Beijing Group· China

Beijing Group (SNEAKY PANDA) is a China-based APT known for geopolitical cyber espionage.

Analyst brief

Beijing Group (also known as Elderwood, SNEAKY PANDA) is a China-based APT group focused on geopolitical cyber espionage. The actor primarily targets defense organizations, supply chain manufacturers, IT service providers, human rights groups, and NGOs in the US, Canada, Taiwan, UK, India, Australia, and other regions. It relies on Spearphishing Attachment or Link for initial access, executes payloads via Malicious Link or File, and uses Ingress Tool Transfer for C2 communication, leveraging custom malware families like PoisonIvy, Hydraq, Briba, and others. Defenders should enhance email-borne threat detection for targeted phishing, monitor network traffic for indicators of known RATs such as PoisonIvy, and remain vigilant for legacy TTPs tied to operations like the 2009 Aurora campaign.

Beijing Group

SNEAKY PANDAElderwoodElderwood Gang

nation-state

Elderwood is a suspected Chinese cyber espionage group that was reportedly responsible for the 2009 Google intrusion known as Operation Aurora. The group has targeted defense organizations, supply chain manufacturers, human rights and nongovernmental organizations (NGOs), and IT service providers.

origin (suspected)

China· state-sponsoredattribution confidence: medium (50)

target countries (as stated by the source)

United StatesCanadaUnited KingdomSwitzerland

target sectors

Private sectorCivil society

techniques · ATT&CK

Spearphishing Attachment Spearphishing Link Malicious Link Malicious File Software Packing Encrypted/Encoded File Ingress Tool Transfer

malware

PoisonIvy Naid Briba Hydraq Linfo Nerex+3

source: misp-galaxy + mitre-attackG0066 7 refs →

Kill-chain playbook4

01
initial-access
T1566.001 T1566.002
Implement user education and email filtering against suspicious spearphishing attachments and links.
02
execution
T1204.001 T1204.002
Restrict user permissions and utilize endpoint security to prevent execution of malicious links and files.
03
stealth
T1027.002 T1027.013
Monitor network traffic and endpoint logs for suspicious activities, particularly focusing on Software Packing and encrypted files.
04
command-and-control
T1105
Utilize network traffic monitoring and restrictive firewall rules to detect and prevent suspicious Ingress Tool Transfer activities.

FAQ2

What malware does Beijing Group use?

This APT group uses custom malware families like PoisonIvy, Hydraq, and Briba, including RATs.

What technique does Beijing Group primarily use for initial access?

It uses Spearphishing Attachment or Link techniques for initial access.

Beijing Group· China

Analyst brief

Beijing Group

Kill-chain playbook4

initial-access

execution

stealth

command-and-control

FAQ2

See also6

Beijing Group· China

Analyst brief

Beijing Group

Kill-chain playbook4

initial-access

execution

stealth

command-and-control

FAQ2

See also6