Sony Pictures Entertainment · 2014-12
The Sony Pictures Entertainment attack involved Lazarus-linked Blockbuster malware with dropper, proxy, cleanup, credential-based lateral movement, C2 log reporting, and destructive disk/file wiping components. Evidence from Operation Blockbuster connected the SPE malware set to a wider Lazarus cluster through code reuse, shared implementation quirks, self-delete behavior, reused resources and passwords, and overlapping malware families spanning financial, media, manufacturing, Sony Pictures, and South Korean targets.
CSIS entry 1025 · November 2014
Sony Pictures Entertainment is hacked with the malware deleting data and the hackers posting online employees’ personal information and unreleased films. An FBI investigation revealed North Korea to be behind the attack.
The North Korean Threat Actor Lazarus Carried Out A Cyber Attack Against US Company Sony Pictures Entertainment And Leaked Stolen Personal Data In 2014 · 01.01.2014
The American media and entertainment studio group Sony Pictures Entertainment fell victim to a large-scale cyber attack in mid to late 2014, carried out by a group called Guardians of Peace, more commonly known as the Lazarus Group, which has been linked to North Korea. The attack, a meticulously planned intrusion, targeted Sony's network and culminated in the theft of extensive confidential data. The hackers strategically disseminated parts of the stolen information, both directly and through the media. They also demanded to stop the release of "The Interview", a satirical film depicting the assassination of North Korean leader Kim Jong Un by two American characters.
Sony Pictures became aware of the hack on 24 November 2014. However, there are indications that the perpetrators had already gained access to Sony's networks months before the attack. The FBI's subsequent investigation led them to attribute the attack to the North Korean government, although they did not officially disclose their evidence. North Korea vehemently denied any involvement.
The main target of the cyber attack was Sony Pictures Entertainment in New York, with the attackers exploiting Microsoft Windows-based systems. The malware responsible for the intrusion, after physically infiltrating Sony's networks, spread as a Windows service and exploited Microsoft Windows' administrative and network file sharing features. This allowed the hackers to connect to the Sony network and enable the theft and destruction of data.
The cyber-attack was in retaliation for Sony's refusal to comply with an earlier request to stop the release of said film. The consequences included the leaking of unreleased films and scripts, the theft of employees' personal information such as national insurance numbers and medical records, and the publication of payrolls and sensitive email correspondence. Sony was forced to suspend all online activities and shut down its network for several days.
As a result, on 19 December 2014, President Obama promised "appropriate action against the perpetrators", particularly the North Korean government. This cyber attack not only caused harm to Sony employees and their families, but also undermined the economic and social well-being of American citizens. In response, the US government may have responded with cyber attacks on critical infrastructure in North Korea, resulting in temporary internet outages in the country. If confirmed, this was the first instance of the United States responding to a cyberattack on its soil with such measures.
Sources cited by EuRepoC (33)
Show 28 more
Operation “Blockbuster”: Breach of Sony Pictures Entertainment · 2014-11
Operation “Blockbuster”: Breach of Sony Pictures Entertainment
The attack on Sony Pictures became public knowledge on November 24, 2014, when Sony employees turned on their computers to be greeted with the sight of a neon red skeleton and the words “Hacked by GOP”, which stood for “Guardians of the Peace”. The message also threatened to release data later that day if an unspecified request was not met. Over the following weeks, huge swathes of information stolen from Sony were released, including: personal information about employees and their families; email correspondence between employees at the company; information about company salaries, unreleased Sony films, and other information.
Target: Sony Pictures Entertainment (released the “Interview” movie, ridiculing the North Korean leader).
Method: Infecting with malware, stealing and wiping data of the company’s employees, correspondence, copies of unreleased films.
https://www.trendmicro.com/vinfo/us/security/news/cyber-attacks/the-hack-of-sony-pictures-what-you-need-to-know
https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf
Sony Pictures Entertainment · 2014-11-21
Threat actors compromised the networks of Sony Pictures Entertainment, destroyed data, and publicly released employee emails. The United States attributed the incident to North Korea, which is believed to have staged the attack to prevent Sony from releasing the film The Interview, which depicts an assassination plot against North Korean leader Kim Jong-un.
