This 'Olympic Destroyer' Malware May Have Killed Winter Games Computers

Minimalist · Feb 12, 2018

Over the weekend, officials from the Winter Olympics taking place in South Korea confirmed a cyberattack hit systems helping run the event during the opening ceremony. They didn't provide much detail, though the attack coincided with 12 hours of downtime on the official website, the collapse of Wi-Fi in the Pyeonchang Olympic stadium and the failure of televisions and internet in media rooms, according to reports.

Researchers from Cisco's Talos cybersecurity unit now believe with "moderate" confidence they've found the malware responsible. They've suitably named it Olympic Destroyer, for its main focus is taking down systems and wiping data, rather than stealing information. More specifically, it deletes files and their copies, as well as event logs, whilst using legitimate features on Windows computers to move around targeted networks.
Click to expand...

https://www.forbes.com/sites/thomas...lympics-cyberattack-and-the-destroyer-malware

WildByDesign · Feb 13, 2018

Stopping Olympic Destroyer: New Process Injection Insights

Link: https://www.endgame.com/blog/techni...mpic-destroyer-new-process-injection-insights

The International Olympic Committee confirmed that the 2018 opening ceremonies experienced a range of digital attacks, resulting in internet disruption and containing the capability to cause destruction. Talos quickly posted an excellent blogpost Monday that described a malware family they dubbed “Olympic Destroyer” as the culprit behind the attacks, and provided the first information about samples likely used in the attack.
Click to expand...

Endgame rapidly analyzed the malware and ran it in the presence of the Endgame platform to confirm the effectiveness of our protections. Our customers are strongly protected in multiple ways against Olympic Destroyer, which is detailed at the end of the post. As we dug deeply into the sample, our research strongly corroborated the technical assessment presented by Talos. However, we noted one additional behavior within the shellcode injection that warrants further examination for a holistic understanding of the attack. Expanding upon the excellent work of Talos, this post describes how and why this sample leverages “notepad.exe” for shellcode injection.
Click to expand...

Olympic Destroyer Injection into notepad.exe
During dynamic analysis, Endgame researchers observed that the initial payload was launching the native “\\system32\\notepad.exe” text editor and then allocating two memory sections. This may be because this is a non-privileged application and one with conveniently malleable memory properties. One of the memory sections contained offsets to Windows native libraries employed during execution while the other contained a copy of itself used during propagation. Figure 1 contains an image of the shellcode injected into notepad.exe.
Click to expand...

itman · Feb 14, 2018

Today, Cisco researchers said they were wrong about this initial assessment after discovering Olympic Destroyer samples with different lists of hardcoded credentials.

A closer look at the malware's behavior revealed that Olympic Destroyer takes the list of credentials found on the local computer and generates a new binary for itself, which is then dropped on other computers on the same network.

The malware adds these new credentials stolen from the current PC to its list of hardcoded credentials.

This self-mutating behavior allows Olympic Destroyer to gather more and more credentials as it spreads through a local nework, updating its binary on the fly.

"I have not seen a malware sample modify itself to include harvested creds before and I've been doing this stuff for longer than I should admit," Craig Williams, one of the Cisco Talos researchers, said today on Twitter.

"Polymorphic malware isn’t a new idea by itself, but I have never seen any examples of malware modifying itself to include harvested credentials," added Jaeson Schultz, fellow Cisco Talos researcher.

3. Olympic Destroyer spread using EternalRomance exploit

But this binary mutation behavior does not explain how Olympic Destroyer arrived on some of the infected networks. This is where the third and last of today's updates came in to shed some light, courtesy of Microsoft.

According to the Windows Defender team, Olympic Destroyer appears to have been deployed via one of the NSA exploits leaked by the Shadow Brokers last year —namely EternalRomance.
Click to expand...

https://www.bleepingcomputer.com/ne...ware-is-more-complex-than-previously-thought/

itman · Feb 14, 2018

Russian actors mentioned as possibly launching cyberattack on 2018 Winter Olympic Games

Fingering the culprit behind the cyberattack that hit the 2018 Pyeongchang Winter Olympic Games during the opening ceremony will never be nailed down with 100 percent accuracy, but industry executives have gathered some circumstantial evidence is pointing toward a Russian group.

There is other evidence pointing to Fancy Bear. It has already been credited with attacking an Olympic organization. In September 2016 the World Anti-Doping Agency (WADA) stated that the group had hacked its systems and accessed athlete data, including confidential medical related to the Rio Games; and, subsequently released some of the data in the public domain, accompanied by the threat that they will release more.
Click to expand...

https://www.scmagazine.com/russian-...-on-2018-winter-olympic-games/article/743835/

cruelsister · Feb 14, 2018

The Russians have been actively deploying targeted System Trashers for years now. At least this time it didn't cost lives like it did in Ukraine.

