Russia’s Notorious History of Hacking the Olympic Games

As the world eagerly anticipates the upcoming Olympic Games in Paris, it’s crucial to address a persistent and increasingly sophisticated threat: cyberattacks. Russia, in particular, has a notorious history of targeting the Olympics with various forms of cyber aggression. In this article, we will look at Russia’s frankly very checkered past when it comes to hacking the games and provide tips on how to protect your organization during the 2024 Olympics.

One attack that’s gone down in hacker history concerns the 2018 Winter Olympics in Pyeongchang in South Korea, known as Olympic Destroyer.  

Three months ahead of the games starting, hundreds of members of the organizing committee and others involved in the preparation for the games got an email with the subject “List of Delegates” and an attached zip file, with a Word document inside of it. When opened, there was just garbled text but there was a helpful button at the top of the document – Enable Content. Clicking it executed a PowerShell script that downloaded and executed a malware program, which installed a backdoor, and also presumably fixed the garbled text. Amongst the recipients were mailboxes at two IT firms that supplied servers and networking for the games.  

Then, on February the 9th, 2018, the opening ceremony started, and at about the same time, the worms planted on computers inside the Olympic network woke up. Scanning the systems they had been planted on, they found browser and network credentials and used these to log on to other systems and then repeated the same process on that system, quickly spreading throughout the confined network. And once the credentials were exfiltrated, it wiped the Boot Configuration Data, specifically targeting Active Directory Domain Controllers (DCs), crashing them and making them unbootable.  

The IT staff at the Technology Operation Center for the games were fortunately prepared, and within a short amount of time they’d worked around the missing DCs, bringing up Wi-Fi access and internet connected TVs just before the opening ceremony concluded. They then spent the rest of the night fighting against the malware, severing the connection between the Olympic network and the internet and by the next morning they’d eradicated the malware from the network, allowing the games to proceed.  

Once the dust had settled, the question of who was behind the attack started being investigated. The obvious culprit was of course North Korea, and the initial forensics work on the malware found many similarities to previous malware from them, but this didn’t quite make sense. North Korea had actually reached out before the games, Kim Jong-un sent his sister as a diplomatic emissary to the games, and the two countries even combined their women’s hockey teams for the games. 

The main clues as to the true source of the malware came from the Rich Headers in the malware, which gives information about the source files present in the compilation of the program, and these matched exactly between this new malware and earlier samples of North Korean malware. A researcher at Kaspersky Labs, Igor Soumenkov, dug deeper into this match and it didn’t make sense to him, as even a minor change in any of the source files will result in a very different header, so the chance that an identical match is found should be slim. Analyzing Rich Headers isn’t normally part of forensics attribution for malware but proved crucial in this case. Further research showed that this was indeed the case, the malware authors had swapped the Rich Headers on purpose to point the finger at North Korea.  

The real culprits were discovered by noting the IP address and URL that the initial stages (remember that zipped Word document?) of the malware communicated with (C2), which turned out to be identical to the URL used in an attack on the election systems in Illinois and Arizona in the run up to the 2016 US election (200,000 voter’s data was stolen). And there it was, we knew who was behind the attacks on the US elections in 2016 and so Russia was behind this attack as well and had tried to point the finger at the North Koreans. They just forgot the golden rule of operational security – don’t reuse infrastructure between operations – it’ll eventually lead to accurate attribution.