Loading threat actor…
Titan Rain is the codename used by U.S. officials for a series of Chinese cyber intrusions publicly associated with activity against U.S. government and defense-related networks in the mid-2000s. Reporting on the campaign linked it to Chinese hackers, with some officials and analysts alleging ties to the People's Liberation Army. The activity was characterized as a sustained espionage-oriented effort directed notably at the Pentagon and other U.S. government departments, and was also discussed in connection with intrusions affecting British government networks and German government systems. Victims publicly associated with Titan Rain included U.S. Department of Defense networks, defense contractors, and military and defense support organizations. The campaign was also linked in public reporting to attacks on British government departments, including the Foreign Office and other Whitehall entities, as well as an organized intrusion affecting part of the House of Commons network. Contemporary accounts described the operations as persistent and strategically focused on sensitive government and defense targets. At a high level, Titan Rain is associated with unauthorized network penetration and follow-on access to sensitive systems, consistent with cyber espionage operations against government and military institutions. Public reporting emphasized intrusion into email and departmental networks rather than disruptive or destructive effects, and officials stated that at least some incidents caused administrative disruption without operational impact. China denied responsibility for the activity.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
China-attributed cyber-espionage operation targeting U.S. Department of Defense networks and U.S. defense contractors to steal sensitive military information.
Named intrusion campaign targeting U.S. DoD networks and U.S. defense contractors for large-scale espionage and data theft.
Named intrusion campaign targeting U.S. DoD networks and U.S. defense contractors, involving large-scale network compromise and data theft (espionage).
Cyber-espionage activity cluster attributed to China targeting U.S. Department of Defense networks and U.S. defense contractors to steal sensitive military information.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.