On the night of October 31, 2005, Mark Russinovich — co-founder of Sysinternals and author of the rootkit-detection tool RootkitRevealer — ran a beta build of his own utility against his personal workstation after playing Van Zant's Get Right with the Man. He found cloaked files, a hidden device driver, and a set of registry keys invisible to Windows Explorer, Task Manager, and his antivirus software. He traced all of it to a piece of commercial software that had installed itself the moment he inserted the CD: Extended Copy Protection (XCP), a digital rights management system Sony BMG had licensed from a small UK firm, First4Internet, and shipped on tens of millions of retail audio discs. His post, "Sony, Rootkits and Digital Rights Management Gone Too Far," used the word "rootkit" to describe a Fortune-500-adjacent media company's own product — and the term stuck (Russinovich, Sysinternals Blog, Oct 31 2005).
What Russinovich had found was not a hypothetical risk. XCP installed a kernel-mode driver that hooked the Windows API used to enumerate files (NtQueryDirectoryFile) so that anything named with the prefix "$sys$" — files, registry keys, and running processes — became invisible to the operating system and to most antivirus engines of the era. It did this by design, to hide its own DRM-enforcement components from the user. The problem, as security researchers immediately pointed out, was that the cloak did not check who owned the $sys$-prefixed object before hiding it. Ten days later, on November 10, 2005, the first malware built to exploit exactly that flaw — a backdoor trojan later tracked as Breplibot/Ryknos — appeared in the wild, renaming itself to inherit Sony's own invisibility cloak (Slashdot; TechSpot; F-Secure v-desc, Nov 2005).
What followed was less a single "hack" than a cascading vendor-negligence crisis: a second, independently broken DRM system (MediaMax, from SunnComm) shipped on roughly half of the affected titles; Sony's own emergency uninstaller introduced an even more severe remote-code-execution hole than the rootkit it was meant to remove; and a wave of state attorney-general suits, consumer class actions, and a landmark Federal Trade Commission enforcement action followed through 2006 and into early 2007. Sony BMG ultimately recalled roughly 4.7 million CDs, settled with regulators in nearly every jurisdiction that sued, and permanently abandoned CD-based copy protection.
The incident endures as a case study for a reason distinct from its scale: it collapsed the assumption that "rootkit" tradecraft implies malicious intent, forced the antivirus industry to evaluate software by behavior rather than vendor provenance, and produced the first regulatory precedent — the FTC's 2007 consent order — treating undisclosed, security-degrading consumer software as an unfair trade practice regardless of the installer's commercial legitimacy. In shape, it is a direct ancestor of later software-supply-chain incidents: a widely-trusted distributor shipping a small, under-scrutinized third-party component that carried unreviewed security-relevant capability at scale, immediately exploited by unrelated actors once exposed.
By the mid-2000s, the major record labels were in open crisis over CD ripping and peer-to-peer distribution. Napster's shutdown in 2001 had done little to slow the practice; consumer CD burners and MP3 players had made ripping trivial, and earlier label experiments with copy-control watermarking (e.g., Macrovision's Cactus Data Shield, deployed by other labels earlier in the decade) had already drawn criticism for degrading playback on some devices. Sony BMG — itself a 2004 joint venture between Sony Music and Bertelsmann's BMG — moved to deploy more aggressive copy-restriction technology across its catalog rather than develop it in-house, licensing two competing systems from small third-party vendors: XCP from First4Internet (Bracknell, UK) and MediaMax from SunnComm Technologies (Phoenix, Arizona, later renamed The Amergence Group).
Neither First4Internet nor SunnComm had a substantial security-engineering track record, and the public record indicates Sony BMG did not subject either product to the kind of independent security review that a kernel-mode software component installed on tens of millions of consumer machines would warrant. A November 30, 2005 Freedom to Tinker report — based on internal correspondence that surfaced after disclosure — found that Sony and First4Internet had been aware of "issues" with the rootkit-style cloaking mechanism well before the October 2005 public disclosure, without escalating it as a security concern (Freedom to Tinker/CITP, Nov 30 2005). The sole "consent" mechanism for either DRM system was a clickthrough End User License Agreement — a document few consumers read, and one that, per Sony BMG's own later lawsuit against SunnComm, MediaMax did not fully honor: the background monitoring process installed regardless of whether the user accepted or declined the EULA.
The technical vector these products relied on was itself a default-on Windows feature: AutoRun, enabled by default on Windows XP for optical media, which silently launched each disc's installer the moment it was inserted. Combined with a lack of code-signing scrutiny for kernel drivers at the time and an antivirus industry that implicitly trusted software distributed by major commercial vendors, the conditions were in place for cloaking software to run undetected at scale for months before independent research — rather than any vendor telemetry — surfaced it.
