FBI outlines its hacking evidence against North Korea
The FBI has directly named the North Korean government as the source of last month's hacking of Sony Pictures following an investigation into the cyber attack.
The agency confirmed a group calling itself "Guardians of Peace" had claimed responsibility for the attack and subsequent threats made to Sony, its employees and cinemas that distribute its movies.
An FBI statement said the true identity of the attackers was the administration in Pyongyang.
The investigators cited three key areas that helped lead them to their conclusion.
Technical analysis of the data deletion malware used in this attack revealed links to other malware that the FBI knows North Korean actors previously developed. For example, there were similarities in specific lines of code, encryption algorithms, data deletion methods, and compromised networks.
The FBI also observed significant overlap between the infrastructure used in this attack and other malicious cyber activity the US Government has previously linked directly to North Korea. For example, the FBI discovered that several Internet protocol (IP) addresses associated with known North Korean infrastructure communicated with IP addresses that were hardcoded into the data deletion malware used in this attack.
Separately, the tools used in the SPE attack have similarities to a cyber attack in March of last year against South Korean banks and media outlets, which was carried out by North Korea.
The FBI said its evidence supported the claim of the White House that the Sony hacking was a "matter of national security".
The agency pledged to support any other companies targeted by future cyber attack and track down those responsible.