Technical evidence including IP addresses, domain names, malware signatures, and other factors, show Elderwood was behind the Operation Aurora attack. The "Elderwood" group was named by Symantec after a source-code variable used by the attackers, and are referred to as the "Beijing Group" by Dell Secureworks.