The FBI claims that the cyberattacks targeting Sony pictures originated from North Korea, but the attack aimed at the film The Interview may have been launched from Iran, China or Russia. The suspicion of the three other countries derives from the sophistication of malware “modules or packets” that were used; those had been seen before from the three countries, but never from North Korea.
The malware destroyed systems in two ways: overwriting data and halting execution processes. The Sony systems were not forced open by the malware, suggesting that an insider may have triggered the attack or someone using stolen credentials. One source told Fox News that the final stage of the attack came from a country other than North Korea, which would leave room for North Korea to deny responsibility.
Fox News reported that the Obama Administration seemed to be playing some sort of double game, informing U.S. security firms on Monday that North Korea was responsible for the attacks but then eschewing such a claim when Press Secretary Josh Earnest spoke publicly about the matter on Thursday. Earnest only said, “There is evidence to indicate that we have seen destructive activity with malicious intent that was initiated by a sophisticated actor.”
U.S. Rep. Ed Royce (R-CA), the chairman of the House Foreign Affairs Committee, attested that the attack was ordered by a foreign government, and added that North Korea has a unit titled Bureau 121 which specializes in cyber warfare.
KCNA, the North Korean state-run news agency, wrote, “The hacking into the Sony Pictures might be a righteous deed of the supporters and sympathizers with the (North) in response to its appeal… ‘The righteous reaction will get stronger to smash the evil doings.’” That language was similar to language used by the hackers.