Minimalist · Mar 8, 2018

OlympicDestroyer is here to trick the industry

Several files related to the cyberattack were uploaded to VirusTotal on the day of the attack and were quickly picked up by other security researchers. As we were researching this attack, the Cisco Talos team published a brief description of the malware which Talos got from an undisclosed source. In their blog Talos highlighted some similarities between the attack, Netya (Expetr/NotPetya) and BadRabbit (targeted ransomware).

The Talos publication effectively removed the TLP constraint as the information had now become public and could be referenced in this way. However, we decided not to jump to conclusions, especially with regards to attribution, and spent time researching it calmly and methodologically, while we continued to discover more and more false flags and controversies in the malware.
Click to expand...

https://securelist.com/olympicdestroyer-is-here-to-trick-the-industry

Minimalist · Mar 8, 2018

The devil’s in the Rich header

In our previous blog, we detailed our findings on the attack against the Pyeongchang 2018 Winter Olympics. For this investigation, our analysts were provided with administrative access to one of the affected servers, located in a hotel based in Pyeongchang county, South Korea. In addition, we collected all available evidence from various private and public sources and worked with several companies to investigate the command and control (C&C) infrastructure associated with the attackers.

During this investigation, one thing stood out – the attackers had pretty good operational security and made almost no mistakes. Some of our colleagues from other companies pointed out similarities with Chinese APT groups and Lazarus. Yet, something about these potential connections didn’t quite add up. This made us look deeper for more clues.
Click to expand...

https://securelist.com/the-devils-in-the-rich-header

guest · Jun 19, 2018

'Olympic Destroyer' Malware Spotted in New Attacks
June 19, 2018
https://www.securityweek.com/olympic-destroyer-malware-spotted-new-attacks

Kaspersky Lab spotted new attacks involving Olympic Destroyer in May and June, and the list of targets raises even more questions about the threat actor’s goals and motives.

The latest attacks targeted financial companies in Russia and European organizations focusing on protection against chemical and biological threats, including in Germany, France, the Netherlands, Switzerland and Ukraine.
The malware was delivered using spear-phishing emails carrying malicious documents. Many of the decoy documents referenced bio-chemical threat research, and some of the text was written in perfect Russian, which suggests that a native speaker helped write it.

“It’s possible that in this case we have observed a reconnaissance stage that will be followed by a wave of destructive attacks with new motives. [...]" Kaspersky researchers warned.
Click to expand...

guest · Nov 19, 2018

Olympic Destroyer Wiper Changes Up Infection Routine
The Hades APT group continues its quest to stay under the radar
November 19, 2018
https://threatpost.com/olympic-destroyer-wiper-changes-up-infection-routine/139230/

It contains a few significant changes that indicate an evolution for the APT group behind it, according to researchers.
The macros’ complexity has increased over time, according to Check Point researchers, with new versions appearing every month or so in an effort to remain under the radar. In October however, something changed.

“The string-encoding methods, as well as other common indicators which we will list afterwards, clearly show that at the very least, most documents were created by one threat actor, with the same set of obfuscation tools that evolved on a monthly basis,” Check Point researchers pointed out in a recent posting.

In addition to the first-stage changes that they uncovered, Check Point researchers also discovered new intel about Hades’ droppers’ use of compromised servers as a second-stage command-and-control (C2).
Click to expand...

Minimalist · Oct 21, 2019

Details of the Olympic Destroyer APT

Interesting details on Olympic Destroyer, the nation-state cyberattack against the 2018 Winter Olympic Games in South Korea. Wired's Andy Greenberg presents evidence that the perpetrator was Russia, and not North Korea or China.
Click to expand...

https://www.schneier.com/blog/archives/2019/10/details_of_the_3.html

Log in or Sign up

This 'Olympic Destroyer' Malware May Have Killed Winter Games Computers

Minimalist Registered Member

WildByDesign Registered Member

itman Registered Member

itman Registered Member

cruelsister Registered Member

Minimalist Registered Member

Minimalist Registered Member

guest Guest

guest Guest

Minimalist Registered Member

Log in or Sign up

This 'Olympic Destroyer' Malware May Have Killed Winter Games Computers

Minimalist Registered Member

WildByDesign Registered Member

itman Registered Member

itman Registered Member

cruelsister Registered Member

Minimalist Registered Member

Minimalist Registered Member

guest Guest

guest Guest

Minimalist Registered Member

Useful Searches