Risk Based Security publishes analysis of data breaches and hacks, including the Sony hack, Equation Group leaks and political data dumps.
HN commenters treat its Sony hack breakdown as a canonical source and cite it for background on the Shadow Brokers leak.
The leaks started on November 24.
> On December 1st, NBC News aired a segment reporting that the FBI were investigating the breach and the possibility that North Korea was involved. While this may sound far-fetched at first, North Korea has a clear motive in attacking Sony.
That was the first NK link.
> (December 8) Unlike previous disclosures that were straight-forward, this group of files comes shortly after the appearance of a Pastebin link (now 404) that purports to be from the GOP, and gives a reason for the attacks on Sony Pictures, linking it to the now controversial movie, “The Interview”. There is speculation that the new announcement may not be authentic as it did not get sent out via the previous channels, and suggests an almost afterthought of blaming the movie for their actions.
That was the first time the GoP (if that was them in the first place) mentioning any of this.
Two likely possibilities (imho):
* Someone else did it purporting to be them, and the GoP didn't deny it for the extra lolz (+ it didn't hurt their cause/objectives)
* They did it themselves to reinforce the media frenzy (by that time, the NK link was almost presented as a fact in many media sources)
Think about it this way: If this is an independent group of hackers, completely unrelated with any states (through funding or otherwise), through the NK link they "leveled up": Convincing the World that this was NK, we're in cyberwar, the world is ending (etc) far outweighs "hacked Sony for…
I googled that phrase and also "HTTPSExploit", and came up with a few articles that mentioned it:
[1] http://rebrn.com/re/the-nsa-has-been-hacked-and-the-hackers-are-releasing-some-of-th-2761918/
[2] https://www.riskbasedsecurity.com/2016/08/the-shadow-brokers-lifting-the-shadows-of-the-nsas-equation-group/
[3] http://pastebin.com/Uu4qsbUN
In a data breach this large, the confidential data itself can be a source of new information.
https://www.riskbasedsecurity.com/2014/12/a-breakdown-and-analysis-of-the-december-2014-sony-hack has a decent overview of what you may have missed if you are only paying attention to FBI or SPE press releases.
https://www.riskbasedsecurity.com/2014/12/a-breakdown-and-analysis-of-the-december-2014-sony-hack/ < for me is the canonical source of news.