Threat intelligence / Malware

Olympic Destroyer

[Olympic Destroyer](https://attack.mitre.org/software/S0365) is malware that was used by [Sandworm Team](https://attack.mitre.org/groups/G0034) against the 2018 Winter Olympics, held in Pyeongchang, South Korea. The main purpose of the malware was to render infected computer systems inoperable. The malware leverages various native Windows utilities and API calls to carry out its destructive tasks. [Olympic Destroyer](https://attack.mitre.org/software/S0365) has worm-like features to spread itself across a computer network in order to maximize its destructive impact.(Citation: Talos Olympic Destroyer 2018)(Citation: US District Court Indictment GRU Unit 74455 October 2020)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Olympic Destroyer](https://attack.mitre.org/software/S0365) is malware that was used by [Sandworm Team](https://attack.mitre.org/groups/G0034) against the 2018 Winter Olympics, held in Pyeongchang, South Korea. The main purpose of the malware was to render infected computer systems inoperable. The malware leverages various native Windows utilities and API calls to carry out its destructive tasks. [Olympic Destroyer](https://attack.mitre.org/software/S0365) has worm-like features to spread itself across a computer network in order to maximize its destructive impact.(Citation: Talos Olympic Destroyer 2018)(Citation: US District Court Indictment GRU Unit 74455 October 2020)

Labels

malware

15 recorded

Relationships

uses

to Clear Windows Event Logs

Technique

uses

to Credentials from Web Browsers

Technique

uses

to Data Destruction

Technique

uses

to Inhibit System Recovery

Technique

uses

to Lateral Tool Transfer

Technique

uses

to LSASS Memory

Technique

uses

to Network Share Discovery

Technique

uses

to Remote System Discovery

Technique

uses

to Service Execution

Technique

uses

to Service Stop

Technique

uses

to SMB/Windows Admin Shares

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Shutdown/Reboot

Technique

uses

to Windows Management Instrumentation

Technique

uses

from Sandworm Team

Group

3 external

References

mitre-attack

S0365

Talos Olympic Destroyer 2018

https://blog.talosintelligence.com/2018/02/olympic-destroyer.html

US District Court Indictment GRU Unit 74455 October 2020

https://www.justice.gov/opa/press-release/file/1328521/download