Connect with us

Hi, what are you looking for?



Russian Hackers Breached Sony’s Network: Report

A group of Russian hackers had — and possibly still has — unauthorized access to the network of Sony Pictures Entertainment, according to a report published on Wednesday by Taia Global.

A group of Russian hackers had — and possibly still has — unauthorized access to the network of Sony Pictures Entertainment, according to a report published on Wednesday by Taia Global.

The Russian team allegedly breached the entertainment company’s network by sending spear phishing emails containing a remote access Trojan (RAT) to Sony employees in India, Russia and other Asian countries. Once they had access to the computers of these employees, the attackers leveraged advanced pivoting techniques to make their way to Sony’s network in Culver City, California, the report said.

Taia Global’s report is based on information provided to the company by Yama Tough, a Russian hacker based in Ukraine. The hacker served time in the United States for cybercrimes, after which he was deported to Russia. His list of targets includes Symantec, SearchInform, and Innodata Isogen.

Yama Tough claims to have been in contact with a member of a Russian group that has had access to Sony’s network since last fall and until at least late January 2015. The unnamed Russian blackhat, who is said to have worked occasionally with Russia’s Federal Security Service (FSB), provided Yama Tough with a large number of files allegedly stolen from Sony, the report said.

Yama Tough sent some of the files to Taia Global, including seven Microsoft Excel spreadsheets, five of which are dated from November 30 through December 10, and six emails, two of which are dated January 14 and January 23. Taia Global says the information is not included in the previously dumped Sony files, and the company has received confirmation regarding the authenticity of one of the documents from its author.

News of an attack on Sony’s network came to light in late November when the company’s computers started displaying an image of a skull accompanied by a message from a group calling itself GOP (Guardians of Peace). In the following weeks, the hackers published large quantities of sensitive information obtained from Sony Pictures Entertainment’s network, including employee records, unreleased movies, private emails, and business and financial information.

Some experts and the United States government attributed the attack to North Korea based on similarities between this operation and previous ones believed to be carried out by Pyongyang. North Korea is also considered a suspect because it might have wanted to prevent the release of the movie “The Interview,” a comedy about the assassination of North Korean leader Kim Jong-Un.

Advertisement. Scroll to continue reading.

However, North Korea denied any involvement in the attack and many experts questioned the findings of US authorities, especially since they haven’t provided any concrete evidence to back their claims.

In late December, Taia Global conducted a linguistic analysis of the messages written by GOP and concluded that the hackers were most likely Russian, not Korean.

If Taia Global’s reports are accurate, it’s possible that Sony was breached not by North Koreans, but by a Russian group. Another possibility, according to the company, is that Sony’s network was penetrated simultaneously by both Russian and North Korean threat actors.

“[The report] raises questions about the sources and methods used by Sony’s investigators and the U.S. government who failed to identify the Russian hackers involved and to differentiate them from the alleged DPRK hackers,” the report reads.

Sony could not immediately be reached for comment.

The attack launched against Sony by a Russian group will be discussed today by Taia Global President Jeffrey Carr in a 25 minute talk at the Suits and Spooks security conference in Washington, DC.

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join security experts as they discuss ZTNA’s untapped potential to both reduce cyber risk and empower the business.


Join Microsoft and Finite State for a webinar that will introduce a new strategy for securing the software supply chain.


Expert Insights

Related Content


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.


As it evolves, web3 will contain and increase all the security issues of web2 – and perhaps add a few more.


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...


Luxury retailer Neiman Marcus Group informed some customers last week that their online accounts had been breached by hackers.


Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.


Satellite TV giant Dish Network confirmed that a recent outage was the result of a cyberattack and admitted that data was stolen.

Artificial Intelligence

The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.


A new study by McAfee and the Center for Strategic and International Studies (CSIS) named a staggering figure as the true annual cost of...