A group of Russian hackers had — and possibly still has — unauthorized access to the network of Sony Pictures Entertainment, according to a report published on Wednesday by Taia Global.
The Russian team allegedly breached the entertainment company’s network by sending spear phishing emails containing a remote access Trojan (RAT) to Sony employees in India, Russia and other Asian countries. Once they had access to the computers of these employees, the attackers leveraged advanced pivoting techniques to make their way to Sony’s network in Culver City, California, the report said.
Taia Global’s report is based on information provided to the company by Yama Tough, a Russian hacker based in Ukraine. The hacker served time in the United States for cybercrimes, after which he was deported to Russia. His list of targets includes Symantec, SearchInform, and Innodata Isogen.
Yama Tough claims to have been in contact with a member of a Russian group that has had access to Sony’s network since last fall and until at least late January 2015. The unnamed Russian blackhat, who is said to have worked occasionally with Russia’s Federal Security Service (FSB), provided Yama Tough with a large number of files allegedly stolen from Sony, the report said.
Yama Tough sent some of the files to Taia Global, including seven Microsoft Excel spreadsheets, five of which are dated from November 30 through December 10, and six emails, two of which are dated January 14 and January 23. Taia Global says the information is not included in the previously dumped Sony files, and the company has received confirmation regarding the authenticity of one of the documents from its author.
News of an attack on Sony’s network came to light in late November when the company’s computers started displaying an image of a skull accompanied by a message from a group calling itself GOP (Guardians of Peace). In the following weeks, the hackers published large quantities of sensitive information obtained from Sony Pictures Entertainment’s network, including employee records, unreleased movies, private emails, and business and financial information.
Some experts and the United States government attributed the attack to North Korea based on similarities between this operation and previous ones believed to be carried out by Pyongyang. North Korea is also considered a suspect because it might have wanted to prevent the release of the movie “The Interview,” a comedy about the assassination of North Korean leader Kim Jong-Un.
However, North Korea denied any involvement in the attack and many experts questioned the findings of US authorities, especially since they haven’t provided any concrete evidence to back their claims.
In late December, Taia Global conducted a linguistic analysis of the messages written by GOP and concluded that the hackers were most likely Russian, not Korean.
If Taia Global’s reports are accurate, it’s possible that Sony was breached not by North Koreans, but by a Russian group. Another possibility, according to the company, is that Sony’s network was penetrated simultaneously by both Russian and North Korean threat actors.
“[The report] raises questions about the sources and methods used by Sony’s investigators and the U.S. government who failed to identify the Russian hackers involved and to differentiate them from the alleged DPRK hackers,” the report reads.
Sony could not immediately be reached for comment.
The attack launched against Sony by a Russian group will be discussed today by Taia Global President Jeffrey Carr in a 25 minute talk at the Suits and Spooks security conference in Washington, DC.
