Elderwood
Elderwood is a suspected Chinese cyber espionage group that was reportedly responsible for the 2009 Google intrusion known as Operation Aurora. [1] The group has targeted defense organizations, supply chain manufacturers, human rights and nongovernmental organizations (NGOs), and IT service providers. [2] [3]
Associated Group Descriptions
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1189 | Drive-by Compromise |
Elderwood has delivered zero-day exploits and malware to victims by injecting malicious code into specific public Web pages visited by targets within a particular sector.[2][3][1] |
|
| Enterprise | T1203 | Exploitation for Client Execution |
Elderwood has used exploitation of endpoint software, including Microsoft Internet Explorer Adobe Flash vulnerabilities, to gain execution. They have also used zero-day exploits.[2] |
|
| Enterprise | T1105 | Ingress Tool Transfer |
The Ritsol backdoor trojan used by Elderwood can download files onto a compromised host from a remote location.[4] |
|
| Enterprise | T1027 | .002 | Obfuscated Files or Information: Software Packing |
Elderwood has packed malware payloads before delivery to victims.[2] |
| .013 | Obfuscated Files or Information: Encrypted/Encoded File |
Elderwood has encrypted documents and malicious executables.[2] |
||
| Enterprise | T1566 | .001 | Phishing: Spearphishing Attachment |
Elderwood has delivered zero-day exploits and malware to victims via targeted emails containing malicious attachments.[2][3] |
| .002 | Phishing: Spearphishing Link |
Elderwood has delivered zero-day exploits and malware to victims via targeted emails containing a link to malicious content hosted on an uncommon Web server.[2][3] |
||
| Enterprise | T1204 | .001 | User Execution: Malicious Link |
Elderwood has leveraged multiple types of spearphishing in order to attempt to get a user to open links.[2][3] |
| .002 | User Execution: Malicious File |
Elderwood has leveraged multiple types of spearphishing in order to attempt to get a user to open attachments.[2][3] |
||