Introduction
Elderwood is a suspected Chinese cyber espionage group that was reportedly responsible for the 2009 Google intrusion known as Operation Aurora. Security Affairs Elderwood Sept 2012 The group has targeted defense organizations, supply chain manufacturers, human rights and nongovernmental organizations (NGOs), and IT service providers. Symantec Elderwood Sept 2012 CSM Elderwood Sept 2012
Activities and Tactics
Targeted Sectors: Private sector, Civil society
Country of Origin: 🇨🇳 China
Incident Type: Espionage
Suspected Victims: United States, Canada, United Kingdom, Switzerland, Hong Kong, Australia, India, Taiwan, China, Denmark
Notable Campaigns
Information pending cataloguing.
Tactics, Techniques, and Procedures (TTPs)
- T1027.013 Encrypted/Encoded File
- T1204.002 Malicious File
- T1566.002 Spearphishing Link
- T1566.001 Spearphishing Attachment
- T1204.001 Malicious Link
- T1189 Drive-by Compromise
- T1203 Exploitation for Client Execution
- T1105 Ingress Tool Transfer
- T1027.002 Software Packing
ATT&CK technique IDs (denormalized)
Notable Indicators of Compromise (IOCs)
No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.
Malware and Tools
MITRE ATT&CK Software
- PoisonIvy (S0012) — malware
- Naid (S0205) — malware
- Briba (S0204) — malware
- Hydraq (S0203) — malware
- Linfo (S0211) — malware
- Nerex (S0210) — malware
- Vasport (S0207) — malware
- Wiarp (S0206) — malware
- Pasam (S0208) — malware
Attribution and Evidence
Country of Origin: China Additional attribution information pending cataloguing.
References
[1] mitre-attack [6] CSM Elderwood Sept 2012 Clayton, M.. (2012, September 14). Stealing US business secrets: Experts ID two huge cyber ‘gangs’ in China. Retrieved February 15, 2018. [7] Symantec Elderwood Sept 2012 O’Gorman, G., and McDonald, G.. (2012, September 6). The Elderwood Project. Retrieved November 17, 2024. [8] Security Affairs Elderwood Sept 2012 Paganini, P. (2012, September 9). Elderwood project, who is behind Op. Aurora and ongoing attacks?. Retrieved February 13, 2018.