On January 12, 2010, Google's Chief Legal Officer David Drummond published a blog post that was, by any measure, extraordinary. A major corporation was publicly accusing a nation-state of conducting cyber espionage against it and announcing that the experience had caused it to reconsider its willingness to operate in that country at all. "We have evidence to suggest that a primary goal of the attackers was accessing the Gmail accounts of Chinese human rights activists," Drummond wrote. "We are no longer willing to continue censoring our results on Google.cn." Within months, Google had redirected its Chinese search engine to Hong Kong.
The operation Drummond was describing had been named Aurora by McAfee, which identified it after Google informed the security industry about the attack. Aurora was not limited to Google: at least 20 other major technology and defense companies were targeted, including Adobe, Intel, Juniper Networks, Rackspace, Symantec, Yahoo, Northrop Grumman, Dow Chemical, and Morgan Stanley. The attackers had used a then-unknown vulnerability in Internet Explorer 6 to gain initial access, then conducted targeted surveillance of specific email accounts and source code repositories. The operation had apparently been running since at least mid-2009.
The Technical Attack Chain
Aurora used a zero-day vulnerability in Internet Explorer 6 - CVE-2010-0249 - that allowed remote code execution when a victim visited a malicious web page. The delivery mechanism was a spear-phishing approach: targets at the victim companies received emails or instant messages containing links to websites hosting the exploit. The links appeared to originate from trusted contacts - the attackers had done enough reconnaissance to know who each target communicated with.
The IE6 vulnerability exploited a use-after-free condition in the browser's handling of HTML objects. When a victim visited a compromised page, JavaScript executed the exploit, achieving code execution in the browser's security context. The payload installed a backdoor - identified by various vendors as "Hydraq" or "Aurora" malware - that established a persistent encrypted connection to command and control servers.
Once the backdoor was installed, it connected out to C2 infrastructure using encrypted communications over standard ports (443/HTTPS) to avoid firewall detection. The operators used the backdoor to conduct manual reconnaissance - navigating the victim network, identifying valuable systems, and selectively accessing specific data. The patience and selectivity of access suggested professional operators with specific collection requirements, not opportunistic hackers.
What the Attackers Were After
The targeting revealed the operation's actual objectives, which were more nuanced than simple intellectual property theft.
At Google, the attackers accessed two Gmail accounts belonging to Chinese human rights activists. They did not mass-exfiltrate user data - they targeted specific accounts. Separately, they accessed Google's source code repositories, particularly the Gaia authentication system that underpinned Google's single-sign-on infrastructure. Understanding Gaia would give insight into how Google's surveillance transparency worked - specifically, how Google detected and responded to court orders and intelligence requests.
This combination - surveilling human rights activists while simultaneously examining the system Google used to respond to government surveillance requests - suggested an operational purpose beyond commercial espionage. The hypothesis developed by security researchers and later supported by additional evidence was that the operation served Chinese intelligence's need to understand what Google knew about PRC surveillance activities, and to maintain visibility over Chinese dissidents who used Gmail to communicate outside the reach of domestic monitoring.
At other target companies, the focus varied. Adobe Systems was apparently targeted for its PDF and Flash software, where source code access would reveal unknown vulnerabilities. Defense contractors like Northrop Grumman were targeted for weapons systems and procurement intelligence. The consistency was that every target had something of specific value to Chinese national interests - this was not a blanket industrial espionage program but a targeted collection effort with defined requirements.
Attribution to APT17 / Comment Crew / Unit 61398
Initial public attribution of Aurora was careful. McAfee, in their report, described the attackers as "a very sophisticated threat actor" without stating a nationality. Google's Drummond post implied China without explicitly naming it. The US government said little publicly.
Over subsequent years, the technical attribution became stronger. Researchers at Google's Project Zero, Mandiant, and other firms traced Aurora's infrastructure and techniques to the same actor clusters later associated with the broader Chinese espionage campaigns documented in the APT1 report. The Aurora backdoor shared code patterns with other malware attributed to PLA-connected groups. The C2 infrastructure used IP ranges and domain registration patterns consistent with Chinese state actor infrastructure.
By the time Mandiant published the APT1 report in 2013, the Chinese state's responsibility for Aurora was treated as established by most of the security industry, even if the specific PLA unit was not definitively identified. The 2014 DOJ indictment of PLA officers did not specifically charge anyone with Aurora, but the overall legal theory of PLA cyber espionage that the indictment established was consistent with what Aurora had represented.
