North Korea-linked attackers phished Sony staff with fake Apple ID emails, stole data and wiped thousands of PCs in 2014. How it worked and what it cost.
Social Engineering Examples·16 sources
In autumn 2014, attackers the US government ties to North Korea sent Sony Pictures staff fake Apple ID emails asking them to "verify" their accounts. The stolen passwords helped them into Sony's network, where they took huge amounts of data and then ran malware that wiped thousands of computers. On 24 November 2014, employees found their screens taken over by a red skeleton from the "Guardians of Peace". Sony later put its costs at about $41 million. Status: Documented incident, attributed by the FBI.
According to the FBI, the attackers researched targets online, then sent emails that copied real service messages almost word for word, with the links swapped. Security researcher Stuart McClure of Cylance went through leaked Sony inboxes and found the main lure was a fake Apple ID notice: unauthorised activity on your account, verify within 48 hours or be locked out.
The link led to a polished fake verification page on a lookalike domain such as ioscareteam.net. Targets were picked by searching LinkedIn for Sony staff with network privileges, such as system engineers and administrators.
Tip: never "verify" an account from an emailed link. Open the app, or type the company's address yourself.
| Stage | What happened |
|---|---|
| Phish | Staff entered their Apple ID and password on the fake page |
| Reuse | Because people reuse passwords, those logins helped the attackers into Sony's network |
| Steal | Large amounts of data were copied out: films, emails, staff records |
| Wipe | Stolen admin passwords were built into wiper malware, which spread over network shares and overwrote disks |
Researchers noted an admin account for Sony's software-distribution tool may have let the attackers push the malware out like a normal update. A flat network with little separation let it spread widely. Kaspersky named the malware Destover. Calling it a version of the Shamoon wiper is shorthand: Kaspersky noted the two use the same commercial disk driver but said that doesn't prove the same crew.
| Cost | Amount | Source |
|---|---|---|
| Investigation and remediation, year to March 2015 | About $41 million (¥4.9 billion) | Sony Form 20-F, June 2015 |
| Early figure, quarter to December 2014 | $15 million | Sony, February 2015 (superseded) |
| Employee class action settlement | Up to $8 million | Approved April 2016 |
The value of leaked films and lost reputation has never been put into numbers.
The FBI publicly blamed North Korea on 19 December 2014. In 2018, the US Department of Justice charged a North Korean programmer, linking the Sony attack to the 2016 Bangladesh Bank heist and the 2017 WannaCry outbreak. He has never been arrested or tried, so his role is an allegation. The group is widely known as Lazarus.
See also spear phishing and credential harvesting.
With spear-phishing emails posing as Apple ID verification notices. Staff who entered their details handed over passwords that helped the attackers get into Sony's network.
The FBI attributed it to North Korea. A North Korean programmer was charged in 2018 but has never been arrested or tried.
Sony reported about $41 million in investigation and remediation costs for the year to March 2015, plus a staff settlement of up to $8 million.
The attackers threatened cinemas showing the film, and it was widely linked to the attack. The film's release was disrupted.
Social Engineering Examples. “Sony Pictures hack (2014): fake Apple ID emails to a wiper attack”. Accessed 3 November 2026. https://socialengineeringexamples.com/sony-pictures-guardians-of-peace-2014
The DOJ/FBI criminal complaint against a North Korean computer programmer (Section VI, "Targeting Techniques Used") describes the conspirators researching target-company employees online; separately, security researcher Stuart McClure's analysis of the leaked Sony inboxes found a direct correlation between the credentials attackers had captured and the LinkedIn listings of Sony staff in system-engineer and network-administrator roles, consistent with LinkedIn-driven selection of privileged-access targets.
Employee-facing OSINT exposure via LinkedIn (names, titles, network-privilege roles) is very hard to eliminate at enterprise scale; the realistic control assumes attackers can already build this picture and instead hardens what a stolen personal password can unlock (see Stage 5), rather than trying to hide the org chart.
The attackers stood up a convincing fake Apple ID/AppleCare "verify your account" phishing page, on a look-alike domain such as ioscareteam.net, closely cloned from real Apple account-security notices; this is the kind of credential-harvesting infrastructure typically built using commodity phishing-kit techniques and look-alike domain registration.
Domain-monitoring and brand-protection services, plus DNS/web filtering that flags newly registered look-alike domains impersonating well-known vendors, can catch this kind of fake-verification infrastructure before it is used at scale.
Beginning around Oct 3, 2014, employees identified in Stage 1 received a series of fake Apple ID emails warning of unauthorized account activity and demanding verification within 48 hours, growing more sophisticated through early November per Cylance's review of the leaked inbox contents.
Email authentication (SPF/DKIM/DMARC) and gateway link rewriting/time-of-click analysis reduce the odds a spoofed "verify your account" email reaches or successfully lures a target, paired with recurring security-awareness training and phishing simulations that specifically cover consumer-brand impersonation lures landing in work inboxes.
Recipients who clicked the link were taken to the fake Apple verification page and entered their real Apple ID username and password, handing the attackers working credentials tied to real employee identities.
Train and reinforce that account-security alerts should be verified only by opening the vendor's own app or hand-typing the official domain, never via an emailed link, and enable phishing-resistant MFA on personal accounts where offered so a stolen password alone is insufficient.
