All actors

Elderwood

Also reported as Elderwood Gang, Beijing Group and Sneaky Panda.

Reports
19
Last reported
Known CVEs
17
Techniques in ATT&CK
9
ID
G0066
Sources
ATT&CK
Merge evidence
0 alias matches

Reports per quarter

  1. 2012 Q3: 3 reports
  2. 2012 Q4: no reports
  3. 2013 Q1: no reports
  4. 2013 Q2: 1 report
  5. 2013 Q3: no reports
  6. 2013 Q4: no reports
  7. 2014 Q1: no reports
  8. 2014 Q2: no reports
  9. 2014 Q3: no reports
  10. 2014 Q4: 1 report
  11. 2015 Q1: no reports
  12. 2015 Q2: no reports
  13. 2015 Q3: 1 report
  14. 2015 Q4: no reports
  15. 2016 Q1: 1 report
  16. 2016 Q2: no reports
  17. 2016 Q3: no reports
  18. 2016 Q4: no reports
  19. 2017 Q1: no reports
  20. 2017 Q2: no reports
  21. 2017 Q3: no reports
  22. 2017 Q4: no reports
  23. 2018 Q1: no reports
  24. 2018 Q2: 1 report
  25. 2018 Q3: no reports
  26. 2018 Q4: no reports
  27. 2019 Q1: no reports
  28. 2019 Q2: no reports
  29. 2019 Q3: no reports
  30. 2019 Q4: no reports
  31. 2020 Q1: no reports
  32. 2020 Q2: no reports
  33. 2020 Q3: no reports
  34. 2020 Q4: no reports
  35. 2021 Q1: no reports
  36. 2021 Q2: no reports
  37. 2021 Q3: no reports
  38. 2021 Q4: no reports
  39. 2022 Q1: no reports
  40. 2022 Q2: no reports
  41. 2022 Q3: 1 report
  42. 2022 Q4: no reports
  43. 2023 Q1: 1 report
  44. 2023 Q2: no reports
  45. 2023 Q3: no reports
  46. 2023 Q4: no reports
  47. 2024 Q1: no reports
  48. 2024 Q2: no reports
  49. 2024 Q3: no reports
  50. 2024 Q4: no reports
  51. 2025 Q1: no reports
  52. 2025 Q2: no reports
  53. 2025 Q3: no reports
  54. 2025 Q4: no reports
  55. 2026 Q1: no reports
  56. 2026 Q2: 9 reports
Dated reports, 2012 Q3 to 2026 Q2.

Techniques in ATT&CK

Listed by ATT&CK

No report from the last two years names a technique ID.

CVEs named in reports

Show all 17 CVEs Show fewer

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

  1. Threat Group Cards: A Threat Actor Encyclopedia

    date ORKL added it fromORKL

  2. APT 17, Deputy Dog, Elderwood, Sneaky Panda

    date ORKL added it fromORKL

  3. Operation Aurora

    date ORKL added it fromORKL

  4. Threat Group Cards: A Threat Actor Encyclopedia

    date ORKL added it fromORKL

  5. Security Response - Black Vine Cyberespionage Group.pdf

    date ORKL added it fromORKL

Show all 19 reports Show fewer
  1. Operation Aurora

    file creation date fromORKL

  2. The Black Vine Cyberespionage Group

    date in the CCS '25 data Symantec fromORKLCCS '25 data

  3. The Elderwood Project

    Malpedia library date Symantec fromORKL

Newest first. Details opens the report in Explore.