A behind-the-scenes account of a cyberattack that disrupted the opening ceremony of the 2018 Winter Olympics, which was tied to a specific unit of Russia's GRU
How digital detectives unraveled the mystery of Olympic Destroyer—and why the next big attack will be even harder to crack. Tweets: @matonis , @securitybeard , @a_greenberg , @a_greenberg , @nxthompson , and @a_greenberg Tweets: Michael / @matonis : A pleasure to read about the various exploits and joyful trolls of security researchers. RICH Header research out of @kaspersky continues to be an unparalleled gem. https://twitter.com/... Warren Mercer / @securitybeard : Check the write up from @r00tbsd and I when we first discovered Olympic Destroyer https://blog.talosintelligence.com/ ... and our attribution nightmare follow up https://blog.talosintelligence.com/ ... https://twitter.com/... Andy Greenberg / @a_greenberg : Wired has published another excerpt of my book SANDWORM, out 11/5. This piece tells the blow-by-blow story of how the most deceptive malware in history nearly crippled the 2018 Olympics—and how investigators ultimately tracked down the culprits behind it. https://www.wired.com/... Andy Greenberg / @a_greenberg : This excerpt is told as an unfolding mystery, but I'm going to spoil the ending. So SPOILER ALERT: The cyberattack on the Olympics was directly tied via a command-and-control domain to the Russians who hacked two US states' boards of election in 2016: Unit 74455 of the GRU. Nicholas Thompson / @nxthompson : An amazing story that starts w one of the most confounding and brazen cyberattacks in history—and ends with @a_greenberg following breadcrumbs back to Russian hackers he's been tracking for 3 years. https://www.wired.com/... Andy Greenberg / @a_greenberg : Come for the inside story of the 12-hour race to rebuild the IT network of last year's Olympics after it was destroyed by hackers. Stay for the part where I went to Moscow to visit the building where those hackers were based. https://www.wired.com/... For your weekend reading!
Context & Ripple Effects
Eighteen months after researchers first documented how the attack knocked Pyeongchang2018.com and local internet offline during the opening ceremony (grounding drones mid-show), Andy Greenberg's account closes the attribution loop: Olympic Destroyer was the work of Unit 74455 of Russia's GRU — the same outfit already linked via a command-and-control domain to the hacks of two US state election boards in 2016.
The piece is also a portrait of how the attribution got done: Talos researchers like Warren Mercer publishing early discovery write-ups, and Kaspersky's RICH-header research supplying the forensic thread. That collaborative detective work is what let investigators see through the malware's deliberate false flags.
First-order effects
- Unit 74455 — already tracked as Sandworm — is now publicly on record for both the 2016 election-board intrusions and a sabotage operation aimed at a global sporting event, collapsing any remaining ambiguity between Russia's espionage and disruption portfolios.
- The researchers who cracked it — Talos, Kaspersky, and the wider detective community Greenberg profiles — have their methods validated as the de facto attribution playbook for state-grade attacks.
Second-order effects
- A GRU unit whose signature tricks are now catalogued in public forensic literature has to spend more on anti-attribution tradecraft, which is exactly why Greenberg's sources warn the next attack will be harder to crack.
- Public naming of units feeds directly into allied responses downstream — the model later seen when the US and partners exposed Cadet Blizzard as part of GRU Unit 29155, and when a quiet US-NATO-Ukrainian hacker partnership began blunting Russia's offensive cyber operations in Ukraine.
Third-order effects
- Attribution is becoming a repeatable industrial process — commercial researchers, intelligence agencies, and governments converging fast enough that named-unit exposure (74455, then 29155) turns into a standing diplomatic and sanctions lever against Moscow.
- If disruptive GRU operations keep getting burned by shared forensics while election-defense gaps persist, expect the unit's effort to migrate toward slower, quieter espionage — raising the bar for the next Olympic-Destroyer-style spectacle to be unraveled.
The trend: State-sponsored Russian cyber operations are being forced from high-visibility sabotage toward deniable persistence as public-private attribution shortens the distance between an attack and a named GRU unit.