THE HISTORY OF THE DARKSEOUL GROUP AND THE SONY INTRUSION MALWARE DESTOVER

INTRODUCTION
Much has been written about the Sony hack. However, hard data has not been as plentiful. In an attempt to
provide additional insight, we detail some facts about the malware reportedly used in the attack, and attempt to
draw lines to other malware and incidents, beyond the mere speculative.
In order to expand the case, we will look at a variety of evidence. In most cases, we will not settle for one single
factor as the basis for assessments, but instead correlate information of different kinds. Factors that we will include
are for example:
• Obfuscation methods
• Code structure
• Text strings, such as encryption keys
• Known localization
• Digital code signing certificates
Details about the different indicators are included in the appendixes.
Acknowledgements
A big thank you goes out to all who helped with this paper – notably Waylon Grange, always an invaluable source of
insight and information, and the good folks over at Farsight Security who gracefully provided passive DNS data.