Threat actor
threat_actor:elderwood
Also: Beijing Group, Sneaky Panda
Name used by Symantec and the episode for the hacking group associated with Operation Aurora and later campaigns.
Name used by Symantec and the episode for the hacking group associated with Operation Aurora and later campaigns.
“they called this hacking group Elderwood”
“CrowdStrike came up with a different name which was Sneaky Panda and Del called them the Beijing Group.”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | USES | zero-day exploit | Attributed | 19 |
| outgoing | USES | watering-hole attack | Attributed | 19 |
| outgoing | TARGETS | Lockheed Martin | Uncertain | 19 |
| outgoing | TARGETS | Raytheon | Uncertain | 19 |
| outgoing | TARGETS | Boeing | Uncertain | 19 |
| outgoing | TARGETS | General Dynamics | Uncertain | 19 |
| outgoing | USES | supply-chain compromise | Explicit | 19 |
| outgoing | TARGETS | Amnesty International Hong Kong | Uncertain | 19 |
| incoming | ASSOCIATED_WITH | Operation Aurora | Attributed | 19 |
Operation Aurora ASSOCIATED_WITH Elderwood
Security researchers associated the attack with the group later called Elderwood; Symantec derived the name from a variable in the malware code.
Attributed Confidence 94% · Jack Rhysider EP 19 Details
“When Symantec investigated the malware further they found the code frequently used a variable with the name Elderwood so they called this hacking group Elderwood”
Elderwood USES zero-day exploit
Elderwood was reported to use multiple zero-day exploits in later attack campaigns.
Attributed Confidence 93% · Jack Rhysider EP 19 Details
“In fact, they had five different zero-day exploits for Adobe Flash”
Elderwood USES watering-hole attack
After Operation Aurora, Elderwood changed its initial-entry tactic to watering-hole attacks.
Attributed Confidence 95% · Jack Rhysider EP 19 Details
“Instead of getting people to click the phishing e-mail they used what’s known as a watering-hole attack”
Elderwood TARGETS Lockheed Martin
Elderwood appeared to be primarily interested in gaining access to defense companies including Lockheed Martin.
Uncertain Confidence 88% · Jack Rhysider EP 19 Details
“They seem to be mostly interested in gaining access to defense companies, companies like Lockheed Martin”
Elderwood appeared to be primarily interested in gaining access to defense companies including Raytheon.
Uncertain Confidence 88% · Jack Rhysider EP 19 Details
“companies like Lockheed Martin, Raytheon, Boeing, and General Dynamics”
Elderwood appeared to be primarily interested in gaining access to defense companies including Boeing.
Uncertain Confidence 88% · Jack Rhysider EP 19 Details
“companies like Lockheed Martin, Raytheon, Boeing, and General Dynamics”
Elderwood TARGETS General Dynamics
Elderwood appeared to be primarily interested in gaining access to defense companies including General Dynamics.
Uncertain Confidence 88% · Jack Rhysider EP 19 Details
“companies like Lockheed Martin, Raytheon, Boeing, and General Dynamics”
Elderwood USES supply-chain compromise
Elderwood was described as compromising suppliers and third parties so malicious software could reach defense contractors through the supply chain.
Explicit Confidence 98% · Jack Rhysider EP 19 Details
“if they can infect the supply chain and that software gets into the defense company, then it’s just as good as hacking into the defense company”
Elderwood TARGETS Amnesty International Hong Kong
The same group that was suspected of conducting Operation Aurora was also suspected of placing zero-day Flash exploits on Amnesty International Hong Kong’s website.
Uncertain Confidence 88% · Jack Rhysider EP 19 Details
“It’s suspected that the same group that did Operation Aurora in 2010 were also responsible for placing zero-day Flash exploits on the website for Amnesty International Hong Kong”