Loading story…
Google disclosed that a highly coordinated intrusion targeted its corporate network and the Gmail accounts of Chinese human rights advocates, and investigators said the same campaign hit at least 30 to 34 other organizations across the technology, defense, finance, and research sectors, including Adobe, Yahoo, Symantec, Northrop Grumman, and Dow Chemical. Security reporting tied the operation—widely known as Operation Aurora—to spear-phishing and exploitation of a previously unknown Microsoft Internet Explorer flaw, with attackers then moving laterally through victim environments using techniques such as malicious email access. Researchers also identified command-and-control infrastructure used to manage the malware, while later investigations traced activity through servers in Taiwan to computers associated with Shanghai Jiaotong University and Lanxiang Vocational School, though analysts cautioned that those systems may have been intermediaries rather than definitive proof of attribution.
Subsequent U.S. reporting said the attackers reached a sensitive Google database containing years of lawful surveillance-order records, including classified FISA information, suggesting a counterintelligence objective beyond theft of source code, trade secrets, and activist communications. The breach prompted FBI and Justice Department scrutiny, briefings for senior U.S. officials, and public warnings from France and Germany to avoid Internet Explorer after the exploit became widely weaponized in drive-by attacks and added to Metasploit. Google said the attack originated from China and threatened to reconsider its China operations, while outside experts and intelligence-linked investigators assessed that the campaign was likely conducted by Chinese state actors or proxies, a claim Beijing denied.
TTPs, infrastructure, and targeting history in one profile.
10 events from the most recent confirmed update back to the earliest known activity.
U.S. officials disclosed that the 2009 Google breach also reached a sensitive internal database containing years of lawful surveillance requests, including classified FISA orders. The revelation intensified concern in Washington, prompted FBI and Justice Department scrutiny, and highlighted a possible counterintelligence motive.
Investigators reported that systems involved in the attacks were traced beyond Taiwan to computers at Shanghai Jiaotong University and Lanxiang Vocational School in China. Analysts cautioned that the schools' role was uncertain and could reflect direct involvement, camouflage, or false-flag use.
By January 19, 2010, attackers were using the same unpatched Internet Explorer vulnerability in drive-by attacks, and exploit code had been added to the Metasploit framework. Security researchers warned that public weaponization of the flaw sharply increased the risk beyond the original targeted intrusions.
A report said investigators were examining whether insiders in Google's China operations may have helped facilitate the attack. This introduced a new line of inquiry into how the intruders may have gained access.
After the Internet Explorer flaw tied to the Google attacks became public, French and German government security agencies advised users to stop using Internet Explorer and switch to alternative browsers until a fix was available. Microsoft said observed attacks were limited and mainly affected IE6.
VeriSign's iDefense released technical details on the attack, including command-and-control servers and an assessment that the operation was likely conducted by the Chinese government or proxies. It initially said malicious PDFs were involved, but that specific claim was later retracted after Adobe disputed it and McAfee pointed to an Internet Explorer exploit instead.
Reporting on the campaign said at least 34 organizations were targeted, including firms such as Yahoo, Symantec, Adobe, Northrop Grumman, and Dow Chemical, along with research institutions and human rights groups. Experts described the operation as unusually sophisticated and coordinated.
Google announced that it had been targeted in a highly organized attack originating from China and said the apparent goal included accessing information on political dissidents. The company also said it would no longer censor search results in China and might shut down its China operations.
In late 2009, attackers used spear-phishing and a previously unknown Internet Explorer vulnerability to penetrate Google's corporate network as part of a broader campaign affecting more than 30 other companies. During the intrusion, they also accessed Gmail accounts of Chinese human rights advocates.
