On November 24, 2014, employees at Sony Pictures Entertainment arrived at work to find their computers displaying an image of a red skeleton and a message from a group calling themselves "Guardians of Peace" (GOP). The message read: "We've already warned you, and this is just the beginning." Hard drives were being wiped. Over the following weeks, the GOP published 100 terabytes of data stolen from Sony's networks: unreleased films, executive salary information, thousands of employee Social Security numbers, internal emails discussing stars and colleagues with unusual candor, and business deals. Sony's network infrastructure was described as effectively destroyed.
The FBI attributed the attack to North Korea's Lazarus Group within weeks - an attribution that was publicly controversial at the time and subsequently corroborated by the NSA's internal analysis, disclosed in later reporting. North Korea's motive was a Seth Rogen comedy, "The Interview," which depicted the assassination of Kim Jong-un. The attack combined destructive malware, comprehensive data theft, and influence operations through media publication of stolen internal communications. It was the first major nation-state destructive cyberattack against a private US company and the most damaging publicly disclosed cyberattack against a US entity at that point.
The Malware: Destover and WhiskeyAlfa
The attack used several malware components. The primary destructive tool was a wiper malware named Destover (Trojan.Destover) - a Windows disk wiper that overwrote the Master Boot Record and data sectors with a specific byte pattern (0xDF) and then forced a system restart, leaving machines unbootable. Destover was compiled for the specific Sony environment, referencing Sony internal directory paths and using credentials that had been harvested from Sony's network during an earlier intrusion phase.
A separate backdoor component (WhiskeyAlfa, also called "Backdoor.Destover") had been present on Sony's network for months before the destructive phase. The Lazarus Group's methodology - documented across multiple campaigns - involves a long reconnaissance phase during which data is exfiltrated before any destructive activity. The 100TB of data published was gathered over this earlier period; the November 24 destructive phase was a final message after the valuable data had already been stolen.
The malware's compilation metadata and code similarities to earlier North Korean malware - including malware used in Operation Troy (attacks against South Korean banks and media in 2013) - were part of the FBI's attribution evidence. Code reuse across operations is a consistent Lazarus Group characteristic and a attribution indicator, though it is also potentially a deliberate false flag technique.
Initial Access and the Spear Phishing Question
Sony's network was accessed through a combination of spear phishing targeting Sony employees and exploitation of publicly exposed applications. The Lazarus Group's standard approach to initial access involves targeted phishing campaigns - messages crafted to appear relevant to specific employees - followed by credential harvesting and lateral movement. Sony's security posture at the time was widely characterized as poor: employees reused passwords across systems, the network was inadequately segmented, and credential harvesting from any foothold provided broad access.
The Novetta report on the Lazarus Group, published in February 2016, provided the most comprehensive technical analysis of the tools and infrastructure used. The group used shared infrastructure across multiple campaigns, and the Sony malware samples contained strings, encryption keys, and code patterns that appeared in earlier and later North Korean operations. The infrastructure included compromised third-party servers in multiple countries, rented VPS infrastructure, and a pattern of traffic routing designed to obscure the ultimate origin.
The "Interview" Context and North Korea's Motive
"The Interview," a Seth Rogen/James Franco comedy in which the protagonists are recruited by the CIA to assassinate Kim Jong-un, had attracted North Korean government protests before its scheduled December 25, 2014 release. North Korea had formally complained to the UN about the film and issued statements calling it an "act of war." Sony executives' internal emails, published by the GOP, showed that the company had considered modifying the film in response to concerns - discussions that became politically embarrassing when published.
The Guardians of Peace demanded that Sony not release the film. After the attack, various major theater chains announced they would not screen it, citing security concerns. Sony initially announced it would not release the film at all. This decision - a private company making exhibition decisions under state coercion - prompted a sharp response from President Obama, who called it a mistake at a year-end press conference. Sony subsequently released the film simultaneously online and in independent theaters on December 25.
"The Interview" earned approximately $40 million on demand and in limited release - making it one of Sony's most successful digital releases. The operational impact of the attack had been severe; the attempt to suppress the film's release failed.
The FBI Attribution Controversy
The FBI's December 2014 attribution of the Sony attack to North Korea was met with immediate skepticism from parts of the security research community. Researchers including Bruce Schneier and Marc Rogers argued publicly that the evidence was insufficient - that code similarities could indicate false flag operations, that the infrastructure used could have been rented or compromised by any actor, and that attribution in cyberspace requires more than technical indicators.
The skepticism was not unreasonable as a methodological matter, but subsequent disclosures substantially strengthened the attribution. The NSA's internal assessments, reported by Der Spiegel and later The Intercept, described access to North Korean cyber operations that provided confidence in the attribution. The 2018 indictment of North Korean operative Park Jin Hyok for the Sony attack (as well as WannaCry and the Bangladesh Bank heist) added named individuals and specific operational details. OFAC sanctions against Lazarus Group-associated entities further formalized US government attribution.
The Sony attribution debate was productive: it produced more careful public discussion of evidence standards for government attribution of cyberattacks and highlighted the gap between intelligence-derived confidence and publicly demonstrable evidence. That gap remains structurally important: the most compelling attribution evidence often cannot be disclosed without revealing sources and methods, leaving public claims vulnerable to plausible alternative interpretation.
Legacy: Corporate Destructive Attack Precedent
The Sony hack established that nation-states would use destructive cyberattacks against private companies as an instrument of political pressure. Prior nation-state cyberattacks against non-governmental entities (Stuxnet, Aurora) had been espionage or sabotage operations, not punishment operations. The Sony attack was explicitly punitive - the destruction was the message, not the means to an objective.
NotPetya in 2017 was the next step in this escalation: destructive malware deployed at scale against Ukrainian targets, spreading globally as collateral damage. Both Sandworm's Ukraine grid attacks and NotPetya showed that the Sony template - destructive attack on civilian/commercial infrastructure as geopolitical messaging - was now a standard tool in state arsenals. The 2022 Russia-Ukraine conflict has included multiple Ukrainian private sector and critical infrastructure attacks with identical patterns.