GINC Technology
GINC-APT-0197 · State

Elderwood

Also APT 17, Aurora, Beijing Group, APT 17, Deputy Dog, Elderwood, Sneaky Panda, ATK 2, Bronze Keystone and 13 other names.

Category
State · Attributed to a state or working for one.
Origin
China(high confidence)
Sponsor
State-sponsored, Jinan bureau of the Chinese Ministry of State Security
Motivation
Espionage; Information theft and espionage
Seen
2009–2026
Status
Active
ATT&CK
G0066 · 9 techniques
Sources
7 sources carry it
Identifier
GINC-APT-0197 · elderwood

What it is

Elderwood is a suspected Chinese cyber espionage group that was reportedly responsible for the 2009 Google intrusion known as Operation Aurora. The group has targeted defense organizations, supply chain manufacturers, human rights and nongovernmental organizations (NGOs), and IT service providers.

Names

The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.

CrowdStrike
APT 17, Deputy Dog, Elderwood, Sneaky Panda, Sneaky Panda
Mandiant
APT 17, TEMP.Avengers
MITRE ATT&CK
G0066
NSA leak
SIG22
Secureworks
TG-8153
Operations
Operation Aurora, Operation “DeputyDog”, Operation “Ephemeral Hydra”, Operation “RAT Cook”
Other names
Aurora, Beijing Group, ATK 2, Bronze Keystone, Deputy Dog, Dogfish, Elderwood Gang, Tailgater Team

Attribution

Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.

Western sources

Targets

Countries
Australia, Belgium, Canada, China, Denmark, Germany, Hong Kong, India, Indonesia, Italy, Japan, Netherlands, Russia, Switzerland, Taiwan, United Kingdom, United States
Sectors
Civil society, Defense, Education, Energy, Financial, Government, High-Tech, IT, Media, Mining, NGOs, Private sector

Tools

The tools and malware families the sources tie to it.

  • Briba
  • Hydraq
  • Linfo
  • Naid
  • Nerex
  • Pasam
  • PoisonIvy
  • Vasport
  • Wiarp

Sources