The Sony Pictures Hack: Forensic Investigators Trace North Korea

On November 24, 2014, employees at Sony Pictures Entertainment arrived at work to find a menacing image on their screens: a red skeleton, a warning from a group calling itself "Guardians of Peace." The hack that followed was the most destructive cyberattack on a U.S. company in history.

THE ATTACK: The hackers deployed "wiper" malware that deleted files and corrupted hard drives across Sony's network. They stole and published:

• Unreleased films including "Annie" and "Fury"
• Sensitive executive emails, including racist and inflammatory exchanges
• Employee social security numbers and medical records
• Executive salary data

The motive appeared to be Sony's upcoming release of "The Interview," a comedy about assassinating North Korean leader Kim Jong-un.

THE FORENSIC TRAIL: FBI and private forensic investigators examined the malware and found telling signatures:

• Code similarities to malware previously attributed to North Korea's Lazarus Group
• Hard-coded IP addresses traced to North Korean infrastructure
• The malware used similar encryption algorithms and data structures to known DPRK tools
• Korean-language artifacts embedded in the code

THE ATTRIBUTION: On December 19, 2014, the FBI officially attributed the attack to North Korea — one of the first times the U.S. government publicly blamed a foreign nation for a cyberattack.

THE CONTROVERSY: Security researchers debated the attribution. Some argued the evidence was circumstantial and that sophisticated actors routinely plant false flags. Others maintained the totality of evidence pointed clearly to Pyongyang.

The investigation pushed digital forensics into a new era: attributing nation-state cyber operations.

Tell us your thoughts in the comments below.

Please like and subscribe for more investigations from The Evidence Log.