Loading story…
US-CERT published technical details on the malware used in the destructive cyberattack against Sony Pictures, describing a multi-component toolset that targeted Microsoft Windows systems and spread laterally through SMB shares on port 445 using brute-force authentication. The malware suite included an SMB worm, a listening implant, a lightweight backdoor, a proxy tool, a destructive hard drive wiper, and a target cleaning utility. According to the alert, the tools enabled remote command execution, file transfer, firewall and UPnP manipulation, and reporting of successful compromises to command-and-control servers hosted across several countries.
The destructive components were designed to overwrite files, the master boot record, and portions of physical drives, leaving systems unusable or severely degraded until reboot in some Windows 7 environments. The disclosure came shortly after U.S. officials publicly attributed the Sony intrusion to North Korea, and followed earlier FBI warnings about the malware, which some vendors tracked as Destover. US-CERT also released malware hashes, filenames, C2 IP addresses, Snort signatures, and YARA rules, while urging organizations to strengthen backups, network segmentation, least-privilege controls, patching, and monitoring to reduce the risk of similar attacks and intellectual property loss.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
US-CERT released alert TA14-353A detailing the SMB worm toolset used in the Sony Pictures attack, including malware behavior, hashes, filenames, command-and-control IP addresses, Snort signatures, and YARA rules. The advisory also recommended mitigations such as backups, segmentation, least privilege, patching, and monitoring.
The FBI and President Obama publicly attributed the destructive cyberattack against Sony Pictures to North Korea. This attribution was reported as occurring shortly before US-CERT published its malware advisory.
Before the public US-CERT alert, the FBI circulated a flash memo to selected organizations warning about the malware associated with the Sony Pictures attack, which some security vendors referred to as Destover.
Cyber threat actors deployed a destructive malware toolset against Sony Pictures, including an SMB worm for lateral movement, backdoors, proxy capabilities, and disk-wiping components that overwrote files, master boot records, and parts of physical drives on Windows systems. The attack disrupted systems and risked loss of intellectual property.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sony has been tied to two major security controversies reflected in the referenced reporting: an earlier backlash over rootkit-like DRM software on music CDs, and the later **Sony Pictures** breach that escalated into a national security issue. Archived reporting on the 2014 incident describes a significant compromise of Sony Pictures, while U.S. government reporting indicated the White House viewed the attack as a national security threat rather than a routine corporate intrusion. Follow-on industry analysis and Novetta’s **Operation Blockbuster** reporting said the Sony Pictures attack exposed a deeper, coordinated malware operation and helped drive broader attribution and threat-tracking efforts. Together, the references show Sony as the focus of both a high-profile software security scandal and a destructive enterprise breach, with the latter prompting extensive private-sector investigation into the malware and attacker tradecraft behind the intrusion.
Jun 29, 2026
Research tracing the **DarkSeoul** threat cluster has linked the 2014 Sony Pictures Entertainment breach to a longer-running campaign of destructive intrusions that also hit South Korean banks and media companies. The reporting ties the activity to malware families and operational patterns seen across incidents dating back to at least 2009, including the April 2013 **DarkSeoul** attack that crippled tens of thousands of systems with disk-wiping malware. Analysts said the campaign was initially mistaken in some cases for hacktivism, but code lineage, shared tooling, and recurring tradecraft pointed to a coordinated, multi-year operation. The Sony intrusion malware **Destover** was highlighted as part of the same evolving toolkit, with researchers connecting it to broader destructive and espionage activity primarily targeting South Korean organizations across sectors. One analysis said South Korean authorities independently attributed the 2013 attacks to **North Korea**, while another noted that the operators behind the wider cluster were commonly tracked as **DarkSeoul** or **Silent Chollima**, though exact operator identity remained disputed in some reporting. The studies also outlined indicators of compromise and defensive controls that could have reduced the impact of the wiper attacks.
Aug 15, 2026
Internet-wide scans found the NSA-linked **DoublePulsar** SMB backdoor on tens of thousands of exposed Windows systems after Shadow Brokers released offensive tooling tied to the implant. Researchers reported infection estimates ranging from roughly 30,000 to more than 120,000 hosts, with infected machines responding to distinctive traffic over port `445`; Microsoft questioned the early counts, but independent investigators said the backdoor had spread rapidly and Countercept later published a method to remotely remove it. Because DoublePulsar operates in memory and leaves no files on disk, it was described as unusually stealthy even as defenders raced to identify and clean compromised systems. Subsequent reporting showed the impact of the leak extended well beyond the initial infections. Symantec said a China-linked group known as **Buckeye/APT3** had used a DoublePulsar variant and related NSA exploit code in real-world attacks as early as March 2016, indicating the capabilities were exposed or replicated long before the public dump. Other leaked SMB exploits, including **EternalChampion**, **EternalRomance**, and **EternalSynergy**, were later ported to work across Windows versions from 2000 through modern releases, while related Shadow Brokers tools such as **EternalBlue** were tied to major outbreaks including **WannaCry** and **NotPetya**, reinforcing the urgency of applying Microsoft’s `MS17-010` patches.
Jun 29, 2026