🇨🇳

Operation Titan Rain

APT Group Information theft and espionage 4 zero-day CVEs ETDA ✓

Also Known As

No alias recorded

Target Countries 2

Countries highlighted in red

United Kingdom United States

Sectors Targeted

National Security and International Affairs 928110 Finance and Insurance 52 Defense Utilities 22 Aircraft Manufacturing 336411 Space Research and Technology 927 Commercial Banking 52211 National Security and International Affairs 928 Government Energy Monetary Authorities-Central Bank 521 Public Administration 92 Educational Services 61 Justice, Public Order, and Safety Activities 922

Details

Origin 🇨🇳 CN

Last Updated 11 May 2024

MITRE ATT&CK 5

T1003 T1041 T1059 T1071 T1078

Related Zero-Days 4

CVE-2021-26855 CVE-2021-26857 CVE-2021-26858 CVE-2021-27065

Known Names 1 entries

Operation Titan Rain US Government

Observed Target Countries 2

Based on ETDA data — countries highlighted in red

UK USA

Description

(Kaspersky) Hacks against the Defense Department and other U.S. agencies stretching back to 2003 were codenamed Titan Rain by investigators. The attacks, which breachedhundreds of networks, including Departments of State, Energy and Homeland Security, were coordinated from Chinese computers, investigators found. Global defense contractor Lockheed Martin and NASA were also struck in what many experts called an attempt to glean information on U.S. systems. While it’s usually difficult to locate the country of origin for such attacks, researchers were able to trace them back to the Chinese province of Guangdong. However, the individuals behind the operation remain a mystery to this day.

Reports & References 3

https://threatpost.com/titan-rain/91835/ https://www.academia.edu/32222445/_Investigating_Titan_Rain_Cyber_Espionage_Cyber_Security_and_Cyber_Operations https://en.wikipedia.org/wiki/Titan_Rain

ETDA Profile

Operation Titan Rain

Origin

China

First Seen 2003

Sponsor State-sponsored, PLA Unit 61398

Motivation

Information theft and espionage

View on ETDA APT Groups ↗