Malware, Networks and Attribution: Mydoom, Target and Sony

What you'll be able to do

By the end of this lesson you will be able to explain how investigators analyze malware and logs to understand attacks, and why naming the attacker is the hardest step.

• Explain how reverse engineering and network analysis were used against the Mydoom worm, and how its author covered their tracks.
• Trace the Target breach from a vendor's stolen credentials to point-of-sale malware, using log forensics.
• Explain how the Sony Pictures attack was attributed, and the difference between technical findings and attribution.

Case 8: The Mydoom Worm (2004)

The case. The book describes Mydoom as one of the fastest-spreading email worms ever, affecting millions of systems worldwide.

The forensic work. Experts traced the worm's origin using malware reverse engineering and network traffic analysis. Its creators were never caught, but the book notes that the analysis helped build better defenses.

Covering tracks. A contemporary report from Kaspersky Lab, in February 2004, shows how the author fought back. A follow-up worm called Doomjuice, which Kaspersky's analysts believed was written by the same person, spread through computers already infected by Mydoom and scattered the complete source code of Mydoom across victims' folders. Kaspersky's reading was that the goal seemed to be making it increasingly difficult to identify the original author. Once thousands of people hold the source code, possession of it no longer points to its writer. It is an early, vivid example of anti-forensics.

The book's takeaway: reverse engineering and network analysis are critical for understanding malware behavior.

Case 5: The Target Data Breach (2013)

The case. Attackers broke into the network of the US retailer Target and stole the details of about 40 million payment card accounts.

The forensic work. The book explains that investigators found malware on Target's point-of-sale (checkout) systems, and that the attackers got in using credentials stolen from a third-party vendor. In section 14.11 it describes the log forensics: firewall and authentication logs to trace the attack's origin, patterns of unauthorized access to sensitive databases, and tracking of the malware's installation through system logs and network traffic. Tools include Splunk, Wireshark and Microsoft Sysinternals tools such as Autoruns and Process Monitor.

What a Senate report added. In March 2014 the US Senate Commerce Committee published an analysis of the breach, based on media reports and expert analyses. According to CBS News' coverage, the attackers reportedly stole the credentials of a refrigeration and HVAC contractor, Fazio Mechanical Services, through phishing emails. The report found that Target ignored several alerts from its anti-intrusion software at the time the malware was delivered, rarely required two-factor authentication from its low-level contractors (according to a former Target vendor manager), and failed to isolate its most sensitive systems. In all, financial and personal information of as many as 110 million customers was affected; the card and personal-data figures overlap.

The book's takeaway: forensic analysis of access logs and malware is critical to understanding and mitigating breaches.

Case 3: The Sony Pictures Hack (2014)

The case. Attackers breached Sony Pictures' network, in what the book describes as retaliation for the film The Interview.

The forensic work. Investigators traced the malicious software to IP addresses associated with the attackers, and analysis showed similarities to earlier attacks attributed to the same groups. Section 14.11 describes the reverse engineering: disassembling the malware, examining the binary for hard-coded IP addresses and encryption keys, and comparing its structure with previous attacks to establish attribution.

What happened next. The FBI attributed the attack to North Korea in December 2014. In 2018 the US Department of Justice charged a North Korean programmer, Park Jin Hyok, alleging he was part of a government-backed team responsible for the Sony attack, the WannaCry ransomware in 2017 and the theft of $81 million from Bangladesh Bank in 2016.

The book's takeaway: network forensics and malware analysis are crucial in identifying threat actors.

The Techniques in Focus

Malware reverse engineering takes malicious software apart to understand its behavior, origin and purpose. Tools include disassemblers and decompilers such as IDA Pro and Ghidra, and sandboxes for watching malware run safely.

Log forensics reconstructs events from system, application and network logs, as in Lesson 3.6.

