Operation Aurora

What happened

In early 2010, Google publicly announced that it, along with at least 20 other major companies, had been the victim of a highly sophisticated and targeted cyberattack originating from China. The attackers exploited a zero-day vulnerability in Internet Explorer to gain access to corporate networks and exfiltrate intellectual property, source code, and potentially information on Chinese human rights activists.

Technical mechanism

The attackers used spear-phishing emails to direct victims to a malicious website containing an Internet Explorer zero-day exploit (CVE-2010-0249). Upon successful exploitation, malware was downloaded to establish a backdoor, allowing the attackers to move laterally and exfiltrate data.

Why it matters

The attack marked a turning point in public disclosure of state-sponsored corporate espionage and highlighted the reality of Advanced Persistent Threats (APTs) targeting intellectual property.

Impact

Intellectual property and source code were stolen from numerous major corporations across various sectors. The incident strained US-China relations and prompted Google to reconsider its business operations in China.

Response

Google publicly disclosed the attack, patched vulnerabilities, and enhanced its security infrastructure. Microsoft released an out-of-band patch for the IE vulnerability. The US government formally protested to China.

Defensive lessons

• Need for defense-in-depth strategies beyond perimeter security.
• Importance of rapid patching and vulnerability management.
• Necessity of robust monitoring for lateral movement and data exfiltration.

Evidence register

1. Google — A new approach to China (verified)