Investigators later said the intrusion campaign against Google and dozens of other U.S. organizations may have started as early as April 2009. The operation targeted trade secrets, source code, and Gmail accounts belonging to Chinese human rights activists.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
14 references tracked. Mallory keeps watching after this page renders.
technologyreview.com
Open sourcearstechnica.com
Open sourcewashingtonpost.com
Open sourcecomputerworld.com
Open sourcecnet.com
Open sourcearstechnica.com
Open sourcewashingtonpost.com
Open sourcetheregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google’s Threat Intelligence Group reported an intensifying, state-backed cyber-espionage campaign against **Western defense companies**—particularly across Europe—describing a “constant, multi-vector siege” aimed at stealing sensitive R&D, disrupting production, and gaining insight into next-generation battlefield systems. The report highlights **drone manufacturers and advanced weapons developers** as priority targets, with **Russia-linked activity** emphasized in the context of the war in Ukraine and a focus on unmanned aircraft technologies and their suppliers. Google attributed one phishing campaign to **UNC5976**, which used **malicious Remote Desktop Protocol (RDP) files** and **spoofed domains** impersonating defense firms across multiple countries. Google assessed that multiple state actors—**Russia, Iran, China, and North Korea**—are leveraging a broad set of access paths, including exploitation of **hiring processes**, **personal accounts**, and **remote work** environments, while smaller manufacturers and adjacent suppliers are also seeing **extortion attempts**, indicating widening supply-chain pressure. Separate reporting also described leaked documents indicating China has used a training platform (*Expedition Cloud*, developed by CyberPeace) to rehearse critical-infrastructure intrusions against neighboring countries by building network “templates” of targets and running reconnaissance-to-attack drills, underscoring the operational maturity and preparation that can translate into real-world campaigns against high-value sectors such as defense and critical infrastructure.
Jun 29, 2026
U.S. authorities and researchers are highlighting **China-linked espionage** that increasingly leverages online recruitment and employment channels to access sensitive information. Reporting on recent federal cases describes foreign intelligence services posing as consulting firms, research groups, or recruiters to approach current and former U.S. government personnel—often starting via email or job platforms and escalating through staged interviews, fake websites, and payment offers—to solicit **classified or sensitive information**; multiple Justice Department actions in 2025 reportedly involved such virtual-first recruitment approaches. Separately, a former Google engineer, **Linwei Ding**, was found guilty of **economic espionage and trade secret theft** after prosecutors said he exfiltrated over 2,000 pages of confidential AI supercomputing documents (including TPU/GPU architecture details, orchestration software, SmartNIC networking designs, and internal system configurations) and uploaded them to a personal cloud account while maintaining undisclosed ties to China-based companies and engaging with a Shanghai-sponsored talent program. Broader context from CSIS’ long-running survey of Chinese espionage cases underscores that these incidents fit a sustained pattern since 2000 spanning both **human intelligence** and **cyber-enabled theft** targeting U.S. government and commercial technologies, while noting open-source case lists likely undercount the true scope.
Jun 29, 2026
Multiple reports and leaked documents indicate **China-linked cyber operations** are expanding in scale and sophistication, with a strong emphasis on targeting government, telecommunications, and other strategic sectors. A Forescout *Vedere Labs* analysis cited by Cybernews reported China as the top origin of threat operations last year (210), with Russia and Iran also major contributors; the reporting also highlighted suspected China-linked activity tied to a multi-year compromise of South Korea’s **Onnara System**, including theft of civil servants’ **GPKI certificates and credentials**, and noted Taiwan’s National Security Bureau reporting an average of **2.63 million attacks per day** last year. Separately, leaked technical materials reviewed by Recorded Future News describe a purported Chinese internal training environment—part of an integrated system called **“Expedition Cloud”**—used to rehearse offensive cyberattacks against replicas of neighboring countries’ real-world networks, including **power/energy transmission, transportation, and smart home infrastructure**. In parallel, a Google Threat Intelligence Group report warned of a “relentless barrage” of nation-state activity against the **U.S. defense industrial base**, describing a shift beyond classic espionage into **supply-chain attacks, workforce infiltration, and battlefield-adjacent operations**; Google attributed much of the activity to **Chinese, Russian, Iranian, and North Korean** actors and noted continued Russian targeting of organizations supporting Ukraine, including phishing, malware aimed at mobile battlefield-management apps, and attempts to access encrypted messaging platforms.
Jun 29, 2026