The Game of Attribution

This report examines the Olympic Destroyer campaign that disrupted the 2018 Pyeongchang Winter Olympics, describing the malware’s TTPs (use of the EternalRomance exploit, deletion of shadow copies and event logs, and lateral movement via PsExec and WMI), the investigative work by Cisco Talos and Michael Matonis, the deliberate false-flag techniques used to confuse attribution, and the later UK NCSC/NSA attribution to Russian GRU Unit 74455 (Sandworm).