Olympic DestroyerMalware
- sourgrape
Malware which seems to have no function other than to disrupt computer systems related to the 2018 Winter Olympic event.From MISP Galaxy
Last reported 2 days ago, by ESET WeLiveSecurity (ES)3 reports
ATT&CK techniques
6 of 32 · each with the sentence it comes from- T1059Command and Scripting Interpreter
“Command and Scripting Interpreter: Windows Command Shell”
- T1059.003Windows Command Shell
“T1059.003”
- T1105Ingress Tool Transfer
“T1105”
- T1485Data Destruction
“T1485”
- T1005Data from Local System
“T1005”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information: Encrypted/Encoded File”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
MythicRatatoskr: el backdoor que utilizó la red Yggdrasil antes de un ataque destructivo de Sandworm“En febrero de 2018, Sandworm lanzó el ataque de borrado de datos Olympic Destroyer contra los organizadores de los Juegos Olímpicos de Invierno de 2018 en Pyeongchang.”
-
MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration“In February 2018, Sandworm launched the Olympic Destroyer data-wiping attack against organizers of the 2018 Winter Olympics in Pyeongchang.”
-
DynoWiper update: Technical analysis and attribution“In 2018-02, Sandworm launched the Olympic Destroyer data-wiping attack against organizers of the 2018 Winter Olympics in Pyeongchang.”
Indicators in its reports
named in the reports above- hxxps://uztickets[.]comin 2 reports
- uztickets[.]comin 2 reports
- hxxps://egyptanimals[.]com/animals/photoalbumin 2 reports
- egyptanimals[.]comin 2 reports
- adomd[.]netin 2 reports
- hxxp://51.15.204[.]214/in 2 reports
- 51.15.204[.]214in 2 reports
- d5f9288daebf87ae…cf235b093cfdin 2 reports
- b69ef0e45b401440…5d0c57e87415in 2 reports
- 4e3e6577866e4ce2…ae04230e768fin 2 reports
- 69969eeb7e0a3d84…cf934c6aa388in 2 reports
- 01855153ca7a33ad…12dfba0dd2cain 2 reports
- e29af83a07fb32eb…2e766d53f704in 2 reports
- 028ca11f3f0d8396…31fc2f50f829in 2 reports
- 9085896989947c09…f6b233fc645bin 2 reports
- d7e6a5a46c6ed351…1be0250fd2a2in 2 reports
- 131a371a1e4ee78e…9290ec3b58a6in 2 reports
- 09c816697c0c2aff…8ca30d04c9cdin 2 reports
- 8ceb5f8bcdf4995b…d682613bb17bin 2 reports
- 37.205.14[.]171in 2 reports
Copy these 20 indicators · defanged
Thanks — we review every report.