Memory forensics analyzes RAM for malicious processes, encryption keys and indicators of compromise. The book uses Mydoom to illustrate it: capturing memory from infected systems, identifying active malicious processes, and extracting text strings and indicators. Today the Volatility Framework is a standard tool for this.

Attribution: The Hardest Step

Technical evidence answers what and how with high confidence: this binary does this, it contacts that server, it resembles that earlier sample. Who is harder. IP addresses can belong to rented or compromised servers; code can be shared, sold or copied, as Doomjuice showed; and attackers sometimes plant false clues. Public attributions of state-backed attacks usually combine technical forensics with intelligence that is not published. Good forensic reports therefore separate technical findings from attribution, and state the confidence of each.

Real-World Example

Imagine (a fictional scenario) an online retailer whose checkout pages were secretly altered to copy card numbers. The examiner's log analysis shows a contractor's account signing in to the content system from an unusual country, three weeks before the change. The modified script sends data to a domain registered two days earlier. Reverse engineering the script shows code almost identical to a skimming kit sold on criminal forums. The report states the technical chain with confidence. It then says that the similar kit is sold widely, so it does not identify a particular group, and that further attribution would need law enforcement cooperation.

From the Book to 2026

What the book teaches. Reverse engineering and network analysis for Mydoom; access-log and malware analysis for Target; network forensics and malware comparison for Sony's attribution.

Why it made sense. These remain foundational cases and techniques.

What has changed. Mainly the detail. The Senate analysis of Target sharpened the lessons about vendor access, unheeded alerts and two-factor authentication. Sony's attribution moved from analysis to formal charges in 2018. Some tools the book lists for these techniques, such as certain older memory or sandbox projects, may no longer be maintained, so check current status. Today's malware also leans on anti-forensics: deleting logs, timestomping and code shared between groups, much as Doomjuice did in 2004.

What to do now. Report technical findings and attribution separately, with stated confidence. Keep vendor access, alerts and logs high on every investigation checklist, and use maintained, validated tools.

Watch: Hacking Timeline, What Did Target Know and When?

This Bloomberg Originals video looks at the timeline of the Target breach and the warnings that came before it.

Questions to keep in mind as you watch:

• At which points in the timeline could the attack have been detected or stopped?
• How does the timeline compare with the book's account and with the Senate report described above?
• Which of the logs and alerts mentioned would a forensic examiner want to preserve first?

The video complements what you just read. The lesson is complete without it. For an optional look at how the Sony attack was attributed, see the further-study link on this lesson.

What Would You Do?

Your malware analysis finds code in a client's network that closely resembles malware publicly attributed to a well-known state-backed group. The client's CEO wants to announce publicly that "a foreign government attacked us". What do you advise? Decide, then compare with the model answer in the note below.

Knowledge Check

Key Takeaways

• Mydoom: reverse engineering and network analysis; its author was never caught, and Doomjuice spread its source code, an early anti-forensic tactic.
• Target: vendor credentials, reportedly phished, led to point-of-sale malware. Ignored alerts and weak two-factor authentication for contractors were key failures; logs told the story.
• Sony: malware comparison and network forensics supported attribution to North Korea, followed by US charges in 2018.
• Separate what the evidence shows technically from who is responsible, and state your confidence in each.

Sources

• Dr. Tahseen Al-Doori — IT Forensics Essentials: Concepts, Tools, and the Practice of Digital Investigation, Chapter 14 (cases 3, 5 and 8; section 14.11)
• Kaspersky — Author of Mydoom produces a new worm threatening Microsoft (10 February 2004)
• CBS News — Senate report details Target's missed chances to stop data breach (25 March 2014)
• Krebs on Security — Target hackers broke in via HVAC company (February 2014)
• Krebs on Security — FBI: North Korea to Blame for Sony Hack (19 December 2014)
• US Department of Justice — North Korean regime-backed programmer charged with conspiracy to conduct multiple cyber attacks and intrusions (2018)
• The Volatility Foundation
• MITRE ATT&CK — T1070 Indicator Removal