DPRK Cyber IndexYearsActorsSourcesAttacks on North KoreaMethodologyContributeSearch

Spear-phishing of AMC Theatres employees

Date (as written)
On December 2 and 3, 2014
Year
2014
Country
U.S.
Actors (as written)
JON CHANG HYOK, KIM IL, PARK JIN HYOK and other hackers/conspirators (RGB)
Actor pages
JON CHANG HYOKKIM ILPARK JIN HYOKhackersconspirators
Tags (as written)
spear-phishing; indictment overt act

Source entries (9)

CSIS Significant Cyber Incidents

CSIS entry 1026 · November 2014
North Korean hackers attacked a British production company planning to release a television series revolving around the imprisonment of a British nuclear scientist in the DPRK. The attack caused the cancellation of the series.
https://csis-website-prod.s3.amazonaws.com/s3fs-public/2026-07/260706_Significant_Cyber_Events.pdf?VersionId=1Li2342elpx5OV3lnGEYyXXB_LRbGnPm

CISSM Cyber Events Database (copy exported 21 Apr 2023, via github.com/holisticinfosec/CISSM-EDA)

Mammoth Screen · 2018-09-06
A threat actor targeted Mammoth Screen, a UK production company that produced Opposite Number, a television drama set in North Korea.
https://www.bbc.com/news/technology-41640976

CFR Cyber Operations Tracker

Targeting of AMC Theatres · Sep 2018
A threat actor targeted U.S. movie theater chain AMC Theatres in 2014 using spear-phishing techniques. The U.S. Department of Justice
https://www.cfr.org/cyber-operations/targeting-of-amc-theatres
https://www.justice.gov/opa/pr/north-korean-regime-backed-programmer-charged-conspiracy-conduct-multiple-cyber-attacks-and

CFR Cyber Operations Tracker

Targeting of Mammoth Screen · Sep 2018
A threat actor targeted Mammoth Screen, a UK production company that produced
https://www.cfr.org/cyber-operations/targeting-of-mammoth-screen
https://www.justice.gov/opa/pr/north-korean-regime-backed-programmer-charged-conspiracy-conduct-multiple-cyber-attacks-and

US Department of Justice press releases

Spear-phishing of movie theater chain and U.K. production company · Around November 2014
Around the same time, the group sent spear-phishing messages to other victims in the entertainment industry, including a movie theater chain and a U.K. company that was producing a fictional series involving a British nuclear scientist taken prisoner in DPRK.
https://www.justice.gov/archives/opa/pr/north-korean-regime-backed-programmer-charged-conspiracy-conduct-multiple-cyber-attacks-and

US Department of Justice press releases

AMC Theatres targeting · December 2014
the December 2014 targeting of AMC Theatres, which was scheduled to show the film;
https://www.justice.gov/archives/opa/pr/three-north-korean-military-hackers-indicted-wide-ranging-scheme-commit-cyberattacks-and

US Department of Justice press releases

Mammoth Screen intrusion · 2015
and a 2015 intrusion into Mammoth Screen, which was producing a fictional series involving a British nuclear scientist taken prisoner in DPRK.
https://www.justice.gov/archives/opa/pr/three-north-korean-military-hackers-indicted-wide-ranging-scheme-commit-cyberattacks-and

US court filing via CourtListener RECAP: United States v. Hyok

Spear-phishing of AMC Theatres employees · December 3, 2014
I was first informed by AMC Theatres that this email account had sent an AMC Theatres employee a spear-phishing email on December 3, 2014. I later learned that [JG NAME REDACTED]@gmail.com sent spear-phishing messages to a total of five AMC Theatres employees on that same date. [Case No. 2:18-mj-01479, U.S. District Court for the Central District of California; filing: COMPLAINT filed as to Defendant Park Jin Hyok in violation of 18:371; 18:1349. Approved by Magistrate Judge Rozella A. O]
https://storage.courtlistener.com/recap/gov.uscourts.cacd.713818/gov.uscourts.cacd.713818.1.0.pdf

US court filing via CourtListener RECAP: United States v. Hyok

Spear-phishing of AMC Theatres employees · On December 2 and 3, 2014
Overt Act No. 2: On December 2 and 3, 2014, the hackers sent spear-phishing messages to AMC Theatres employees from multiple email accounts. [Case No. 2:20-cr-00614, U.S. District Court for the Central District of California; filing: SEALED INDICTMENT filed as to Jon Chang Hyok]
https://storage.courtlistener.com/recap/gov.uscourts.cacd.804762/gov.uscourts.cacd.804762.8.0_1.pdf

Values found later for empty fields

country: British
North Korean hackers attacked a British production company planning to release a television series revolving around the imprisonment of a British nuclear scientist in the DPRK. The attack caused the cancellation of the series.
https://csis-website-prod.s3.amazonaws.com/s3fs-public/2026-07/260706_Significant_Cyber_Events.pdf?VersionId=1Li2342elpx5OV3lnGEYyXXB_LRbGnPm

Suggest a correction on GitHub