Olympic Destroyer (Pyeongchang Games, 2018)
Wiper launched during the opening ceremony of the Pyeongchang Winter Games on February 9, 2018, laced with fake North Korean and Chinese clues, attributed to the GRU by US prosecutors in October 2020.
On February 9, 2018, during the opening ceremony of the Pyeongchang Winter Games, the organizing committee's network went down. Stadium wifi, screens, ticketing and the official website stopped working; spectators could not print their tickets. Teams restored most of it overnight. The code, named Olympic Destroyer, wiped and spread with stolen credentials. It also carried carefully planted clues: fragments recalling Lazarus, others Chinese groups. In March 2018, Kaspersky showed that the file header pointing to North Korea had been forged. On October 19, 2020, the US Justice Department charged six GRU officers from unit 74455, Sandworm's unit, for Olympic Destroyer, NotPetya and the attacks on the Ukrainian power grid. The motive alleged was revenge for Russia's ban from the Games over doping. The case taught the market two things. A false flag can point at another state, not only at a criminal group. And technical attribution can take two and a half years to become a court filing, longer than a policy term.
Constructed example: the organizer of a major sporting event buys a one-year cyber policy with LMA 5565. A wiper hits ticketing on opening day. Early clues point to state A, then to state B. No government attributes the attack during the policy period: the insurer pays, unable to establish the exclusion on objectively reasonable inference.
Olympic Destroyer, Pyeongchang Olympics attack, Pyeongchang 2018 attack
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.