$sys$filesystem directory), then hooked NtQueryDirectoryFile so that Explorer, Task Manager, and most contemporary antivirus scanners could no longer see anything with that prefix (Mark Russinovich, Sysinternals Blog, Oct 31 & Nov 4, 2005; Virus Bulletin, "Inside Sony's Rootkit," Dec 2005). On titles carrying MediaMax instead, SunnComm's software installed a background process irrespective of whether the user accepted or declined the EULA — a point Sony BMG itself later alleged in a 2007 suit against SunnComm (iTnews, "Sony BMG sues DRM software supplier"). No telemetry, alerting, or user notification accompanied any of this.| Type | Value / Description | Source | Date |
|---|---|---|---|
| FILE PATH | %WINDIR%\System32\$sys$filesystem\ (and other "$sys$"-prefixed component paths — exact names varied by release build) | Mark Russinovich, Sysinternals Blog | 2005-10-31 |
| REGISTRY | HKLM\SYSTEM\CurrentControlSet\Services\$sys$<driver/service name> (naming pattern; exact key names varied by title) | Virus Bulletin, "Inside Sony's Rootkit" | 2005-12 |
| DRIVER | Kernel-mode filter driver hooking NtQueryDirectoryFile (component file names varied by release build) | Halderman & Felten, USENIX Sec 2006 | 2006 |
| MALWARE NAME | Backdoor:W32/Breplibot.C (aka Ryknos, Stinx-E) | F-Secure v-descs | 2005-11-10 |
| NAMING PATTERN | Any process/file/registry object prefixed "$sys$" — automatically cloaked on infected hosts | Mark Russinovich, Sysinternals Blog | 2005-11-04 |
| NOTE | No IP or domain C2 indicators for Breplibot/Ryknos' IRC backdoor infrastructure were identified in the public reporting reviewed for this card; contemporaneous vendor write-ups described the mechanism without publishing specific network indicators. Flagged as a genuine sourcing gap rather than omitted. | ||
This case file has no "threat actor" in the conventional CTI sense of an adversarial group pursuing a campaign. The rootkit-class capability at the center of the incident was vendor-embedded: designed and coded by First4Internet (XCP) and SunnComm (MediaMax), and distributed at scale by Sony BMG as a commercial copy-protection mechanism. Confidence in this identity chain is [HIGH] — it rests on public corporate record, contemporaneous investigative reporting, and Sony BMG's own admissions embedded in its FTC consent order and its later lawsuit against SunnComm.
Separately, the malware that weaponized the rootkit's cloaking mechanism — Breplibot/Ryknos — was authored by unknown, financially or criminally motivated individual(s) with no established connection to Sony BMG, First4Internet, or SunnComm. Reported arrests in a related case in mid-2006 have not been confirmed by this desk as tied specifically to that malware family; this line is treated as [UNATTRIBUTED] pending a primary source that closes the gap.
The Sony BMG XCP scandal was the first mass-scale demonstration that a major commercial vendor would ship literal rootkit tradecraft — kernel-level API hooking to conceal files, processes, and registry keys — to enforce commercial policy against ordinary consumers. It permanently collapsed the assumption that the mere presence of rootkit-class cloaking implied malicious intent, forcing the antivirus industry toward behavior-based detection rather than provenance-based trust: after 2005, "who shipped it" stopped being a sufficient reason to exempt software from rootkit scanning.
It directly produced the first Federal Trade Commission enforcement precedent treating undisclosed, security-degrading consumer software installation as an unfair trade practice — a legal template regulators and litigants have referenced in later software-consent enforcement actions — and was the first case brought under a then-brand-new state anti-spyware statute (Texas, 2005). J. Alex Halderman and Edward Felten's academic teardown, presented at the 15th USENIX Security Symposium in 2006, remains a widely taught methodological reference for how to conduct rigorous, public-interest security analysis of consumer software under legal and commercial pressure.
Structurally, the incident previews the shape of later software-supply-chain compromises: a widely trusted distributor (Sony BMG) shipping an externally-sourced, under-scrutinized component (from small vendors most of the organization had limited technical insight into) that carried unreviewed, security-relevant capability at scale — immediately weaponized by unrelated criminal actors once the flaw became public. It differs from incidents like SolarWinds or XZ Utils in one crucial respect: there was no deliberate adversarial intent at the point of origin, only negligence — which is precisely why it remains the canonical case study for "vendor negligence" as its own distinct incident category, separate from both nation-state supply-chain compromise and conventional malware campaigns.