Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Beijing Group · Nation-state · assessed origin China · misp-galaxy + mitre-attack · refreshed 2026-10-06

Beijing Group

  • SNEAKY PANDA
  • Elderwood
  • Elderwood Gang
  • SIG22
  • G0066
  • Sneaky Panda

state sponsor · ChinaMITRE G0066 ↗

Beijing Group — ATT&CK roseBG

attack rose · 9 techniques across 4 tactics

Analyst brief

misp-galaxy + mitre-attack

Elderwood is a suspected Chinese cyber espionage group that was reportedly responsible for the 2009 Google intrusion known as Operation Aurora. The group has targeted defense organizations, supply chain manufacturers, human rights and nongovernmental organizations (NGOs), and IT service providers.

Observed targets (as stated by the sources)

10 countries · 2 sectors
United StatesCanadaUnited KingdomSwitzerlandHong KongAustraliaIndiaTaiwanChinaDenmarkAssessed origin: China

assessed origin · Chinaobserved targets · 10

countries · 10

  • United States
  • Canada
  • United Kingdom
  • Switzerland
  • Hong Kong
  • Australia
  • India
  • Taiwan
  • China
  • Denmark

sectors · 2

  • Private sector
  • Civil society

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

9 techniques · 4 of 15 tactics

  1. Initial access

    3 techniques

  2. Execution

    3 techniques

  3. Stealth

    2 techniques

  4. Command and control

    1 technique

select a technique

Arsenal

9 malware
Malware
Malware · 9ATT&CK
PoisonIvyS0012 ↗
NaidS0205 ↗
BribaS0204 ↗
HydraqS0203 ↗
LinfoS0211 ↗
NerexS0210 ↗
VasportS0207 ↗
WiarpS0206 ↗
PasamS0208 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

Primary-source reports

via APTnotes · linked, never re-hosted
  1. 2012The Elderwood ProjectSymantec ↗

Take it with you

keyless · no signup

References

7 sources
  1. 1.cfr.org/interactive/cyber-operations/sneaky-panda
  2. 2.community.broadcom.com/symantecenterprise/communities/community-home/libraryd…
  3. 3.attack.mitre.org/groups/G0066
  4. 4.attack.mitre.org/groups/G0066
  5. 5.csmonitor.com/USA/2012/0914/Stealing-US-business-secrets-Experts-ID-…
  6. 6.web.archive.org/web/20190717233006/http:/www.symantec.com/content/en/u…
  7. 7.securityaffairs.co/wordpress/8528/hacking/elderwood-project-who-is-behind…

Track Beijing Group on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.