Elderwood - G0066

Created: 2018-04-18T17:59:24.739Z

Modified: 2021-03-02T22:40:11.097Z

Contributors: Valerii Marchuk, Cybersecurity Help s.r.o.

Aliases

Elderwood,Elderwood Gang,Beijing Group,Sneaky Panda

Description

Elderwood is a suspected Chinese cyber espionage group that was reportedly responsible for the 2009 Google intrusion known as Operation Aurora. (Citation: Security Affairs Elderwood Sept 2012) The group has targeted defense organizations, supply chain manufacturers, human rights and nongovernmental organizations (NGOs), and IT service providers. (Citation: Symantec Elderwood Sept 2012) (Citation: CSM Elderwood Sept 2012)

Techniques Used

Elderwood has leveraged multiple types of spearphishing in order to attempt to get a user to open links.(Citation: Symantec Elderwood Sept 2012)(Citation: CSM Elderwood Sept 2012)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|

Elderwood has used exploitation of endpoint software, including Microsoft Internet Explorer Adobe Flash vulnerabilities, to gain execution. They have also used zero-day exploits.(Citation: Symantec Elderwood Sept 2012)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|The Ritsol backdoor trojan used by

Elderwood can download files onto a compromised host from a remote location.(Citation: Symantec Ristol May 2012)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1027.002|Software Packing|

Elderwood has packed malware payloads before delivery to victims.(Citation: Symantec Elderwood Sept 2012)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|