North Korean spy charged with hacking Sony

So it turns out that maybe Seth Rogen isn’t the best person to look to on matters of cybersecurity. 

The Justice Department today officially charged an alleged North Korean spy with the 2014 hack of Sony Pictures Entertainment, providing in the process a detailed look at the means by which Kim Jong-un’s government supposedly retaliated against the entertainment company for its involvement in the film The Interview. 

Notably, the charges do not align with the conspiratorial musings of the film’s co-star and co-producer, Seth Rogan, who earlier this year in an interview with Vulture disputed the general understanding that North Korean was behind the hack. 

“I’ve heard that it was a disgruntled Sony employee,” he explained, later adding that “I kind of don’t think it was North Korea.”

The actual criminal complaint paints quite a different picture — going so far as to name a specific individual, Park Jin Hyok, the U.S. government says did much of the legwork in the hack that Sony claims cost it $15 million and led to eventual resignation of then Sony Pictures co-chair Amy Pascal.

“The facts set forth in this affidavit describe a wide-ranging, multi-year conspiracy to conduct computer intrusions and commit wire fraud by co-conspirators working on behalf of the government, of the Democratic People’s Republic of Korea, commonly known as ‘DPRK’ or ‘North Korea,’ while located there and in China, among other places,” notes the complaint. “Among the successful intrusions by the subjects was the cyber-attack in November 2014 directed at Sony Pictures Entertainment (‘SPE’) and its comedic film ‘The Interview,’ which depicted a fictional Kim Jong-Un, the Chairman of the Workers’ Party of Korea and the ‘supreme leader’ of North Korea.”

And thats’s not all. According to the complaint, Park was also involved with the development of the ransomware WannaCry (the complaint refers to this as WannaCry 2.0, but this is what is commonly referred to as WannaCry) and a digital Bangladeshi digital bank heist of $81 million.

He was busy. 

Importantly, Park did not do all of this alone. He likely had an entire team of (as of yet) uncharged co-conspirators all working at the behest of the North Korean government. 

Still, officially putting a face and a name to both the Sony hack and WannaCry is concrete step toward attribution for the attacks and should, in the process, quiet any lingering conspiracy theories regarding two of the most notable cybersecurity incidents of the last several years.