Operation Aurora: The Dragon in the Source Code

On January 12, 2010, Google published a blog post that would reorder the relationship between Silicon Valley, Beijing, and Washington for years to come.

It was written in measured corporate language. It described “a highly sophisticated and targeted attack on our corporate infrastructure originating from China.” It confirmed that source code had been stolen. It revealed that the operation’s ultimate objective had been the Gmail accounts of Chinese human rights activists.

And then it did something no tech company had ever done before: it named a nation-state as the attacker. Publicly. By country.

By the time Google’s engineers had traced the intrusion back to its origin, they had discovered they were not alone. Adobe, Juniper Networks, Rackspace, Yahoo, Symantec, Morgan Stanley, Dow Chemical — at least 34 companies across the technology, finance, defense, and energy sectors had been simultaneously compromised. The attackers had been inside some of these networks for months.

Security firm McAfee named the campaign Operation Aurora after a filepath string found in the malware: \Aurora\Aurora\Release\Aurora.pdb. The name was evocative. What it described was not a smash-and-grab raid. It was a strategic intelligence collection program — patient, precise, and aimed at the nerve centers of American technological power.

Threat Actor Profile: The Elderwood Group / Byzantine Hades

Designation: Elderwood Group (Symantec designation); Byzantine Hades (US DoD / USCYBERCOM designation); later overlapping with APT17, APT10, and related clusters in various vendor frameworks
Attribution: Chinese People’s Liberation Army (PLA) / Ministry of State Security (MSS); specific unit attribution debated, with strong indicators pointing to contractors and intelligence units operating under Chinese military and civilian intelligence mandates
Origin: People’s Republic of China; assessed operations centers in Shanghai and Beijing
Primary Mission: Strategic cyber espionage; theft of intellectual property from defense, technology, and aerospace sectors; surveillance of political dissidents and human rights activists; infiltration of foreign government systems
Known Tradecraft: Spear-phishing via instant messaging and email, zero-day weaponization, watering hole attacks, custom RAT (Remote Access Trojan) implants with encrypted C2, long-dwell-time persistence, source code and IP exfiltration

Notorious Operations:

• Operation Aurora (2009–2010): Simultaneous breach of Google, Adobe, and at least 32 other companies via IE zero-day; theft of source code and targeting of dissident Gmail accounts. The operation that gave the Elderwood Group its public profile.
• RSA SecurID Breach (2011): Overlapping Chinese actors compromised RSA Security and stole the seed values behind millions of SecurID hardware tokens — a stepping stone to the defense contractors who relied on them, including Lockheed Martin.
• Lockheed Martin / F-35 Espionage: Chinese actors are assessed to have stolen F-35 Joint Strike Fighter design data, contributing to China’s J-20 and J-31 programs.
• Google China Exit (2010): The direct geopolitical consequence of Aurora. Google announced it would stop censoring search results on Google.cn and ultimately shut down its Chinese search operations — the most high-profile corporate response to a state-sponsored cyberattack in history.

The Target: Inside Google’s Architecture

To understand what the attackers were after, you have to understand what Google had — and what it was willing to protect.

Google in 2010 operated two things of extraordinary value to a Chinese intelligence apparatus.

The first was Gmail infrastructure — specifically, the ability to access any Gmail account. The operation sought accounts belonging to known Chinese dissidents, journalists, and pro-democracy activists. Chinese intelligence wanted to know who they were emailing. Who was warning them about surveillance. Whether they had contacts in foreign intelligence services or governments. In the calculus of authoritarian control, a list of dissident communications is worth more than any trade secret.

The second was Google’s core source code repository — the Perforce version control system hosting the search engine’s foundational algorithms, infrastructure code, and — critically — its security architecture. Compromising the source code could expose vulnerabilities in Google services used by hundreds of millions of people. It could reveal how Google’s systems detected and responded to government surveillance requests. It was the keys to the kingdom.

The attackers got into both.

The Kill Chain: One Zero-Day, Thirty-Four Victims

The initial intrusion vector was elegant in its simplicity. The attackers did not need to break down Google’s perimeter. They needed one engineer to click one link.

A Google employee in China received an instant message. The message appeared to come from a trusted contact. It contained a link. The employee clicked it.

The link resolved to a webpage hosting CVE-2010-0249 — a use-after-free vulnerability in Internet Explorer 6’s JScript engine that had been unknown to Microsoft until McAfee’s disclosure. The flaw was triggered by a specially crafted HTML page that manipulated JScript object references in memory; when the browser freed a JScript object and then attempted to access it again, an attacker-controlled memory address was dereferenced instead.

