On November 24, 2014, employees at Sony Pictures Entertainment arrived at work to find their computers displaying an image of a leering skeleton over the header "Hacked By #GOP" - Guardians of Peace. A message warned that Sony's secrets would be released to the world unless demands were met. Within hours, it became clear this was not a conventional data breach: the attackers had deployed a wiper that destroyed Sony's corporate infrastructure, simultaneously stealing an enormous quantity of sensitive data and rendering thousands of machines inoperable.

The attack, attributed to North Korea's Lazarus Group by the FBI and US intelligence community, was unprecedented in the United States: it was the first major destructive cyberattack against a private US company - not espionage, not data theft for financial gain, but deliberate destruction combined with coercion. The target was Sony's upcoming film "The Interview," a comedy about a CIA plot to assassinate North Korean leader Kim Jong-un. The attack was North Korea's response to a Hollywood movie.

The Attack and the Wiper

The Guardians of Peace malware (formally analyzed by US-CERT as "Destover") combined multiple capabilities. The wiper component overwrote the master boot record and master file table of infected systems, rendering them unbootable. It also overwrote the contents of files before deletion, preventing forensic recovery. The destructions was systematic - the malware spread across Sony's network using harvested credentials and network shares, executing on thousands of machines in a coordinated wave.

The simultaneous data exfiltration had been running for weeks before the wiper deployed. Sony's network had been compromised since at least early November; attackers spent that time staging data on servers within Sony's network before exfiltrating it. What was eventually leaked included: unreleased Sony films (Annie, Still Alice, and others), executives' salary information and personal emails, employees' Social Security numbers and medical records, scripts for future productions, and candid executive emails that were embarrassing when published.

The email leaks became the most culturally resonant element. Co-chair Amy Pascal's emails contained racially insensitive jokes and candid assessments of Hollywood figures. CEO Michael Lynton's correspondence was made public. Employees' private health information - HIV status, mental health records, pregnancy, salary data - were published. Sony employees faced extortion from individuals who had obtained their personal information from the leaked data. Pascal resigned in February 2015.

[TECHNICAL NOTE]
The Destover malware family used by GOP/Lazarus Group in the Sony attack: Destover was a multi-component package including a wiper (MBR overwrite plus file destruction), a listening implant for persistent access, a credential harvester, and a spreader component that used harvested credentials to propagate across the network. The wiper component generated fake files named with random strings (AAA, BBB, etc.) to pad disk usage during the overwrite process. Technical similarities to prior Lazarus Group operations - specifically the DarkSeoul attacks against South Korean banks and broadcasters in 2013 - were identified by multiple security firms including Kaspersky, Mandiant, and AlienVault. Common code patterns, string obfuscation techniques, and specific cryptographic implementations linked Destover to the DarkSeoul malware family. The C2 infrastructure used IP addresses in Thailand, Italy, Poland, Bolivia, Singapore, and Cyprus - consistent with Lazarus Group's pattern of using compromised intermediary systems in multiple countries for C2.

The Extortion Campaign and "The Interview"

The GOP's demands evolved over the weeks following the initial attack. Initially vague, the demands eventually focused specifically on Sony withdrawing "The Interview" from release. Messages threatened 9/11-style attacks on movie theaters that showed the film. Theater chains, frightened by the threats, began pulling out of the release. Sony, under extraordinary pressure, initially announced it would not release the film in theaters.

The decision triggered an unusual public response from President Obama, who called Sony's decision a mistake at a year-end press conference. He framed it as a question of whether the US would allow a foreign adversary to dictate what Americans could watch. Sony reversed course within days, releasing "The Interview" on Christmas Day 2014 in independent theaters that chose to screen it and via online platforms (YouTube Movies, Google Play, Xbox Video). The film grossed $36 million online in four days - a significant showing for a limited release.

The FBI's attribution of the attack to North Korea was met with some skepticism from independent security researchers, who questioned the public evidence. The FBI cited the malware similarities to prior North Korean operations, the specific IP addresses used in some communications, and classified intelligence assessments. The classified component of the attribution was never disclosed publicly. Most security firms conducting independent analysis ultimately agreed with the FBI's assessment; a minority maintained doubts.

[WARNING]
The Sony Pictures attack introduced the concept of "destructive attacks against private companies" to the US policy discussion in a way that hadn't previously crystallized. Prior to Sony, US officials discussed nation-state cyber threats primarily in terms of espionage and critical infrastructure attacks. Sony was a private entertainment company with no role in critical infrastructure. Its destruction was achieved as political retaliation for a movie. This created a policy dilemma: how should the US government respond to destructive attacks against private companies by nation-states when those companies are not critical infrastructure operators? Sony's attack demonstrated that the traditional national security framework - focused on critical infrastructure and government systems - left the private sector broadly exposed to destructive attacks used as foreign policy instruments. The US response to Sony - Obama's public attribution, limited sanctions against North Korea, and a commitment to "respond proportionately" - did not prevent subsequent North Korean attacks. The deterrence gap for destructive attacks against non-critical private infrastructure remains unresolved.

Long-Term Consequences

Sony settled multiple class action lawsuits brought by former employees whose personal information was exposed, including health records and Social Security numbers. The cost of the attack in direct expenses - rebuilding IT infrastructure, the lawsuits, lost revenue from the disrupted release - was estimated at over $100 million. Sony implemented extensive security improvements post-attack, including network segmentation, improved credential management, and enhanced monitoring.

Amy Pascal's departure and the publication of the internal emails created lasting reputational damage. The candid assessments of actors, directors, and executives that appeared in the leaked correspondence generated news coverage that outlasted the breach itself. The Sony hack demonstrated that the reputational and cultural damage from leaked internal communications could be as significant as the direct financial costs of the attack.

The attack also marked a turning point in how US companies understood their exposure to nation-state operations. Sony was not targeted because of strategic value or critical infrastructure status - it was targeted because it made a movie that annoyed a foreign government. This arbitrary, politically motivated targeting logic applied to any private company that might, in the course of normal business, do something a foreign government found objectionable.

[IOC]
Sony/Destover/GOP indicators: primary malware families identified by US-CERT in Alert TA14-353A: Backdoor.Destover, Trojan.Volgmer, Trojan.Manuscript. Wiper component created files named AAA, BBB, CCC, DDD in target directories during overwrite. C2 IPs used during the operation included addresses in Bolivia, Italy, Singapore, Thailand, Poland - consistent with compromised intermediary infrastructure. The malware included a hardcoded list of file extensions to destroy. Network propagation used SMB/Windows admin shares with harvested credentials stored in the malware's configuration. Sony breach timeline: initial compromise approximately October 2014; wiper deployed November 24, 2014; North Korea attribution announced December 19, 2014 by Director of National Intelligence. The FBI offered a $5 million reward for information on the Sony attackers; no known collection. Lazarus Group malware shared specific code sections with DarkSeoul (2013) including a specific custom RC4 implementation and PE packing method confirmed by multiple independent researchers.