The Sony Pictures Entertainment attack involved Lazarus-linked Blockbuster malware with dropper, proxy, cleanup, credential-based lateral movement, C2 log reporting, and destructive disk/file wiping components. Evidence from Operation Blockbuster connected the SPE malware set to a wider Lazarus cluster through code reuse, shared implementation quirks, self-delete behavior, reused resources and passwords, and overlapping malware families spanning financial, media, manufacturing, Sony Pictures, and South Korean targets.