Key Judgements​​ 

• Olympic Destroyer should be treated with a high level of concern, due to the destructive nature of the malware and its potent mechanisms to spread laterally.​​ 
• Commentary and analysis surrounding malware code similarities of Olympic Destroyer have yielded many leads but no conclusive attribution.​​ 
• The co-occurrence of disparate code overlaps in the malware may be indicative of a false flag operation, attempting to dilute evidence and confuse researchers.​​ 

Executive Summary​​ 

A major telecommunications and IT provider was targeted by an unknown threat actor as part of an operation directed at disrupting the Olympic Games in PyeongChang. Recorded Future identified hardcoded credentials for the IT provider embedded in the Olympic Destroyer malware used in this campaign. Small amounts of code overlap connect the malware to numerous, disparate threat groups, which ultimately does not help to identify the threat actor responsible for developing the Olympic Destroyer malware.​​ 

Background​​ 

A major telecommunications and IT provider was targeted by an unknown threat actor as part of targeting the Olympic Games in PyeongChang prior to December 2017.​​ 

El malware, comúnmente conocido como Olympic Destroyer, fue identificado inicialmente por investigadores de Talos. Los investigadores han teorizado que el Olympic Destroyer se empleó para interrumpir la ceremonia de apertura de los Juegos Olímpicos el 9 de febrero. El malware destructivo se mueve lateralmente dentro de una red a través de Psexec y WMI, para infectar a los hosts y dejar inútiles sus datos. Psexec y WMI son herramientas internas integradas de Windows; Psexec se emplea para ejecutar procesos en otros sistemas de una red compartida, y WMI se emplea para automatizar tareas en sistemas remotos. El malware también emplea Mimikatz, una herramienta para el robo de contraseñas, para extraer credenciales de una máquina comprometida, permitiéndole también mover a través de la red objetivo. Investigadores de Microsoft afirmaron que también hay evidencia del uso de EternalRomance, un exploit filtrado que recientemente fue abusado por ransomware como método de propagación, pero no pudimos verificar esta afirmación.​​ 

Threat Analysis: A Two-Pronged Campaign​​ 

Recorded Future found an extended set of malware targeting the PyeongChang Games using an additional set of Active Directory credentials. The diversity of credentials and presence of a software key suggest that an early reconnaissance phase would likely involve an initial malware infection and not just simple credential phishing.​​ 

All samples of the Olympic Destroyer malware variant targeting the IT provider were timestamped five minutes prior to the compilation of the samples identified by Talos researchers as targeting the PyeongChang 2018 network. This suggests a parallel, two-pronged attempt to target the Olympics event, aimed at both organizers and infrastructure providers.​​ 

Additional unreported malware hashes are contained in the appendix below.​​ 

Note: Upon discovery of the hardcoded credentials, Recorded Future adhered to responsible disclosure practices, notified the relevant IT provider, and provided details of the campaign. An independent forensic investigation is underway and no damage is reported at this time.​​ 

Technical Analysis: Attribution Remains Elusive​​ 

Una de las técnicas más innovadoras empleadas actualmente por equipos de investigación avanzada es la búsqueda de similitud de código a gran escala. Los investigadores de Google fueron los primeros en emplear notablemente esta técnica para agrupar campañas previamente no atribuidas , como la del actor norcoreano Scarcruft y WannaCry, vinculando finalmente a ambas con el Grupo Lazarus. Los investigadores de BAE descubrieron las primeras superposiciones en el malware empleado por BlueNoroff empleado en el atraco SWIFT de Bangladesh al señalar el uso de una función de borrado compartido, señalando una vez más a Corea del Norte. Los investigadores de Kaspersky usaron este método para vincular el troyano dirigido a CCleaner con el grupo Axiom, y así sucesivamente.​​ 

The trouble with this technique is that while code similarity can be stated with certainty, down to a percentage of bytes shared, the results are not straightforward and require expert interpretation. The Olympic Destroyer malware is a perfect example of how we can be led astray by this clustering technique when our standard for similarity is too low.​​ 

Olympic Destroyer remains unclustered and unattributed. Because this technique still requires expert interpretation, casual or incomplete analysis can yield seemingly cohesive narratives, for example, pointing in the direction of North Korea, China, or Russia. This occurs when the code is looked at with a low enough correlative threshold.​​ 

Below are some disparate observations derived from the Olympic Destroyer malware based on code similarity analysis:​​ 

China: Los investigadores de Intezer fueron los primeros en señalar fragmentos de similitud de código con diversos actores amenazantes en el clúster chino general, incluyendo APT3 (UPS), APT10 (menuPass) y APT12 (IXESHE).​​ 

Corea del Norte: Nuestra propia investigación reveló similitudes de código triviales pero consistentes entre los módulos de Olympic Destroyer y varias familias de malware empleadas por el Grupo Lazarus. Entre ellas se incluyen funciones estándar pero diferentes dentro del malware BlueNoroff Banswift, la familia LimaCharlie del malware Lazarus del reporte Novetta Blockbuster y un módulo del malware Lazarus SpaSpe diseñado para atacar a los controladores de dominio.​​ 

Before one concludes that these widely diverse threat actors have formed an axis of evil intent on disrupting the Olympics, we need to take a step back and look at our research techniques.​​ 

Code similarity historically yielded significant research findings in clustering new campaigns to known threat actors and continues to hold great promise for research and malware classification. However, it does require scrutiny and discernment when the similarity threshold is so low as to focus on a few functions, or less. As with previous attributory methods, researchers must remain vigilant to the ever-looming threat of adversary adaptability.​​ 

El grupo terrorista Flame, patrocinado por el Estado israelí, aprovechó un ataque criptográfico previamente teórico para propagar lateralmente. El grupo de ciberdelincuentes Turla desorientó a los equipos de respuesta a incidentes al instalar malware no relacionado en las máquinas de sus víctimas, y los Lambert insertaron código limpio aleatorio para usarlo como claves de cifrado con el fin de evitar una agrupación precisa. Nuestros adversarios son ingeniosos. Si bien engañar a la agrupación por similitud de código requiere un esfuerzo y una habilidad considerables, debemos considerar que es posible para atacantes decididos de alto nivel con las motivaciones adecuadas.​​ 

Outlook​​ 

The operation to disrupt the PyeongChang Winter Olympic Games was more extensive than originally reported, with both organizers and infrastructure targeted simultaneously. The wealth of spreading mechanisms embedded within the malware suggests an aggressive effort to spread within these networks and cause maximum damage. The co-occurrence of code overlap in the malware may be indicative of a false flag operation, attempting to dilute evidence and confuse researchers. For the time being, attribution remains inconclusive.​​