According to U.S. intelligence sources who spoke to the Washington Post, Russian military spies likely hacked the computer network used to run the South Korean Winter Olympics, disrupting the ticketing and broadcast systems in retaliation for banning the Russian team for doping violations — and tried to leave digital fingerprints that would pin the blame on North Korea.

U.S. officials declined to comment to the Post, but if the report is accurate, Russia’s tactic was a savvy one. North Korea has flexed its hacking capabilities several times in recent years, in campaigns ranging from spreading the WannaCry ransomware to its suspected hack of Sony Pictures in 2014. Dmitri Alperovitch, the co-founder of cybersecurity firm CrowdStrike, told The Guardian Monday that he’s more concerned about North Korea’s cyber attack capacity than Russia’s. Still, the February 16 indictment by a U.S. federal grand jury of thirteen Russian nationals for influencing the 2016 presidential election suggest the country is more than holding its own.

The drama highlights the porous, destabilizing nature of the internet. The international community sanctions the flow of many goods to and from North Korea, but China and Russia still provide its government with reliable internet access. And though most North Koreans don’t have access to the open web, cyberspace was still a positive force in repressive nations as recently as the Arab Spring, when young activists used Facebook and Twitter to mobilize.

But political hacks and social media disinformation campaigns over the interceding years have muddied those waters. The web’s power for good or ill depends on who wields it — and in the era of sophisticated, state-sanctioned cyber warfare, even that’s often unclear.