Night Dragon Operation is one of the

cyberattacks A cyberattack is any offensive maneuver that targets computer information systems, computer networks, infrastructures, or personal computer devices. An attacker is a person or process that attempts to access data, functions, or other restricte ...

that started in mid-2006 and was initially reported by Dmitri Alperovitch, Vice President of Threat Research at Internet security company McAfee in August 2011, who also led and named the Night Dragon Operation and Operation Aurora cyberespionage intrusion investigations. The attacks have hit at least 71 organizations, including defense contractors, businesses worldwide, the United Nations and the International Olympic Committee.

Attack work model

The attacks use a variety of components—there is no single piece or family of malware responsible. The preliminary stage of the attack involves penetration of the target network, ‘breaking down the front door’. Techniques such as

spear-phishing Phishing is a type of social engineering where an attacker sends a fraudulent (e.g., spoofed, fake, or otherwise deceptive) message designed to trick a person into revealing sensitive information to the attacker or to deploy malicious softwar ...

and SQL injection of public facing Web servers are reported to have been used. Once in, the attackers then upload freely available hacker tools onto the compromised servers in order to gain visibility into the internal network. The internal network can then be penetrated by typical methods (accessing Active Directory account details, cracking user passwords, etc.) in order to infect machines on the network with remote administration trojans (RATs). Since this attack is done by a government, the resources in terms of hardware, software, and other logistics available to the hackers are considerable ( PLA Unit 61398).

References

Cyberattacks Cyberwarfare by Chinabr>Confessions of a Cyber Spy Hunter Eric Winsborrow (TEDx)
{{computer-security-stub Chinese advanced persistent threat groups