Loading story…
Sony has been tied to two major security controversies reflected in the referenced reporting: an earlier backlash over rootkit-like DRM software on music CDs, and the later Sony Pictures breach that escalated into a national security issue. Archived reporting on the 2014 incident describes a significant compromise of Sony Pictures, while U.S. government reporting indicated the White House viewed the attack as a national security threat rather than a routine corporate intrusion.
Follow-on industry analysis and Novetta’s Operation Blockbuster reporting said the Sony Pictures attack exposed a deeper, coordinated malware operation and helped drive broader attribution and threat-tracking efforts. Together, the references show Sony as the focus of both a high-profile software security scandal and a destructive enterprise breach, with the latter prompting extensive private-sector investigation into the malware and attacker tradecraft behind the intrusion.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
Novetta published a piece explaining why Operation Blockbuster matters, reflecting a later coordinated industry effort tied to analysis of the Sony Pictures attack. The supplied reference does not include the article body, so only the existence of this public milestone can be established.
Novetta published research describing the depth of the Sony Pictures attack, indicating additional public technical analysis of the incident. The reference suggests a deeper examination of the attack's scope or methods, though no further specifics are provided here.
An archived WWLP article reported that the White House was treating the Sony hack as a national security threat. This marks an escalation of the incident from a corporate breach to a matter of U.S. national security concern.
A Risk Based Security article published in early December 2014 analyzed the Sony hack, indicating that the cyberattack against Sony had become a significant security incident by that time. The supplied reference does not provide further technical or impact details.
Mark Russinovich published a TechNet blog post arguing that Sony's digital rights management software behaved like a rootkit and went too far from a security and system integrity perspective. This reference indicates an early Sony-related cybersecurity controversy centered on DRM software.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
5 references tracked. Mallory keeps watching after this page renders.
web.archive.org
Open sourceweb.archive.org
Open sourceweb.archive.org
Open sourceweb.archive.org
Open sourceweb.archive.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sony Pictures Entertainment suffered a destructive cyberattack that leaked internal emails and documents, disrupted operations, and intensified after the studio's planned release of *The Interview*, a film depicting the assassination of North Korean leader Kim Jong Un. A group calling itself **Guardians of Peace** claimed responsibility, and US officials publicly attributed the intrusion to North Korea, with FBI Director James Comey later saying the attackers exposed themselves by sending messages through internet infrastructure used exclusively by North Korea. ABC also reported that investigators believed parts of the operation were routed through compromised computers overseas, underscoring the attackers' efforts to obscure their origin. The attribution quickly became contested as private-sector researchers and cyber intelligence firm Norse briefed the FBI on an alternate theory pointing to disgruntled former Sony employees and piracy-linked hackers rather than Pyongyang, while the FBI said it had no credible evidence contradicting its conclusion. The fallout expanded beyond the initial breach when WikiLeaks published more than **170,000 emails** and **30,000 documents** taken in the attack, prompting Sony to denounce the release as trafficking in stolen, private, and privileged material. Separate reporting on the celebrity photo theft involving Jennifer Lawrence and others showed the FBI simultaneously confronting another high-profile case of hacked private content being widely redistributed online, highlighting the broader climate of major entertainment-sector cyber intrusions and privacy violations.
Jun 29, 2026
Sony Pictures Entertainment suffered a destructive cyberattack that shut down internal systems, exposed large volumes of confidential data, and led to the online leak of unreleased films, executive emails, contracts, salary information, and employee medical and personal records. The attackers, calling themselves **Guardians of Peace**, reportedly stole roughly 11TB of data and used the breach to pressure Sony over *The Interview*, a comedy depicting a plot to kill Kim Jong Un. The fallout triggered lawsuits from former employees, public embarrassment for senior executives after private emails were published, and major operational disruption as staff reverted to phones, fax machines, and handwritten notes while the company worked with the FBI and other authorities. The intrusion escalated from data theft to coercion when the hackers threatened cinemas with a "9/11"-style attack if *The Interview* was shown, prompting major theater chains to drop the film and Sony to cancel its wide Christmas release before later restoring it through independent theaters and online platforms including YouTube, Google Play, Xbox Video, and Sony's own service. U.S. officials and the FBI publicly attributed the attack to North Korea, later tying it to alleged operative **Park Jin Hyok** and broader Lazarus-linked activity, while North Korea denied responsibility and some private researchers argued insider involvement may also have played a role. The case became a landmark example of cyber-enabled extortion, censorship pressure, and destructive state-linked intrusion against a major media company.
Jun 29, 2026
US-CERT published technical details on the malware used in the destructive cyberattack against Sony Pictures, describing a multi-component toolset that targeted Microsoft Windows systems and spread laterally through SMB shares on port `445` using brute-force authentication. The malware suite included an SMB worm, a listening implant, a lightweight backdoor, a proxy tool, a destructive hard drive wiper, and a target cleaning utility. According to the alert, the tools enabled remote command execution, file transfer, firewall and UPnP manipulation, and reporting of successful compromises to command-and-control servers hosted across several countries. The destructive components were designed to overwrite files, the master boot record, and portions of physical drives, leaving systems unusable or severely degraded until reboot in some Windows 7 environments. The disclosure came shortly after U.S. officials publicly attributed the Sony intrusion to North Korea, and followed earlier FBI warnings about the malware, which some vendors tracked as **Destover**. US-CERT also released malware hashes, filenames, C2 IP addresses, Snort signatures, and YARA rules, while urging organizations to strengthen backups, network segmentation, least-privilege controls, patching, and monitoring to reduce the risk of similar attacks and intellectual property loss.
Jun 29, 2026