Elderwood
- ID
- G0066
- Associated names
- Elderwood Gang, Beijing Group, Sneaky Panda
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
Elderwood is a suspected Chinese cyber espionage group that was reportedly responsible for the 2009 Google intrusion known as Operation Aurora. [1] The group has targeted defense organizations, supply chain manufacturers, human rights and nongovernmental organizations (NGOs), and IT service providers. [2] [3]
Techniques used (9)
- T1027.002 Software Packing
- T1027.013 Encrypted/Encoded File
- T1105 Ingress Tool Transfer
- T1189 Drive-by Compromise
- T1203 Exploitation for Client Execution
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
Software used (9)
- S0012 PoisonIvy
- S0203 Hydraq
- S0204 Briba
- S0205 Naid
- S0206 Wiarp
- S0207 Vasport
- S0208 Pasam
- S0210 Nerex
- S0211 Linfo