Elderwood

Overview

Elderwood is a suspected Chinese cyber espionage group that was reportedly responsible for the 2009 Google intrusion known as Operation Aurora. The group has targeted defense organizations, supply chain manufacturers, human rights and nongovernmental organizations (NGOs), and IT service providers.

Naming & attribution

Elderwood is tracked under 4 names across the industry. It uses 9 documented ATT&CK techniques — more than 26% of the 174 groups tracked here.

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

• Mofang China — 5 shared techniques (50% overlap)
• Transparent Tribe Pakistan — 7 shared techniques (44% overlap)
• Machete — 5 shared techniques (33% overlap)
• The White Company — 4 shared techniques (33% overlap)
• Andariel North Korea — 5 shared techniques (31% overlap)
• Saint Bear Russia — 6 shared techniques (29% overlap)

Targets

Civil society · Private sector

Regions

Australia · Canada · China · Denmark · Hong Kong · India · Switzerland · Taiwan · United Kingdom · United States

Capabilities

• Exploitation of public-facing / client applications — ATT&CK T1203
• Custom malware/implant development — ATT&CK: 9 attributed custom malware families

TTPs — 9 techniques across 4 tactics

Tools & malware (9)

PoisonIvy · Naid · Briba · Hydraq · Linfo · Nerex · Vasport · Wiarp · Pasam

Reporting (3)

• Stealing US business secrets: Experts ID two huge cyber 'gangs' in China — Clayton, M.
• Elderwood project, who is behind Op. Aurora and ongoing attacks? — Paganini, P
• The Elderwood Project — O'Gorman, G., and McDonald, G.