The result: arbitrary code execution in the context of the browser process. No additional user interaction required. One click. Full code execution.

The exploit was not sprayed broadly. It was delivered with precision — targeting specific individuals at specific companies via spear-phishing over Windows Live Messenger and email. Each link was personalized. Each decoy was crafted to match the target’s interests and social circle. The attackers had done their reconnaissance.

The payload dropped by the exploit was a custom Remote Access Trojan — later nicknamed “Hydraq” by Symantec — a lightweight backdoor written in C++ that established an encrypted channel to attacker-controlled command-and-control infrastructure. Hydraq communicated over standard HTTPS, blending into normal corporate web traffic. It used custom binary protocols over SSL to evade signature-based detection.

Once Hydraq was running on a machine inside the Google network, the attackers had a foothold. The real work began.

The Objective: Source Code and Surveillance

From their initial beachhead, the Aurora operators demonstrated the hallmark patience of a mature state intelligence program.

They mapped the internal network. They identified the Perforce source code management server — the system storing Google’s core codebase. They moved laterally using harvested credentials, compromising additional machines until they reached systems with the access they needed.

What they exfiltrated from Perforce remains partially classified, but Google’s own disclosures confirmed that source code was stolen. The specific codebases accessed were never fully named publicly, though reporting has pointed to components of search infrastructure and security tools.

More precisely documented was the second objective. The attackers accessed the production infrastructure of Gmail — not to read individual emails in bulk, but to access a specific capability: a lawful intercept system that Google maintained to respond to court-ordered surveillance requests from U.S. law enforcement. This system, required under CALEA (Communications Assistance for Law Enforcement Act), maintained a record of which accounts had been placed under court-ordered surveillance.

The Chinese intelligence services appear to have wanted to know which of their own agents and assets had been identified by U.S. law enforcement. The lawful intercept database was, in effect, a list of compromised spies. The operation was not just espionage — it was counter-espionage.

Simultaneously, the attackers accessed the Gmail accounts of specific named activists and dissidents. These accounts were not mass-harvested. They were targeted by name, consistent with a list prepared in advance by an intelligence organization with prior knowledge of its subjects.

The Scope: Beyond Google

The first remarkable thing about Aurora was what it did to Google. The second was what it revealed about everyone else.

As McAfee and Google’s investigators followed the infrastructure — command-and-control servers, malware samples, network indicators — they found that the same campaign, the same tools, the same C2 infrastructure, had been used against at least 33 other organizations simultaneously. Many of the victims were household names. Most had had no idea they were compromised.

The targeting profile was consistent with a state-level collection mandate: defense contractors, aerospace firms, semiconductor companies, internet infrastructure providers, financial institutions. These were not targets of opportunity. They were items on a collection list.

The dwell time — the period the attackers had been inside these networks before discovery — was measured in months. In some organizations, the attackers had been present since mid-2009 or earlier. They had moved quietly, exfiltrating selectively, leaving minimal forensic traces.

This was not the smash-and-grab model of Eastern European cybercrime. This was long-term strategic collection — a case officer running agents over years, rendered in packets.

The Fallout: A Company Leaves China

Google’s public naming of China as the attacker was unprecedented. It was also a decision with significant risk: Google was a major commercial operator in China, with a substantial workforce, infrastructure investment, and advertising revenue. Naming Beijing publicly was a direct provocation.

Google named China anyway.

The company announced it would stop censoring search results on Google.cn — in violation of its agreements with Chinese authorities — and would evaluate whether to continue operating in China at all. In March 2010, Google shut down Google.cn and redirected Chinese users to its uncensored Hong Kong search service. The Chinese government blocked it.

Google exited mainland China. The operation that had begun with a single instant message link had, within three months, ended the commercial relationship between one of the world’s most valuable technology companies and the world’s most populous nation.

The geopolitical reverberations continued. The U.S. State Department, under Secretary Hillary Clinton, issued a formal statement demanding an explanation from the Chinese government. Clinton invoked “internet freedom” as a foreign policy priority — a framing that shaped U.S. digital diplomacy for years afterward.

Beijing denied everything. It always does.

The Technical Legacy

Beyond the geopolitics, Aurora changed the security industry’s understanding of what sophisticated state espionage looked like in practice.

