View source for Sony/Destover: mystery North Korean actor’s destructive and past network activity

{{Publication
|Botnet=Destover,
|Target=Sony,
|Group=Destructive,
|Year=2014
|Date=2014-12-04
|Editor=Kaspersky Securelist
|Link=https://securelist.com/blog/research/67985/destover/
|Author=Kurt Baumgartner,
|Type=Blogpost
|Abstract=This week, for the first time, the FBI issued a Flash warning about a destructive wiper activity, used in the attack on Sony Pictures Entertainment. Samples of this Destover malware contained configuration files created on systems using Korean language packs.

Since the attack, further information about the malware has surfaced in one form or another, but some details, such as those relating to the previous activity of the prime suspects, are still to be examined.

So, while Sony Pictures silently completes its costly clean-up efforts and prepares to release “The Interview”, let’s discuss some of the malware functionality, glaring similarities with other wiper events, and some of the suspect group’s previous activity.
}}