Because personal/work password reuse is common, the attackers likely used or cross-checked the harvested Apple credentials against Sony's internal logins, per Cylance's assessment, obtaining or guessing valid Sony passwords for several high-access accounts, including one with administrator rights to Sony's SCCM software-distribution platform.
Eliminate work/personal password reuse with mandatory password managers and unique credentials per account, and require phishing-resistant MFA on all corporate email, VPN, and administrative logins so a leaked personal password cannot be reused to reach the network.
The stolen high-access credentials, including the SCCM administrator account, were hard-coded directly into the wiper malware and, per Cylance's evidence-based but speculative reconstruction, plausibly used to push the malware across Sony's network disguised as a legitimate software update.
Apply least-privilege access and close monitoring/change control on enterprise software-distribution tools like SCCM, including alerting on new or anomalous administrator logins and unexpected push jobs, so one compromised admin account cannot silently distribute malware enterprise-wide.
Exploiting a flat, poorly segmented network, the intruders spent at least two months copying confidential data, unreleased films, executive emails, salary data and employee PII before the destructive phase. Identity Finder's analysis of the posted files (5 Dec 2014) counted 47,426 unique Social Security numbers across 601 files, of which 15,232 belonged to current or former Sony employees; the consolidated employee class action alleged the theft of nearly 100 terabytes in total.
Network segmentation to contain lateral movement, EDR tuned to flag mass file access and exfiltration staging, and data-loss-prevention monitoring on large outbound transfers make a multi-month internal foothold far more likely to be caught before wholesale data theft.
On Nov 24, 2014, the attackers detonated the wiper that vendors named Destover (Kaspersky) and BKDR_WIPALL (Trend Micro). US-CERT alert TA14-353A describes it overwriting the master boot record and destroying data on up to the first four physical drives, and it disabled thousands of Sony workstations. The attackers then publicly released the stolen data under the "Guardians of Peace" persona and used that leverage to demand Sony withdraw "The Interview," completing the extortion/coercion objective.
Offline, immutable backups isolated from the production domain and a rehearsed incident-response plan that assumes destructive wiper activity limit how much of the enterprise a detonation can take down, and tested restoration paths remove much of the leverage the extortion/coercion step depends on.
Browse by what this case has in common with others in the library.
Impostors posing as Scoular's CEO and a senior figure at its audit firm convinced the controller a secret China acquisition…
A tech-support operator used fake Microsoft/Apple security pop-ups to scare consumers, often older Americans, into calling an India-based support line…
In 2015, fake emails from Ubiquiti's CEO and a real London lawyer got its finance chief to wire $46.7M. How…
A phone-record pretexting incident involving a retired U.S. Army general was followed by FTC enforcement and broader privacy-policy scrutiny.
Fraudsters faked WPP CEO Mark Read on WhatsApp and staged a Teams call with a cloned executive voice. The agency…
Fake finance "directors" in WhatsApp groups steered 18+ US investors to NanoBit, a crypto platform that never traded. The SEC…
Toronto firm CoHost spent two months interviewing a candidate it now believes was a fabricated persona with fake references. The…
Chinese state-linked hackers used spear-phishing links and an unpatched Internet Explorer zero-day to breach Google, Adobe, and dozens of other…
Two New Jersey men ran US "laptop farms" and shell companies that let North Korean IT workers use the stolen…
A phone-record pretexting incident involving a retired U.S. Army general was followed by FTC enforcement and broader privacy-policy scrutiny.
Fraudsters spoofing the French CEO's "personal" email talked Pathé's Dutch management into wiring €19.2M for a fake secret Dubai acquisition,…
The EA data breach began in June 2021, when hackers used a Slack session cookie they said cost $10 to…
A single phishing email opened by an Anthem subsidiary employee in Feb 2014 seeded a nation-state intrusion that quietly stole…
Prosecutors allege Ghanaian twins used fake female personas and AI video to take $15M+ from 130+ older Americans. What is…
A Chinese national entered Mar-a-Lago after a pool-visit pretext and staff's unverified assumption that she was related to a member.…
A compromised Constant Contact mass-mailing account let Russia-linked Nobelium (APT29) send USAID-spoofed phishing emails that funneled roughly 3,000-7,000 accounts across…
Impersonators posing as two Philadelphia school vendors asked to switch from cheque to ACH and diverted nearly $700,000 in 2024.…
The FBI's 2025 Internet Crime Report tracked AI fraud for the first time: 22,364 complaints and $893M lost. What the…
Anthropic says a suspected Chinese state group conned Claude Code with a fake pentest story and let it run most…
KnowBe4 hired a North Korean operative using a stolen US identity and an AI-enhanced photo in 2024. Malware started on…
APT28's LAMEHUG malware asked an AI model on Hugging Face to write the spy commands it ran on Ukrainian government…
Two New Jersey men ran US "laptop farms" and shell companies that let North Korean IT workers use the stolen…
A compromised Constant Contact mass-mailing account let Russia-linked Nobelium (APT29) send USAID-spoofed phishing emails that funneled roughly 3,000-7,000 accounts across…
A single phishing email opened by an Anthem subsidiary employee in Feb 2014 seeded a nation-state intrusion that quietly stole…
Social Engineering Examples