The zero-day question. CVE-2010-0249 was a high-quality zero-day that had almost certainly been developed or purchased specifically for this operation. The attackers had not used it casually — it had been held in reserve and deployed surgically. This established a pattern that would be confirmed again and again: nation-state actors maintain inventories of unpatched vulnerabilities as strategic assets, using them only when the target’s value justifies the expenditure.

The CALEA surveillance infrastructure attack. The targeting of Google’s lawful intercept system sent a direct message to the U.S. intelligence community: the systems that law enforcement requires technology companies to maintain for surveillance purposes are themselves attack surfaces. Every backdoor built for legitimate government use is also a backdoor that adversaries will attempt to enter. The tension between mandated surveillance access and security hardening — already present — became acute after Aurora.

The corporate disclosure precedent. Google’s decision to go public, name the attacker, and describe the operational goals set a precedent that the industry has struggled to follow ever since. Most Aurora victims said nothing publicly. Some quietly patched and moved on. The asymmetry between Google’s transparency and the silence of 33 other companies illustrated a structural problem in how the private sector handles state-sponsored intrusions — one that remains unresolved.

---

Attack Chain: Operation Aurora — The Dragon in the Source Code

graph TD
    A["🇨🇳 Elderwood Group\n(Chinese State / PLA-MSS Nexus)"] --> B["Strategic Collection Mandate\n34 Target Organizations\nTechnology, Defense, Finance, Energy"]

    B --> C["Target Selection & OSINT\nEngineer Profiles via LinkedIn\nSocial Network Mapping\nIdentify High-Value Insiders"]

    C --> D["Weaponize IE Zero-Day\nCVE-2010-0249\nJScript Use-After-Free\nInternet Explorer 6"]

    D --> E["Spear-Phishing Delivery\nPersonalized Instant Messages\n(Windows Live Messenger)\nTailored Lure per Target"]

    E --> F["Target Clicks Malicious Link\nMalformed HTML Page Loaded\nIE6 JScript Engine Corrupts Memory"]

    F --> G["Arbitrary Code Execution\nIn Browser Process Context\nNo Further User Interaction Required"]

    G --> H["Hydraq RAT Dropped\n(Trojan.Hydraq / McRAT)\nEncrypted C2 over HTTPS\nCustom Binary Protocol over SSL"]

    H --> I["Beachhead Established\nInside Target Network\nBlends with Normal Web Traffic"]

    I --> J["Internal Reconnaissance\nNetwork Mapping\nCredential Harvesting\nActive Directory Enumeration"]

    J --> K["Lateral Movement\nUsing Stolen Credentials\nToward High-Value Servers"]

    K --> L{"Objective Split"}

    L --> M["Path A: Perforce SCM Server\nGoogle Core Source Code"]
    L --> N["Path B: CALEA Infrastructure\nLawful Intercept Database\n(Court-Ordered Surveillance Records)"]
    L --> O["Path C: Gmail Accounts\nChinese Dissident Targets\nHuman Rights Activists"]

    M --> P["Source Code Exfiltrated\nSearch Infrastructure\nSecurity Architecture"]
    N --> Q["U.S. Surveillance Target List\nCompromised PRC Agents\nCounter-Espionage Intelligence"]
    O --> R["Activist Communications\nContact Networks\nForeign Government Ties Exposed"]

    P --> S["Long-Dwell Persistence\nMonths of Undetected Access\nSome Orgs Infected Since Mid-2009"]
    Q --> S
    R --> S

    S --> T["Discovery: December 2009\nGoogle Internal IR Team"]
    T --> U["McAfee Analysis Published\nJanuary 14, 2010\n'Operation Aurora' Named"]
    T --> V["Google Public Disclosure\nJanuary 12, 2010\nNames China as Attacker"]

    V --> W["Geopolitical Fallout\nGoogle Stops Censoring Google.cn\nMarch 2010: Google Exits China\nU.S. State Dept. Demands Explanation"]

    U --> X["33 Additional Victims Identified\nAdobe, Juniper, Yahoo, Symantec\nMorgan Stanley, Rackspace, Dow\nDefense & Aerospace Contractors"]

    X --> Y["Scope: Strategic Collection\nMonths of Dwell Time\nIP + Dissident Surveillance + SIGINT"]

    Y --> Z["Legacy: Nation-State Espionage\nEnters Corporate Threat Model\nCALEA Backdoor Risk Exposed\nChinese Cyber Doctrine Confirmed"]