Olympic Destroyer malware more complex than first thought

The Olympic Destroyer malware that interfered with the opening ceremony of the 2018 Winter Olympics is more complicated than originally believed.

The malware, which was first reported by U.K. newspaper The Guardian last Friday, was responsible for failing Wi-Fi and television systems for on-site journalists covering the opening ceremony in Pyeongchang, South Korea. On Sunday, officials from the Olympics confirmed the system failures weren't random or an accident, but instead were the result of a targeted cyberattack.

Following the confirmation, researchers from Cisco Talos published an analysis of the Olympic Destroyer malware and said it was capable of interfering with a Windows computer's data recovery processes and deleting critical Windows services, thus making systems unable to boot.

"The samples identified, however, are not from adversaries looking for information from the games, but instead they are aimed to disrupt the games," the researchers said. "The samples analyzed appear to perform only destructive functionality."

The Cisco Talos research was updated later in the week with newly uncovered details. The first major discovery was the malware also wipes files on network shares. Originally, the researchers believed Olympic Destroyer malware only targeted individual endpoints.

Our post has been update to include the impact on network shares - Shocker - they are effectively wiped: Olympic Destroyer Takes Aim At Winter Olympics with indications of prior compromise - https://t.co/NoD5la9m7r #OlympicDestroyer @SecurityBeard @r00tbsd @TalosSecurity

— Craig Williams (@security_craig) February 12, 2018

The next new discovery was Olympic Destroyer malware mutates on each system. The malware uses a self-patching feature to change itself after moving from one host system to another. The original research said Olympic Destroyer dropped a credential stealer for browser and system passwords on each targeted system, and then used a list of stolen credentials to move laterally through the network. The updated findings said this is wrong.

I updated our #OlympicDestroyer post. The malware has the capability to generate new binaries with the stolen credentials (by patching the PE). The list in the screenshot comes from previous executions and was not created by the devevelopers themself https://t.co/VwkNNSI06Q

— Paul Rascagnères (@r00tbsd) February 13, 2018

The final update about the Olympic Destroyer malware is it spread using the EternalRomance exploit, which is a National Security Agency (NSA) exploit leaked by the Shadow Brokers in 2017. EternalRomance was also used to spread NotPetya and Bad Rabbit ransomware last year, along with another NSA exploit known as EternalBlue.

Update: While several security vendors, including Microsoft, initially reported a link between Olympic Destroyer and EternalRomance, those reports were amended as later analysis showed no presence of the NSA exploit in the malware.

"Disruption is the clear objective in this type of attack and it leaves us confident in thinking that the actors behind this were after embarrassment of the Olympic committee during the opening ceremony," the Cisco Talos researchers wrote.

The 2018 Winter Olympics have already been the target of other cyberattacks because of the controversial decision to ban some Russian athletes from the games. The Russian hacking group known as Fancy Bears claimed responsibility for attacks on the International Olympic Committee, the U.S. Olympic Committee and other groups because of the doping scandal that caused Russian athletes to be banned for the current games.