPULSE

Small Sieve

Smoke Loader

SMOKEDHAM

Snip3

SNUGRIDE

SocGholish

Socksbot

SodaMaster

SombRAT

SoreFang

SOUNDBITE

SPACESHIP

Spark

SpeakUp

SpicyOmelette

spwebmember

SpyDealer

SpyNote RAT

sqlmap

SQLRat

Squirrelwaffle

SslMM

Starloader

STARWHALE

STEADYPULSE

Stealth Mango

StoneDrill

StreamEx

StrifeWater

StrongPity

Stuxnet

SUGARDUMP

SUGARUSH

Sunbird

SUNBURST

SUNSPOT

SUPERNOVA

SVCReady

Sykipot

SynAck

SYNful Knock

Sys10

SYSCON

Systeminfo

SysUpdate

T9000

Taidoor

TAINTEDSCRIBE

TajMahal

Tangelo

TangleBot

Tarrask

Tasklist

TDTESS

TEARDROP

TERRACOTTA

TEXTMATE

ThiefQuest

ThreatNeedle

TianySpy

Tiktok Pro

TinyTurla

TINYTYPHON

TinyZBot

Tomiris

Tor

Torisma

TrailBlazer

Triada

TrickBot

TrickMo

Triton

Trojan-SMS.AndroidOS.Agent.ao

Trojan-SMS.AndroidOS.FakeInst.a

Trojan-SMS.AndroidOS.OpFake.a

Trojan.Karagany

Trojan.Mebromi

Truvasys

TSCookie

Turian

TURNEDUP

Twitoor

TYPEFRAME

UACMe

UBoatRAT

Umbreon

Unknown Logger

UPPERCUT

Uroburos

Ursnif

USBferry

USBStealer

Valak

VaporRage

Vasport

VBShower

VERMIN

ViceLeaker

ViperRAT

Volgmer

VPNFilter

WannaCry

WARPWIRE

WarzoneRAT

WastedLocker

Waterbear

WEBC2

WellMail

WellMess

Wevtutil

WhisperGate

Wiarp

Windows Credential Editor

WINDSHIELD

WindTail

WINERACK

Winexe

Wingbird

WinMM

Winnti for Linux

Winnti for Windows

Wiper

WIREFIRE

WireLurker

WolfRAT

Woody RAT

X-Agent for Android

XAgentOSX

Xbash

Xbot

xCaon

xCmd

XcodeGhost

XCSSET

XLoader for Android

XLoader for iOS

XTunnel

YAHOYAH

YiSpecter

yty

Zebrocy

Zen

ZergHelper

Zeroaccess

ZeroT

Zeus Panda

ZIPLINE

ZLib

Zox

zwShell

ZxShell

ZxxZ

Home

Software

Olympic Destroyer

Olympic Destroyer

Olympic Destroyer is malware that was used by Sandworm Team against the 2018 Winter Olympics, held in Pyeongchang, South Korea. The main purpose of the malware was to render infected computer systems inoperable. The malware leverages various native Windows utilities and API calls to carry out its destructive tasks. Olympic Destroyer has worm-like features to spread itself across a computer network in order to maximize its destructive impact.[1][2]

ID: S0365

ⓘ

Type: MALWARE

ⓘ

Platforms: Windows

Version: 2.0

Created: 25 March 2019

Last Modified: 23 April 2021

Version Permalink

Live Version

ATT&CK® Navigator Layers

Enterprise Layer

download

view

Techniques Used

Domain

ID

Name

Use

Enterprise

T1555

.003

Credentials from Password Stores: Credentials from Web Browsers

Olympic Destroyer contains a module that tries to obtain stored credentials from web browsers.[1]

Enterprise

T1485

Data Destruction

Olympic Destroyer overwrites files locally and on remote shares.[1][2]

Enterprise

T1070

.001

Indicator Removal: Clear Windows Event Logs

Olympic Destroyer will attempt to clear the System and Security event logs using wevtutil.[1]

Enterprise

T1490

Inhibit System Recovery

Olympic Destroyer uses the native Windows utilities vssadmin, wbadmin, and bcdedit to delete and disable operating system recovery features such as the Windows backup catalog and Windows Automatic Repair.[1]

Enterprise

T1570

Lateral Tool Transfer

Olympic Destroyer attempts to copy itself to remote machines on the network.[1]

Enterprise

T1135

Network Share Discovery

Olympic Destroyer will attempt to enumerate mapped network shares to later attempt to wipe all files on those shares.[1]

Enterprise

T1003

.001

OS Credential Dumping: LSASS Memory

Olympic Destroyer contains a module that tries to obtain credentials from LSASS, similar to Mimikatz. These credentials are used with PsExec and Windows Management Instrumentation to help the malware propagate itself across a network.[1]

Enterprise

T1021

.002

Remote Services: SMB/Windows Admin Shares

Olympic Destroyer uses PsExec to interact with the ADMIN$ network share to execute commands on remote systems.[1][3]

Enterprise

T1018

Remote System Discovery

Olympic Destroyer uses Windows Management Instrumentation to enumerate all systems in the network.[1]

Enterprise

T1489

Service Stop

Olympic Destroyer uses the API call ChangeServiceConfigW to disable all services on the affected system.[1]

Enterprise

T1016

System Network Configuration Discovery

Olympic Destroyer uses API calls to enumerate the infected system's ARP table.[1]

Enterprise

T1569

.002

System Services: Service Execution

Olympic Destroyer utilizes PsExec to help propagate itself across a network.[1]

Enterprise

T1529

System Shutdown/Reboot

Olympic Destroyer will shut down the compromised system after it is done modifying system configuration settings.[1][2]

Enterprise

T1047

Windows Management Instrumentation

Olympic Destroyer uses WMI to help propagate itself across a network.[1]

Groups That Use This Software

ID

Name

References

G0034

Sandworm Team

[4][5][2][6][7]

References

Mercer, W. and Rascagneres, P. (2018, February 12). Olympic Destroyer Takes Aim At Winter Olympics. Retrieved March 14, 2019.

Scott W. Brady. (2020, October 15). United States vs. Yuriy Sergeyevich Andrienko et al.. Retrieved November 25, 2020.

Russinovich, M. (2004, June 28). PsExec. Retrieved December 17, 2015.

CrowdStrike. (2019, January). 2019 Global Threat Report. Retrieved June 10, 2020.

Secureworks. (2020, May 1). IRON VIKING Threat Profile. Retrieved June 10, 2020.

UK NCSC. (2020, October 19). UK exposes series of Russian cyber attacks against Olympic and Paralympic Games . Retrieved November 30, 2020.

Haquebord, F. et al. (2022, March 17). Cyclops Blink Sets Sights on Asus Routers. Retrieved March 17, 2022.

×

load more results

Contact Us

Terms of Use

Privacy Policy

Website Changelog

© 2015 - 2024, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.