Cyber Resilience

Threat actor · all actors

ElderwoodG0066 state

🇨🇳 CN

aka Elderwood, Elderwood Gang, Beijing Group, Sneaky Panda, SIG22, G0066

Last updated: 2026-08-20

1attributed CVEs
12ATT&CK techniques
3.6IDF score (tooling uniqueness)
0exclusive CVEs
2026years active

About this actor

[Elderwood](https://attack.mitre.org/groups/G0066) is a suspected Chinese cyber espionage group that was reportedly responsible for the 2009 Google intrusion known as Operation Aurora. (Citation: Security Affairs Elderwood Sept 2012) The group has targeted defense organizations, supply chain manufacturers, human rights and nongovernmental organizations (NGOs), and IT service providers. (Citation: Symantec Elderwood Sept 2012) (Citation: CSM Elderwood Sept 2012)

Source: MITRE ATT&CK

Names & naming systems

Each vendor coins its own name for the same actor. Where a name follows a known scheme we attribute it; the rest are listed honestly as unclassified.

MITRE ATT&CKG-number catalogue id

G0066

CrowdStrikenation-animal names

Sneaky Panda

Unclassifiedno scheme matched

ElderwoodElderwood GangBeijing GroupSIG22

How we know this

Data origin
MITRE ATT&CK Imported from the MITRE ATT&CK STIX bundle as an intrusion-set object.
Techniques
MITRE ATT&CK STIX mappings — 12 ATT&CK techniques on file.
Named victims
1 extracted from reporting.

Thin data: Only one named victim is on file.

See how actor data is built for the full pipeline.

Activity timeline

Profile

CVERiskCVSSEPSSPublishedProducts
CVE-2026-8732 8.59.80.19272026-05-29see CVE

Mitigating controls (NIST 800-53)

ControlTechniques coveredCoverage
SI-312 / 12100%
SI-411 / 1292%
AC-49 / 1275%
CA-79 / 1275%
CM-29 / 1275%
CM-69 / 1275%
SC-79 / 1275%
SI-28 / 1267%
SC-447 / 1258%
SI-76 / 1250%
SI-86 / 1250%
CM-75 / 1242%
IA-93 / 1225%
SC-203 / 1225%
AC-62 / 1217%

Co-occurring actors

Similar actors

Similar TTPs

Overlapping CVEs

Active in same years

Same nation-state

Same category