> series: anatomy_of_a_breach —— part: 110 —— target: pyeongchang_winter_olympics —— attacker: russian_gru —— disguise: false_flags<span class="cursor-blink">_</span>_
During the opening ceremony of the 2018 Pyeongchang Winter Olympics on 9 February, the Games' IT infrastructure suffered a coordinated cyber attack. The official Olympics website went down — preventing spectators from printing tickets. The Wi-Fi network in the PyeongChang Olympic Stadium failed. Internet-connected televisions in the main press centre stopped working. The Olympic Destroyer malware had spread through the Games' network, destroying data on Windows systems by overwriting boot records and deleting backup catalogues.
Initial analysis of the malware revealed code similarities with North Korean and Chinese threat actors — but Kaspersky researchers discovered that these similarities were deliberately planted false flags. The malware's metadata, code reuse patterns, and compilation artefacts had been carefully crafted to mislead attribution. The attack was ultimately attributed to Russia's GRU (specifically the Sandworm team), with the false flag operation interpreted as retaliation for the IOC's ban of Russia from the Games over its state-sponsored doping programme.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping CallOlympic Destroyer established two critical principles: first, international events are legitimate targets for nation-state cyber operations motivated by political grievances. Second, cyber attribution is not straightforward — sophisticated adversaries deliberately plant false evidence to mislead investigators and create diplomatic ambiguity. For UK organisations, this means that threat intelligence must be multi-sourced and analytically rigorous, and that event-related infrastructure requires proportionate security.
Infrastructure testing assesses event IT security and recovery procedures. Cyber Essentials establishes baseline controls. SOC in a Box provides 24/7 monitoring during events and high-threat periods. And UK Cyber Defence's threat intelligence provides the attribution analysis that cuts through false flags.
<a href="/penetration-testing/infrastructure">Infrastructure testing</a> assesses event security. <a href="https://www.socinabox.co.uk">SOC in a Box</a> monitors during high-threat periods. <a href="https://www.cyber-defence.io/services/threat-intelligence">UK Cyber Defence</a> provides threat intelligence.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping Call