Operation Aurora: how China hacked Google in 2010

On January 12, 2010, Google published a statement that shook the tech industry: the company had been the victim of a sophisticated cyberattack originating in China. This wasn't an opportunistic break-in by a script kiddie hunting for a trophy. It was a systematic state espionage operation against dozens of the world's largest corporations — and Google was the only one with the nerve to make it public.

What Operation Aurora was

Operation Aurora was a cyber espionage campaign attributed to the Elderwood Group, an advanced persistent threat (APT) group based in Beijing with documented connections to China's People's Liberation Army. The attacks began in mid-2009 and continued through December of that year, before being discovered and disclosed.

The name came from inside the malware itself: while reverse-engineering the code, McAfee researchers found an internal folder called "Aurora" — and the nickname stuck.

How the attack worked technically

The initial vector was elegant and effective: targeted spear-phishing. Victims received a carefully crafted link — by email or instant messenger — pointing to a malicious page hosted on compromised servers. When opened in Internet Explorer 6, the page exploited CVE-2010-0249, a use-after-free flaw that allowed remote code execution with no further user interaction.

From there, the Hydraq Trojan — also called the Aurora malware — was installed silently. Hydraq opened a persistent backdoor, letting the attackers exfiltrate data, move laterally across the corporate network and reach source code repositories.

Choosing IE6 as the vector wasn't random: in 2009 the browser still held a considerable share of the corporate market, especially at companies locked into legacy web applications incompatible with newer versions.

Who was hit

The list is striking. At least 34 organizations were compromised, according to McAfee and industry sources, including:

• Google — the primary target; source code stolen and the Gmail accounts of human rights activists accessed
• Adobe
• Yahoo
• Juniper Networks
• Symantec
• Morgan Stanley
• Northrop Grumman
• Rackspace
• Dow Chemical

Most stayed quiet — they didn't want to risk access to the Chinese market, which was growing fast at the time. Google was the exception that broke the pattern.

The operation's two real objectives

Aurora pursued distinct goals at the same time:

1. Intellectual property theft. Product source code and trade secrets were the main prize. For Google, the target included the code behind the search system and internal infrastructure — information worth billions.

2. Surveillance of activists. The attackers accessed the Gmail accounts of Chinese human rights activists who communicated with citizens inside China. The goal was to map dissident networks — a political intelligence operation embedded inside a corporate espionage operation.

That combination made Aurora an emblematic case of how states use cyber tools for multiple purposes at once: money and control.

Google's response — and what happened next

What did Google do after discovering Operation Aurora?

Google redirected the google.com.cn domain to google.com.hk (Hong Kong), effectively leaving mainland China. The decision was announced in March 2010, four months after the attack was discovered.

The move was unprecedented: one of the world's largest technology companies chose to abandon the planet's biggest internet market over principles of security and freedom of expression. No other company compromised in the same operation took a comparable step.

On the technical side, Microsoft shipped the MS10-002 patch fixing CVE-2010-0249 in January 2010, outside the normal Patch Tuesday cycle — an indication of the vulnerability's severity. The German government went as far as publicly recommending its citizens stop using Internet Explorer while the patch was unavailable.

Why Aurora is a landmark in digital security

Before 2010, state-sponsored attacks were often treated as a topic for intelligence analysts rather than corporate IT professionals. Operation Aurora changed that permanently:

• It made the APT model public as a real corporate threat — not just a governmental or military one.
• It demonstrated that zero-days in ordinary corporate software are espionage weapons, not merely tools for financial crime.
• It forced the conversation about responsibility: when a state attacks a private company, who answers for it? The company? The government of the country it's based in? There was no clear answer then, and there isn't one now.

Later attacks like Stuxnet — the digital weapon against Iran and NotPetya in 2017 expanded the scale and impact, but Aurora was the first time the state APT model became visible to the general public. It opened an era.

The lesson that still holds

Spear-phishing is still the most common entry vector in APT attacks in 2026. The difference is that it now comes supercharged with generative AI — emails indistinguishable from the real thing, personalized with context scraped from LinkedIn and social media, at industrial scale. The CVE changes; the vector doesn't.

If you want to understand how to protect yourself from the same vector that got Google, the starting point is learning to identify phishing accurately — the signs have changed, but the logic of the deception is the same. And robust multi-factor authentication (not SMS) is non-negotiable: see how the MFA fatigue attack that bypasses conventional 2FA works.

Sixteen years later, the question Aurora put to the industry — how does a company protect its assets against an adversary with the resources of a state? — still has no simple answer. But understanding the history is the first step toward not repeating it.