Elderwood
IntrusionSet · ATTACK:enterprise:G0066
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G0066",
"title": "Elderwood",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G0066",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--03506554-5f37-4f8f-9ce4-0e9f01a1b484",
"external_id": "G0066",
"domain": "enterprise",
"created": "2018-04-18T17:59:24.739Z",
"modified": "2026-07-31T18:47:35.392Z",
"version": "1.3",
"aliases": [
"Elderwood",
"Elderwood Gang",
"Beijing Group",
"Sneaky Panda"
],
"tactics": [
],
"source_references": [
{
"source_name": "Beijing Group"
},
{
"source_name": "Sneaky Panda"
},
{
"source_name": "Elderwood"
},
{
"source_name": "Elderwood Gang"
},
{
"source_name": "CSM Elderwood Sept 2012",
"url": "https://www.csmonitor.com/USA/2012/0914/Stealing-US-business-secrets-Experts-ID-two-huge-cyber-gangs-in-China"
},
{
"source_name": "Symantec Elderwood Sept 2012",
"url": "https://web.archive.org/web/20190717233006/http:/www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-elderwood-project.pdf"
},
{
"source_name": "Security Affairs Elderwood Sept 2012",
"url": "http://securityaffairs.co/wordpress/8528/hacking/elderwood-project-who-is-behind-op-aurora-and-ongoing-attacks.html"
}
]
}Explicit source assertions (18)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0066 → uses → ATTACK:enterprise:S0012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--003f23dd-24c7-4b3b-b703-0bf081d638f4
Symantec Elderwood Sept 2012ATTACK:enterprise:G0066 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0c81e49d-53be-4fba-9a07-ec2fe5501267
Symantec Elderwood Sept 2012ATTACK:enterprise:G0066 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1262d88d-0eb1-4d19-b84a-9793ef3e4d03
CSM Elderwood Sept 2012 · Symantec Elderwood Sept 2012ATTACK:enterprise:G0066 → uses → ATTACK:enterprise:S0205
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--13c8251c-f380-425c-b762-2298e5802dee
Symantec Elderwood Sept 2012ATTACK:enterprise:G0066 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2003aaad-7b87-461d-b17f-b19100069ad9
CSM Elderwood Sept 2012 · Symantec Elderwood Sept 2012ATTACK:enterprise:G0066 → uses → ATTACK:enterprise:S0204
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2d20e20c-7f01-4834-88de-030ca09ee540
Symantec Elderwood Sept 2012ATTACK:enterprise:G0066 → uses → ATTACK:enterprise:S0203
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4a851ebf-c021-4ab1-a02f-84b03d65fdda
Symantec Elderwood Sept 2012ATTACK:enterprise:G0066 → uses → ATTACK:enterprise:S0211
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--50cc59f8-6d62-4140-b5c6-40da528a5e13
Symantec Elderwood Sept 2012ATTACK:enterprise:G0066 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--537d027b-0559-4d1a-8f28-a918d3d23e63
CSM Elderwood Sept 2012 · Symantec Elderwood Sept 2012ATTACK:enterprise:G0066 → uses → ATTACK:enterprise:S0210
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5406867b-20fe-43e3-bd64-6816ba340b60
Symantec Elderwood Sept 2012ATTACK:enterprise:G0066 → uses → ATTACK:enterprise:S0207
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--77426812-954b-49dd-9db8-c3aa99113678
Symantec Elderwood Sept 2012ATTACK:enterprise:G0066 → uses → ATTACK:enterprise:T1204.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--89672463-a201-43c7-a24a-1e6d7a1a188a
CSM Elderwood Sept 2012 · Symantec Elderwood Sept 2012ATTACK:enterprise:G0066 → uses → ATTACK:enterprise:T1189
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--91b22928-d538-4460-a5ff-7a0a5e797430
CSM Elderwood Sept 2012 · Symantec Elderwood Sept 2012 · Security Affairs Elderwood Sept 2012ATTACK:enterprise:G0066 → uses → ATTACK:enterprise:S0206
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--949c94e6-7c2f-4605-957f-11b7cd5a6097
Symantec Elderwood Sept 2012ATTACK:enterprise:G0066 → uses → ATTACK:enterprise:T1203
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e1269d18-6cc9-45cc-9c99-06f765bea366
Symantec Elderwood Sept 2012ATTACK:enterprise:G0066 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f0ef3f47-5651-4638-a007-cb585d3174b0
Symantec Ristol May 2012ATTACK:enterprise:G0066 → uses → ATTACK:enterprise:S0208
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f718c8ae-859f-4987-bf8c-9fac91a610bf
Symantec Elderwood Sept 2012ATTACK:enterprise:G0066 → uses → ATTACK:enterprise:T1027.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f8c27264-e42d-48fd-9a18-4b275383f155
Symantec Elderwood Sept 2012