U.S. investigators have joined the probe on the devastating attack that crippled Sony's computer systems on Nov. 24, after copies of recently released and yet-to-be released Sony films and files containing sensitive employee information have been leaked to file-sharing websites following the attack.
The Federal Bureau of Investigation (FBI) has confirmed that it is working with the Department of Homeland Security and Sony Pictures to track down the perpetrators of last week's cyber intrusion. In a five-page "flash" warning sent to companies in the U.S., the FBI also says it has extracted malicious software that was used to launch the attack on an unnamed company's computer network. The warning does not explicitly mention Sony Pictures, but people who have reviewed the report believe the FBI is referring to the company.
In the warning obtained by Reuters, the FBI provides a technical description of the malware and recommended methods for dealing with it in the event of an attack. Part of the response is to immediately contact the FBI if companies detect the malware in their systems, Reuters says.
"I believe the coordinated cyberattack with destructive payloads against a corporation in the U.S. represents a watershed event," says Tom Kellerman, chief cybersecurity officer at Trend Micro. "Geopolitics now serve as harbingers for destructive cyberattacks."
This comes after copies of the recently released Brad Pitt film "Fury" was released to file-sharing websites and downloaded at least 500,000 times, according to news site TorrentFreak. The war drama film, which made its way to theaters in October, is a box office hit and has amassed positive reviews from critics.
Also leaked is the musical remake of the 1982 classic "Annie," which is still to be released next month, as well as the films "Mr. Turner" and the Julianne Moore starrer "Still Alice," which GoldDerby.com predicts to be Academy Award contenders. The 2015 drama "To Write Love in Her Arms" starring Kat Dennings and Chad Michael Murray is also leaked.
The films aren't the only files leaked. It appears the attackers have kept their promise of releasing the company's "secrets" unless Sony Pictures gives in to their demands. A report posted by Fusion reporter Kevin Roose says he received an email from an anonymous person pointing him towards a Pastebin file containing the company's financial records, which include data about the salaries of 6,000 Sony Pictures employees, including its top executives, and sensitive information such as their home addresses.
Workers at Sony Pictures' Culver City, California and New York City offices were greeted by a message posted on their screens by the attackers on Monday. The message, which included a picture of a red skull in the background, says "Hacked by #GOP," which reportedly stands for Guardians of Peace. The attackers warned that it will release the company's internal documents if Sony Pictures does not comply with their demands. It is not clear what those demands are or whether Sony officials are aware of them. What is clear, however, is the company has chosen not to give what the attackers want.
"Sony Pictures continues to work through issues related to what was clearly a cyberattack last week," says the company in a statement. "The company has restored a number of important services to ensure ongoing business continuity and is working closely with law enforcement officials to investigate the matter."
Sony has since partnered with the Mandiant forensics team at FireEye security firm; a sign which analysts say indicates the severity of the breach. Mandiant was also the same team that worked with Target during the 2013 Target security breach that led to the theft of millions of user accounts and bank details.
Reuters reports that the malware allegedly used in the Sony Pictures attack is very similar to that used to launch attacks on businesses in the Middle East and South Korea, such as the breach on oil producer Saudi Aramco's systems that rendered more than 30,000 computers useless. Those attacks were widely believed to have been launched from Iran and South Korea.
So far, the FBI says it has yet to identify who is behind the Sony Pictures attack, but Re/code reports that the company is exploring the possibility that the attack came out of North Korea, possibly by hired hackers operating from China, as retaliation against Sony Pictures' soon-to-be-released comedy "The Interview." Starring actors Seth Rogen and James Franco, the film revolves around two U.S. journalists hired by the CIA to assassinate North Korean leader Kim Jong-Un.
In a letter written by North Korea to United Nations Secretary-General Ban Ki-moon, the Pyongyang leaders condemned the movie, calling it an "undisguised sponsoring of terrorism, as well as an act of war."