The Zero-Day Debate and Responsible Disclosure
Aurora reinvigorated a debate that had never been fully resolved: when a government discovers a zero-day vulnerability is being actively exploited by a foreign adversary, what is the appropriate response? The US intelligence community knew about the IE6 vulnerability being exploited in Aurora before it was publicly disclosed. The question of whether to disclose it to Microsoft immediately, continue using the intelligence from monitoring the campaign, or some middle path, exemplified the Vulnerabilities Equities Process dilemma in concrete form.
Adding to the controversy: the German and French governments issued advisories recommending that their citizens stop using Internet Explorer due to the active exploitation of the unpatched vulnerability. The US Department of Homeland Security notably did not initially issue a comparable advisory, which was interpreted by some observers as reflecting the intelligence community's preference to preserve operational visibility into the ongoing campaign. DHS eventually issued its own advisory several days later.
The episode illustrated the tension between two legitimate government interests: the intelligence value of monitoring an ongoing sophisticated attack using a known vulnerability, and the defensive responsibility to warn the millions of Americans using vulnerable software. There is no clean resolution to this tension - it is inherent in the structure of a government that has both offensive intelligence and defensive security responsibilities residing in different agencies with different missions.
Google's Response and Its Broader Impact
Google's decision to go public with Aurora was unprecedented. Major corporations that had been compromised by nation-state actors typically kept quiet, fearing reputational damage and preferring to handle incidents through private diplomatic channels. Google's public disclosure changed this calculus, demonstrating that public attribution could serve the disclosing company's interests by framing the incident as victimization by a foreign government rather than a corporate security failure.
The subsequent confrontation with Chinese censorship requirements - Drummond's post announced Google was "no longer willing to continue censoring results" - was directly connected to Aurora. Google had concluded that operating under Chinese government requirements while simultaneously being targeted by Chinese government espionage was an untenable position. The China operation was eventually restructured to route through Hong Kong rather than operating as a separate censored service.
The Aurora disclosure also directly preceded the broader wave of APT disclosure that would follow over the next few years. Once Google had demonstrated that public disclosure was a viable response, other companies and eventually governments became more willing to discuss specific attacks. Mandiant's APT1 report three years later was a direct extension of the public attribution model that Google had validated.
Within Google itself, Aurora accelerated significant security investments. Project Zero - Google's internal vulnerability research team that hunts for zero-days in widely used software and reports them to vendors - was partly a response to Aurora: the recognition that understanding and preemptively eliminating zero-days from widely used products served a defensive interest that benefited the entire ecosystem. Google's investment in encrypted HTTPS-by-default, discussed above in the Snowden context, was also reinforced by the recognition that unencrypted communications created interception opportunities.
Aurora's Place in the APT Concept
The term "Advanced Persistent Threat" was coined within the US Air Force around 2006 to describe state-sponsored intrusion campaigns with specific characteristics: advanced (using sophisticated tools and techniques), persistent (maintaining long-term access rather than one-off attacks), and threat (constituting a genuine danger rather than opportunistic nuisance). The concept had circulated in government and cleared defense contractor circles before Aurora, but Aurora was the first major public case that demonstrated all three characteristics to a broad civilian audience.
Before Aurora, most public discussion of hacking was framed around individual criminals, hacktivist groups, or script kiddies running known exploits against opportunistic targets. The idea that sophisticated state actors were systematically targeting specific private companies for specific intelligence purposes was not well understood outside government and cleared security circles. Aurora brought that understanding into the public domain.
The APT framework has evolved significantly since Aurora - it is now applied to a much broader range of state-sponsored activity, including offensive operations and pre-positioning for disruption as well as intelligence collection. But the core concept - that the threat from state actors is qualitatively different from criminal hacking in its patience, resources, and specificity of targeting - was established in the public consciousness by the Aurora disclosure and the coverage that followed it.
The years since Aurora have confirmed the pattern it represented. The same targeting logic - specific companies, specific data, patient long-duration access - has appeared in every major Chinese APT campaign since. The tools have become more sophisticated. The infrastructure has become more resilient. The targets have expanded to include critical infrastructure alongside intellectual property. But the foundational insight of Aurora - that China was conducting systematic, targeted cyber espionage aligned with national strategic objectives - has been validated by every subsequent wave of disclosure, indictment, and technical research.
Aurora was the moment when the security industry, major corporations, and eventually the public understood that the threat landscape had fundamentally changed - that the internet was not just a platform for commerce and communication but a domain of active strategic competition between states, and that the companies building that infrastructure were operating in the middle of that competition whether they wanted to or not.