Dmitri Alperovitch

Early Life and Immigration

Dmitri Alperovitch was born in 1980 in Moscow, in the Russian Soviet Federative Socialist Republic. He immigrated to the United States with his family at age 13, in 1994, and the family settled in Chattanooga, Tennessee. He later became a naturalized U.S. citizen.

Georgia Tech

Alperovitch studied at the Georgia Institute of Technology, earning a B.S. in computer science in 2001 and an M.S. in information security in 2003, one of the first graduate degrees the school awarded in that field.

Early Career

Alperovitch worked at CipherTrust, where he was a lead inventor of the TrustedSource reputation system used to detect spam and malicious traffic, and continued that work at Secure Computing after it acquired CipherTrust in 2006. He then joined McAfee, where he became vice president of threat research and led the company's global Internet threat intelligence analysis.

Operation Aurora

In January 2010, Google disclosed that it and more than twenty other companies had been targeted by a sophisticated intrusion campaign originating from China, aimed at intellectual property including source code. While at McAfee, Alperovitch led the technical investigation and gave the campaign the name "Operation Aurora," after a folder name, "Aurora," that McAfee researchers found embedded in the attackers' malware.

Night Dragon

In February 2011, McAfee published "Night Dragon," a report Alperovitch co-authored describing a multi-year espionage campaign against global oil, energy, and petrochemical companies. The report traced the intrusions, which targeted proprietary operational and financial data, to actors operating from China.

Operation Shady RAT

In August 2011, Alperovitch published "Revealed: Operation Shady RAT," a McAfee report analyzing five years of log data from a single command-and-control server. The report documented intrusions into more than 70 government agencies, corporations, and organizations across 14 countries, and argued that the intrusions represented a sustained, coordinated campaign of intellectual-property theft rather than isolated incidents.

Founding CrowdStrike

In late 2011, Alperovitch co-founded CrowdStrike with George Kurtz and Gregg Marston, serving as chief technology officer. CrowdStrike positioned itself around proactive threat intelligence and attribution, tracking the specific groups behind intrusions rather than only their malware, and assigning them the animal-based naming convention (such as "Bear" for Russia-linked actors and "Panda" for China-linked actors) that became widely used across the industry.

The DNC Breach and Attribution to Russia

In June 2016, CrowdStrike was called in to investigate a breach of the Democratic National Committee's network. In a June 14, 2016 blog post, Alperovitch disclosed that CrowdStrike had found two separate Russian intelligence-affiliated intrusions: COZY BEAR, present in the network since at least summer 2015, and FANCY BEAR, which had gained access in April 2016. CrowdStrike assessed COZY BEAR as likely linked to Russia's FSB with lower confidence and FANCY BEAR as likely linked to Russia's GRU military intelligence agency with medium confidence. The finding was corroborated by other security firms and later validated by the U.S. intelligence community's January 2017 assessment and by the Senate Intelligence Committee's 2020 report on Russian interference in the 2016 election. The attribution and its role in a presidential election made Alperovitch and CrowdStrike a recurring subject of political controversy, including unsubstantiated claims later made by President Trump about the company and the breach.

Departure from CrowdStrike

Alperovitch stepped down as CrowdStrike's chief technology officer in February 2020, several months after the company's June 2019 initial public offering on the Nasdaq. Michael Sentonas succeeded him as CTO.

Silverado Policy Accelerator and Current Work

Alperovitch co-founded the Silverado Policy Accelerator, a nonpartisan think tank focused on geopolitics and technology policy, which launched in 2019 and publicly relaunched in 2021; he serves as its chairman and co-founder. He also founded the Alperovitch Institute for Cybersecurity Studies at Johns Hopkins University's School of Advanced International Studies and has advised the U.S. Department of Defense and Department of Homeland Security. In 2024 he co-authored, with Garrett Graff, "World on the Brink: How America Can Beat China in the Race for the Twenty-First Century."

Impact and Legacy

Alperovitch's investigations of Operation Aurora, Night Dragon, and Shady RAT helped establish state-sponsored economic espionage as a documented, named category of cyberattack rather than an abstract concern, and his work at CrowdStrike helped popularize public attribution as a tool of both corporate incident response and government policy. The DNC investigation placed threat-intelligence findings at the center of a national political controversy, illustrating both the influence and the contested nature of private-sector attribution of nation-state hacking.

Timeline

• 1980Born in Moscow, in the Russian Soviet Federative Socialist Republic.
• 1994Immigrated to the United States at age 13; the family settled in Chattanooga, Tennessee.
• 2001Earned a B.S. in computer science from the Georgia Institute of Technology, followed by an M.S. in information security in 2003.
• 2010-01Led the McAfee investigation into the China-linked intrusion campaign against Google and other companies, naming it 'Operation Aurora.'
• 2011-02Co-authored McAfee's 'Night Dragon' report on espionage against global energy and petrochemical companies.
• 2011-08Published 'Revealed: Operation Shady RAT,' documenting a five-year intrusion campaign against more than 70 organizations.
• 2011Co-founded CrowdStrike with George Kurtz and Gregg Marston, becoming chief technology officer.
• 2016-06-14Published CrowdStrike's attribution of the DNC breach to two Russian intelligence-linked groups, COZY BEAR and FANCY BEAR.
• 2020-02Stepped down as CrowdStrike's chief technology officer.
• 2021Publicly launched the Silverado Policy Accelerator, a geopolitics and technology policy think tank, as co-founder and chairman.
• 2024-04Co-authored 'World on the Brink: How America Can Beat China in the Race for the Twenty-First Century' with Garrett Graff.