Claim

Operation Aurora ASSOCIATED_WITH Elderwood

Security researchers associated the attack with the group later called Elderwood; Symantec derived the name from a variable in the malware code.

Episode
EP 19 — Operation Aurora
Origin
Attributed
Confidence
94% (extractor score, not a fact score)
Speaker
Jack Rhysider
Attributed source
Symantec

Transcript evidence

“When Symantec investigated the malware further they found the code frequently used a variable with the name Elderwood so they called this hacking group Elderwood”

Jack Rhysider · offsets 19016–19177

Read the official transcript

Extraction provenance

Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T04:14:52.486896+00:00

claim:ep019:6225cfeabd80