Sony Pictures hack 2014: how North Korea broke into Hollywood

November 24, 2014. Sony Pictures employees arrived at work and found a red skeleton on their screens with the caption: Hacked by #GOP. Network drives were inaccessible. Email, frozen. Internal files, corrupted or deleted. Within hours, one of the world's largest film studios was running on pen and paper.

It wasn't ransomware asking for money. It was deliberate destruction — and behind it stood an entire country.

Who were the "Guardians of Peace"?

The group called itself Guardians of Peace (GOP). Over the following weeks, the FBI ran a technical investigation comparing the malware used in the attack against known samples from earlier campaigns. The conclusion, announced on December 19, 2014 — just 25 days after the incident — was unambiguous: the people responsible were agents of the North Korean government.

Later, researchers from Kaspersky Lab, Novetta, Symantec and AlienVault Labs, in a joint investigation named Operation Blockbuster, confirmed and detailed the attribution. The group behind the hack was the Lazarus Group, the North Korean regime's cyber-espionage and sabotage cell, active since at least 2009 — the same group responsible for the July 4, 2009 DDoS attacks against US and South Korean government sites.

How the attack happened

The initial vector was spear phishing: carefully crafted emails sent to specific Sony employees, with malicious attachments or links. Once one employee's machine was compromised, the attackers moved laterally through the corporate network for weeks — mapping internal structures, identifying critical servers and exfiltrating data — before triggering the destructive phase.

What is wiper malware?

Wiper malware is a type of malicious code designed to destroy data permanently, with no possibility of recovery. Unlike ransomware, which encrypts files while waiting for a ransom, a wiper simply erases or overwrites data. In the Sony attack, the hackers used Destover, a wiper that overwrote the Master Boot Record (MBR) of Windows machines, rendering them unable to boot — and taking the stored data with them.

Destover shared code components with Shamoon, a wiper used in 2012 against Saudi Aramco that destroyed more than 30,000 computers. The technical resemblance was one of the pieces of evidence pointing at North Korea, whose hacking apparatus had already demonstrated the ability to develop destructive tools at that level.

What was stolen — and what was destroyed

Before triggering Destover, the Lazarus Group exfiltrated terabytes of confidential data from Sony Pictures. The leaked material included:

• Complete unreleased films, which showed up on torrent sites days later
• Email exchanges between executives, including racist remarks and criticism of famous actors
• Salaries and personal data of tens of thousands of current and former employees
• Editorial plans, scripts and confidential negotiations with distributors
• Internal system passwords and credentials for external platforms

The executive email leak was especially devastating for the company's image. Private conversations between then co-chair Amy Pascal and producer Scott Rudin — with disparaging comments about Hollywood stars — became headlines worldwide.

The connection to "The Interview"

The explicit trigger for the attack was The Interview, a Sony comedy starring Seth Rogen and James Franco about an assassination attempt on Kim Jong-un. North Korea had called the film "an act of war" and formally demanded the US block its distribution — and the US ignored it.

In December 2014, the GOP sent direct threats to cinemas that showed the film, referencing the September 11 attacks. Major theater chains cancelled screenings. Sony, under pressure, announced it would not release The Interview. The decision was sharply criticized by the Obama administration, which called it "a mistake".

Five days later, Sony reversed course: it released the film simultaneously on online platforms and in independent cinemas. The Interview grossed more than US$15 million in streaming in its first weeks — while North Korea remained furious.

The response: FBI, Obama and historic sanctions

On December 19, 2014, the FBI publicly confirmed that North Korea was responsible. It was the first time the United States had officially attributed a destructive cyberattack to a foreign state in a public statement.

President Barack Obama went further: in January 2015, he signed an executive order imposing new economic sanctions on North Korea specifically in retaliation for the Sony hack. It was the first time in American history that a president sanctioned a foreign country in direct response to a cyberattack.

North Korea denied any involvement — and then praised the hack, without acknowledging direct participation. The contradiction didn't go unnoticed.

The legacy of the Sony hack

The incident changed how the corporate world sees state cyber risk. Until 2014, most companies treated state-sponsored hackers as a problem for governments, intelligence agencies and critical infrastructure — not for film studios.

The Sony hack demonstrated that any company with a high public profile and access to sensitive data can become a geopolitical target. The motivation didn't have to be financial: it was enough for a state to have an interest in punishing or intimidating.

The attack also popularized a type of incident response that's now industry standard: proactive threat hunting — looking for signs of intrusion inside the network before the attacker triggers the destructive phase. In Sony's case, the intruders spent weeks inside the network undetected. If lateral-movement detection tools had been in place, the attack could have been stopped much earlier.

Heartbleed in April 2014 and the Sony hack in November were the two biggest warnings of that year: the first about structural flaws in widely used software, the second about states' willingness to use cyberattacks as an instrument of foreign policy. Together, they would redefine what "corporate security" means in the 21st century.

What to learn from all of it

The Sony attack wasn't extraordinarily sophisticated in technical terms — the entry point was spear phishing, a well-known technique. What made the damage so large was the combination of no network segmentation (once inside, the attackers reached everything), no exfiltration monitoring and the nature of the wiper, which made fast recovery impossible.

Three direct lessons that still apply to any organization today:

• Segment the network: one employee's credentials should not open access to production servers, backups and HR data at the same time.
• Monitor volume anomalies: terabytes of data leaving a corporate network over a few days produces identifiable patterns — if someone is watching.
• Implement lateral-movement detection: EDR and SIEM tools configured to alert on unusual access between network segments are the difference between containing an incident and total destruction.

To understand how groups like Lazarus have operated from the start and the impact of large-scale infrastructure attacks, it's worth revisiting the cases that wrote the playbook they still follow today.