Compromise of Sony Pictures Entertainment · Dec 2014
t to North Korea, which is believed to have staged the attack to prevent Sony from releasing the film The Interview, which depicts an assassination plot against North Korean leader Kim Jong-un.
Sony Pictures Entertainment · 2014-12
Reported: 2014-12; Victims: Sony Pictures Entertainment; Motivations: Destruction; Sectors: Entertainment; Countries: United States
Sony Pictures breach · November 24, 2014
The Lazarus Group attacks culminated on November 24, 2014. On that day, a Reddit post appeared stating that Sony Pictures had been hacked via unknown means; the perpetrators identified themselves as the "Guardians of Peace". Large amounts of data were stolen and slowly leaked in the days following the attack. An interview with someone claiming to be part of the group stated that they had been siphoning Sony's data for over a year.
November 2014 Sony Pictures hack · November 2014
November 2014 Sony Pictures hack
MBR wiper attack against Sony Pictures Entertainment · November 24, 2014
MBR wiper attack against Sony Pictures Entertainment
Sony Pictures · November 2014
Sony Pictures. In November 2014, DPRK state-sponsored cyber actors allegedly launched a cyber attack on Sony Pictures Entertainment (SPE) in retaliation for the 2014 film “The Interview.” DPRK cyber actors hacked into SPE’s network to steal confidential data, threatened SPE executives and employees, and damaged thousands of computers. FBI’s Update on Sony Investigation (Dec. 19, 2014) https://www.fbi.gov/news/pressrel/press-releases/update-on-sony-investigation DOJ’s Criminal Complaint of a North Korean Regime-Backed Programmer (Sept. 6, 2018) https://www.justice.gov/opa/pr/north-korean-regime-backed-programmer-charged-conspiracy-conduct-multiple-cyber-attacks-and
Sony Pictures Entertainment · 2014
Lazarus Group was also directly responsible for the well-known 2014 cyber-attacks of Sony Pictures Entertainment (SPE).
Sony Pictures Entertainment destructive attack · November 2014
In November 2014, the conspirators launched a destructive attack on Sony Pictures Entertainment (SPE) in retaliation for the movie “The Interview,” a farcical comedy that depicted the assassination of the DPRK’s leader.
Sony Pictures Entertainment · November 2014
The destructive cyberattack on Sony Pictures Entertainment in November 2014 in retaliation for “The Interview,” a movie that depicted a fictional assassination of the DPRK’s leader;
Compromise of Sony Pictures Entertainment · December 2014
Targeted cyber attacks against a private company that was planning to release a comedy film about an assassination plot against the North Korean leader. The hacking group released employee information, confidential emails, and wiped the company’s data.
Cyber-attack on Sony Pictures Entertainment (SPE) over "The Interview" · November 2014
Among the successful intrusions by the subjects was the cyber-attack in November 2014 directed at Sony Pictures Entertainment ("SPE") and its comedic film "The Interview" ... Once inside SPE's network, the subjects stole movies and other confidential information, and then effectively rendered thousands of computers inoperable. [Case No. 2:18-mj-01479, U.S. District Court for the Central District of California; filing: COMPLAINT filed as to Defendant Park Jin Hyok in violation of 18:371; 18:1349. Approved by Magistrate Judge Rozella A. O]
Destructive cyber-attack on Sony Pictures · Beginning on November 24, 2014
Overt Act No. 1: Beginning on November 24, 2014, after sending threatening communications to Sony Pictures employees, the hackers initiated a destructive cyber-attack of Sony Pictures computers, publicly disseminated Sony Pictures’ confidential data and communications stolen from its computers, and made further threats against the company and its employees. [Case No. 2:20-cr-00614, U.S. District Court for the Central District of California; filing: SEALED INDICTMENT filed as to Jon Chang Hyok]
Sony Pictures Entertainment (SPE) destructive attack and data theft · late November (2014)
In late November, SPE confirmed that it was the victim of a cyber attack that destroyed systems and stole large quantities of personal and commercial data.
