Other
Sony Pictures Hack: Lazarus Group Wiper + Data Exfiltration
Primary Source βIncident Details
On November 24, 2014, attackers identifying themselves as ‘Guardians of Peace’ (GOP) deployed the Destover destructive wiper malware across Sony Pictures’ corporate network, wiping approximately 70% of Sony’s laptops and computers. The attack was attributed by the FBI to North Korea’s Lazarus Group (Bureau 121), believed to be motivated by Sony’s planned release of ‘The Interview’ (a comedy depicting the assassination of Kim Jong-un). Prior to the destructive wiper deployment, attackers had spent months inside Sony’s network exfiltrating massive amounts of data including: unreleased films (Fury, Annie, Still Alice, and others), executive emails (including embarrassing exchanges about Barack Obama and major actors), employee personal data for ~47,000 current and former employees (names, SSNs, salaries, medical information, performance reviews), salary information, and detailed financial data. The impact on Sony Pictures was catastrophic β complete loss of email for weeks, leaked films distributed via BitTorrent, severe reputational damage from email contents, and estimated $35 million in response costs. The attack is a landmark case demonstrating nation-state use of destructive cyber capabilities for coercive purposes short of armed conflict.
Technical Details
- Initial Attack Vector
- North Korea's Lazarus Group (Bureau 121) used spear-phishing to gain initial access to Sony Pictures' network, conducted months of reconnaissance, then deployed 'Destover' destructive malware (wiper) while simultaneously exfiltrating terabytes of data
- Malware Family
- Destover (wiper/backdoor)
Timeline
- 2014-11-24 Breach occurred
- 2014-11-24 Publicly disclosed
- 2015-01-01 Customers notified