Mandiant Says Sony Hack Was “Unprecedented” Due to Undetectable Malware

Sony was rocked by a massive ransomware attack in late November, and is still reeling from the effects. Most recently, Sony employees have been on the receiving end of threatening emails from the perpetrators of the hack: Guardians of Peace (#GOP).

Now we’re beginning to learn a bit more about the hack courtesy of Mandiant, the cybersecurity firm brought in for digital forensics analysis. While the investigation is still ongoing, email correspondence from Mandiant founder Kevin Mandia and Sony Entertainment CEO Michael Lynton has been provided to Variety.

Lynton sent out an email to employees on Saturday discussing the attack, but couldn’t give much solace to the 3,800 employees that had their information leaked to the Internet. “There is much we cannot say about our security protocols for obvious reasons, but we wanted to share with you a note we received today from Kevin Mandia, the founder of the expert cybersecurity firm that is investigating the cyber-attack on us,” Lynton explained.

Sony Entertainment CEO Michael Lynton (Image Credit: USNews)

An apology to employees would have probably been better, but Lynton at least followed up with a note from Kevin Mandia, shedding some light on the attack. Interestingly, Mandia seems to suggest that attack was so sophisticated and well thought out that nothing Sony could have done would have prevented it.

“This attack is unprecedented in nature,” said Mandia. “The malware was undetectable by industry standard antivirus software and was damaging and unique enough to cause the FBI to release a flash alert to warn other organizations of this critical threat.

^{Kevin Mandia}

“Its purpose was to both destroy property and release confidential information to the public,” Mandia added. “The bottom line is that this was an unparalleled and well planned crime, carried out by an organized group, for which neither SPE nor other companies could have been fully prepared.”

Mania seems to taking up for Sony and trying to deflect any sense of responsibility for Sony’s part in the release of personal information. Mandia also didn’t address the poor security practices by Sony that allowed such sensitive and embarrassing information to be leaked.

Not only were thousands of corporate and personal passwords stored in an unprotected file called “Password”, but internal memos also revealed Sony’s strategy for selecting films and criticism of the studio’s continued involvement with dreadful Adam Sandler films.