Wilderness of Mirrors: Operation Aurora

A series of cyber attacks from China that targeted U.S. private sectors in 2010.

  • Date Reported: January 2010

  • Type of Incident: Espionage

  • Suspected Victims: Google, Rackspace, Yahoo, Adobe, Northtrop Grumman, Morgan Stanley Symantec, Juniper Networks, Dow Chemical

  • Suspected State Sponsor: China

  • Affiliations: Believed to be the work of PLA Unit 61398, and with possible assistance from Sneaky Panda, and believed to be associated with Winnti Umbrella.

On the 14th of January in 2010 McAfee Labs identified a zero day vulnerability in Microsoft’s Internet Explorer that had been used as an entry point for “Operation Aurora” to exploit over 30 companies, one of which was Google. They were actually the only company at the time that confirmed they were a victim. Google even confirmed to the public that the Gmail accounts of certain Chinese human rights activists had been compromised.

These cyber attacks were conducted by APTs (Advanced Persistent Threats) such as the Elderwood Group based in Beijing China, which has ties to the People’s Liberatio Army. The attacks began in Mid-2009 and continued through December 2009.

“the threat actors used a phishing campaign (spear-phishing to be precise) to compromise the network of large american businesses to steal their trade secrets.”

According to McAfee the main goal of the attack was to gain access to and possibly alter the source code repositories at these large American companies. Many companies were unwilling to attribute Operation Aurora to China, something Google publicly did. It led Google to cease its operations in China, but it does continue to operate a localized version of its search engine in Hong Kong.

“this incident is viewed as a milestone in recent cyber operations history because it raised the profile of cyberops as a tool for industrial espionage.”