'Olympic Destroyer' attack on PyeongChang Winter Olympics
9 Feb 2018 · South Korea · Official attribution
On 9 February 2018, the Olympic Destroyer malware attacked IT systems of the PyeongChang Winter Olympics during the opening ceremony. A US indictment charges officers of GRU Unit 74455 (Sandworm) with the attack. The same indictment covers hack-and-leak operations against the 2017 French election and attacks in Georgia.
Established by. US federal grand jury indictment of six GRU Unit 74455 officers (returned 15 Oct 2020, announced 19 Oct 2020). The UK NCSC issued a parallel attribution the same day.
Latest. The indictment is outstanding, and no defendants are in custody.
Link to the war against Ukraine. The same GRU unit is charged with attacks on Ukraine's power grid and with NotPetya.
Open in the interactive hub → ↑ Beyond Ukraine
Use this record. Quote the figures with the source and date named on this page; in statements, briefings and reporting cite the original body, not this site. The data are open (CC BY 4.0).
Open data (CC BY 4.0) Subscribe to updates Report an error Method & corrections
Sections: Case files · Historical dossiers · Fact-checks · UN on the record · Beyond Ukraine · The world's response · Negotiations track · Sanctions · Research & analysis · Research desk
Languages: English · Français · Español · Русский · العربية · 中文
Page generated 2026-10-23 · CC BY 4.0