Operation Aurora

Background

Operation Aurora refers to a series of cyberattacks conducted against Google and more than thirty other major companies, beginning around mid-2009 and continuing through December 2009. The campaign targeted companies across sectors including technology, defense, finance, and chemicals, with confirmed or reported victims including Google, Adobe Systems, Juniper Networks, Rackspace, Akamai Technologies, Yahoo, Symantec, Northrop Grumman, Morgan Stanley, and Dow Chemical. The attackers' primary objective appeared to be access to intellectual property and source code repositories, described by investigators as "the crown jewels" of the targeted firms.

Disclosure

On January 12, 2010, Google published a blog post titled "A new approach to China," publicly disclosing that it had detected a "highly sophisticated and targeted attack on our corporate infrastructure originating from China." Google stated that the primary goal of the attackers appeared to be accessing the Gmail accounts of Chinese human rights activists, though only two accounts appeared to have been accessed, and that limited information (such as subject lines and account creation dates) rather than message content had been exposed in most other cases investigated. The disclosure was notable because Google chose to name China as the attack's origin and to make the intrusion public rather than resolve it quietly, a departure from typical corporate practice at the time.

Technical Details

The attackers exploited a previously unknown (zero-day) vulnerability in Microsoft Internet Explorer, affecting versions 6, 7, and 8 across multiple Windows releases. Victims were compromised via spear-phishing and "watering hole"-style techniques that led targeted employees to malicious websites, which then delivered malware including a backdoor commonly identified as Hydraq (also tracked as Trojan.Hydraq). Investigators, including researchers at McAfee, also found that a separate flaw in the Perforce source code revision control software used by some victim organizations aided the attackers in reaching source code repositories. Command-and-control traffic was disguised to resemble encrypted SSL connections and routed through servers located in Illinois, Texas, and Taiwan, including compromised accounts on Rackspace's hosting infrastructure. Microsoft issued an out-of-cycle security advisory and, on January 21, 2010, released a patch addressing the Internet Explorer vulnerability.

Naming and Attribution

The operation's name, "Aurora," originated with McAfee researchers Dmitri Alperovitch and George Kurtz, who found the string "Aurora" in a file path within the attackers' malware and concluded it was the intruders' own internal designation for the operation. Security researchers, including analysts at McAfee, Symantec, and VeriSign's iDefense Labs, along with reporting based on U.S. diplomatic cables later released via WikiLeaks, attributed the campaign to China-based actors, with some evidence pointing toward state or state-tolerated involvement. The threat group behind the intrusions was later tracked by security researchers under names including the "Elderwood Group" and, in industry APT-numbering schemes, associated with APT17-style tracking designations. Chinese officials denied government involvement in the attacks.

Consequences and Legacy

In its January 2010 announcement, Google stated it was no longer willing to continue censoring search results on Google.cn and indicated it might have to shut down its China operations and offices entirely, a decision the company framed as directly connected to the attack and to broader concerns about free expression and human rights in China. In March 2010, Google began redirecting mainland Chinese search traffic to its uncensored Hong Kong-based search service. The incident also prompted U.S. government attention, including a statement from then-Secretary of State Hillary Clinton calling on China to explain the intrusions, and contributed to a broader diplomatic and policy debate over state-sponsored cyberespionage. Operation Aurora is widely cited by security researchers and historians as a landmark case that popularized the term "advanced persistent threat" in public discourse and demonstrated how targeted intrusions against private companies could carry direct geopolitical consequences.

Timeline

• 2009-06Attackers reportedly begin the intrusion campaign later named Operation Aurora, targeting Google and dozens of other companies.
• 2009-12Active exploitation and data exfiltration activity attributed to the campaign continues into December 2009.
• 2010-01-12Google publishes "A new approach to China," publicly disclosing the attack and announcing it may stop censoring Google.cn search results.
• 2010-01-14McAfee researchers publicly name the campaign "Operation Aurora" after a string found in the attackers' malware, and Microsoft issues a security advisory on the exploited Internet Explorer vulnerability.
• 2010-01-21Microsoft releases an out-of-cycle security patch fixing the Internet Explorer zero-day used in the attacks.
• 2010-03Google begins redirecting mainland Chinese search traffic to its uncensored Hong Kong search service, effectively ending on-shore search censorship.