G00667 cited sources

Elderwood

Also tracked as Elderwood Gang, Beijing Group, Sneaky Panda

Techniques Mapped9

Tools & Malware9

Campaigns TrackedNone published

Last Updated (MITRE)Jul 31, 2026

Description (MITRE ATT&CK)

Elderwood is a suspected Chinese cyber espionage group that was reportedly responsible for the 2009 Google intrusion known as Operation Aurora. The group has targeted defense organizations, supply chain manufacturers, human rights and nongovernmental organizations (NGOs), and IT service providers.

Known Techniques by Tactic

Execution (3)

Initial Access (3)

Stealth (2)

Associated Tools & Malware

PoisonIvy (malware)Naid (malware)Briba (malware)Hydraq (malware)Linfo (malware)Nerex (malware)Vasport (malware)Wiarp (malware)Pasam (malware)

Seraph Context

Organisational Relevance

Shown when this actor's known techniques match your monitored environment.

Exploited CVE Correlation

Surfaced when a technique used by this actor maps to a tracked CISA KEV entry.

Sector & Regional Signal

Derived from MITRE's own published description text, never asserted beyond it.

Watchlist

Signed-in customers can track this actor and be notified of profile updates.

Is this actor relevant to your environment?

Match this actor's known techniques against the technologies you run inside Seraph CTI, and get notified if their profile changes.

Explore Seraph CTI Back to Threat Actors