북한의 소니영화사 해킹 관련 외교부 대변인 논평 · 2014-12-20
제14-946호 배포일시 : 2014.12.20.(토) 12:30 문 의 : 북미국 공보․홍보담당관 김건 심의관(☎ : 2100-7383) 제목 : 북한의 소니영화사 해킹 관련 외교부 대변인 논평 1. 우리 정부는 미국 정부가 워싱턴 현지시간 12.19(금)‘소니영화사(Sony Pictures Entertainment)'에 대한 사이버 공격과 영화관 및 관람객들에 대한 용납할 수 없는 위협이 북한의 소행이라고 밝히고 이를 규탄한 것에 주목함. 2. 우리 정부는 지난 2013.3월 우리 금융기관 등에 대한 사이버 공격과 금번 ‘소니영화사’에 대한 사이버 공격이 유사한 수법으로 밝혀진 점에 유의하면서, 북한의 이러한 행위가 사이버 공간의 개방성과 안전(openness and security)을 심각하게 훼손하는 동시에 개인 및 기업의 이익을 침해하는 범죄라는 점에서 깊은 우려를 표명하고 이를 규탄함. 3. 우리 정부는 이러한 사이버 공격과 위협이 결코 용납되어서는 안된다는 점에서, 미국측과 금번‘소니영화사’사이버 공격과 관련된 정보를 공유하고 유사한 사이버 공격 및 위협에 대한 억제와 대응태세를 강화해 나가는 등 사이버 공간의 안전을 확보하기 위한 국제적 협력을 지속할 것임. 끝. 외 교 부 대 변 인
「ソニー攻撃のIPアドレスは北朝鮮のもの」、FBI長官が断言 · 2015-01-08
attribution sentence(s): 攻撃側がプロキシサーバを使い忘れてうっかり明かしたIPアドレスは、北朝鮮の関係者のみが使うものだったという。 | ソニー・ピクチャーズエンタテインメント（SPE）に対するサイバー攻撃に北朝鮮が関与したとされる問題で、米連邦捜査局（FBI）のジェームズ・コメイ長官が米ニューヨークで開かれたセキュリティカンファレンスで1月7日に講演し、攻撃に使われたIPアドレスは北朝鮮の関係者のみが使うものだったという新事実を明らかにした。メディア各社が伝えた。 | この事件で米政府は北朝鮮がSPE攻撃に関与したと断定し、北朝鮮に対する制裁を発表した。しかし直接的な関与を裏付ける根拠は明らかにしておらず、一部の専門家などは、SPEの内部関係者が関与した可能性もあるとの見方を示していた。
Sony Pictures Entertainment · November 2014
Annex 34 (excerpt from US Office of the Secretary of Defense report “Military and Security Developments involving the DPRK 2017”): “In November 2014, North Korean cyber actors using the nom de guerre “Guardians of Peace” attacked Sony Pictures Entertainment, shutting down employee access and deleting data.” Footnote 106 also refers to “the Sony Pictures Entertainment attack”.
Sony Pictures Entertainment · November 2014
(MSMT/2025/2, report p. 15, 17) “Temp.Hermit is known for recent supply chain compromises and major cyber incidents such as the 2014 hack against Sony Pictures Entertainment, the 2016 theft of $81 million from the Central Bank of Bangladesh, and the WannaCry ransomware outbreak of 2017.” p. 17: “Sony Pictures Entertainment was the target of a major cyberattack in November 2014 by North Korean hackers affiliated with Chosun Expo Joint Venture that used spear phishing tactics to infiltrate the company’s network and steal confidential data that was later published online by the hackers.”
Sony Pictures destructive attack: FBI attribution to North Korea (CrowdStrike commentary) · December 19, 2014
Unprecedented Announcement by FBI Implicates North Korea in Destructive Attacks December 19, 2014 ... For the first time they are directly linking a cyber attack to an action from a foreign government - specifically North Korea.
Sony/Destover: mystery North Korean actor’s destructive and past network activity · 2014-12-04T19:53:37
This week, for the first time ever, the FBI issued a media FLASH to warn businesses about the destructive wiper activity that was used in the attack on Sony Pictures Entertainment.
dollar figures: $15 million "in investigation and remediation costs" for the quarter to Dec. 31
While Sony said in an earnings report that the hack would cost $15 million "in investigation and remediation costs" for the quarter to Dec. 31, senior general manager Kazuhiko Takeda said Wednesday that the figure would be $35 million for the full fiscal year through March 31.
dollar figures: $35 million for the full fiscal year through March 31
senior general manager Kazuhiko Takeda said Wednesday that the figure would be $35 million for the full fiscal year through March 31.
