Sony Corporation is investigating allegations of a cyberattack this week, with multiple threat actors claiming responsibility for the purported breach.
Initially, an extortion group known as RansomedVC claimed to have attacked Sony’s systems and asserted their control over the company’s data, which they announced they would sell. “We have successfully compromised all of Sony systems,” a message posted on RansomedVC’s onion leak site declared. “We won’t ransom them! We will sell the data due to Sony not wanting to pay.”
However, it was noted that the sample data shared by RansomedVC was relatively small, around 2 MB. This included a PowerPoint presentation, Java source code files, Eclipse IDE screenshots, and other assets. RansomedVC later claimed to have stolen 260 GB of data during the alleged attack and was seeking US$2.5 million for its release.
Contrary to their name, RansomedVC is described as an extortion group, not a ransomware operation, and they revealed that they are still developing an encryptor.
In response to these claims, Sony Corporation stated, “We are currently investigating the situation, and we have no further comment at this time.” The company has yet to confirm or deny the breach.
Meanwhile, the situation took an unexpected turn when another threat actor, named ’MajorNelson,’ claimed responsibility for the attack and disputed RansomedVC’s assertions. MajorNelson criticized news reports that attributed the attack to RansomedVC, accusing journalists of being “far too gullible” and labeling RansomedVC as scammers seeking influence.
MajorNelson released a 2.4 GB compressed archive for free, which purportedly contains 3.14 GB of uncompressed data belonging to Sony. The dump allegedly includes a significant number of credentials for internal systems, files related to SonarQube, Creators Cloud, Sony’s certificates, a device emulator for generating licenses, qasop security, incident response policies, and more.
BleepingComputer, a technology news source, examined the archive posted by MajorNelson and found that it contained all the files in RansomedVC’s smaller sample. However, definitive attribution remains challenging, and the veracity of both threat actors’ claims has yet to be independently verified.
