The threat actors appear to be in a reconnaissance phase, which could be a prelude to a larger cyber-sabotage attack meant to destroy and paralyze infrastructure.

The actors behind this kind of code, whether they’re bent on sending a political message or simply wanting to cover their tracks after data exfiltration, have adopted various techniques to carry out those activities.

Researchers say the case of Olympic Destroyer malware show how threat actors can manipulate “geopolitical agenda” with false flags.

Researchers now believe attackers may have had prior access to networks and that malware was more sophisticated than originally believed.

The malware’s sole purpose was to take down systems, not steal data, Cisco Talos researchers say.