FORENSIA

THREAT_ACTOR · G0066

Elderwood

Also known as: Elderwood, Elderwood Gang, Beijing Group, Sneaky Panda

Profile

Elderwood is a suspected Chinese cyber espionage group that was reportedly responsible for the 2009 Google intrusion known as Operation Aurora. The group has targeted defense organizations, supply chain manufacturers, human rights and nongovernmental organizations (NGOs), and IT service providers.

MITRE ATT&CK ↗

Techniques

9 ATT&CK techniques attributed to this actor.

T1027.002 Software PackingT1027.013 Encrypted/Encoded FileT1105 Ingress Tool TransferT1189 Drive-by CompromiseT1203 Exploitation for Client ExecutionT1204.001 Malicious LinkT1204.002 Malicious FileT1566.001 Spearphishing AttachmentT1566.002 Spearphishing Link

Software

9 malware/tools attributed to this actor.

PoisonIvyHydraqBribaNaidWiarpVasportPasamNerexLinfo

Related corpus activity

9,329 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to Elderwood.

IndicatorTypeFamilySevSrc
cve-2025-34085cve—851
cve-2026-1969cve—851
cve-2024-1781cve—851
cve-2025-12057cve—851
cve-2016-0638cvephishing851
cve-2026-0740cve—851
cve-2025-0921cve—852
cve-2025-68670cve—852
cve-2021-29441cve—851
cve-2026-3844cve—851
cve-2017-17215cve—852
cve-2022-47945cve—851
cve-2025-7852cve—851
cve-2025-7443cve—851
cve-2025-23304cve—852
cve-2025-66478cve—852
cve-2026-22584cve—852
cve-2021-27076cve—851
cve-2018-8007cve—851
cve-2026-3102cve—853
50ebf107d522326c9a9db8821fe3263aa5136964faaf5dd183657bbb52725f84sha256phishing802
873f1277a42de5c82f869459e7fb7c94554a642bhash—803
5115277eabf2d22d49dcef1e155874387d8e783853bd86debf7ff58588aae35dsha256phishing802
b8eed63ab9cbdca494f26a6f66bfd4a0a693b3f0hash—803
44a4ac119349f525d877728b53fe38453a516881d577679caf08ab69312a695fsha256phishing802
c2eb1033bc01ab0fd732a7ba4967be02c0690bf0hash—802
123e80a34508c4dede7cc70e76931fcchash—803
82e579bd49d69845133c9aa8585f8bd26736437bhash—802
625b6535321d58bb5c613e85332bf731hash—803
7105caa6d4fd8a2c67523d385277528e556ae4f6hash—802

Showing the top 30 by severity of 9,329.