Operation Shady RAT: Five Years Inside the UN, the IOC and 71 Targets

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

In August 2011, Dmitri Alperovitch, vice president of threat research at McAfee and the investigator who named Night Dragon and Operation Aurora, revealed Operation Shady RAT, an espionage campaign that had been running since mid-2006. RAT stands for remote access tool, software that gives an attacker administrative control over a computer, including its files and keystrokes. At least 71 organizations were compromised, among them defense contractors, the United Nations, ASEAN and the governments of Canada, India, South Korea, Taiwan, the United States and Vietnam.

The list also included the International Olympic Committee and the World Anti-Doping Agency, targeted around the 2008 Beijing Summer Olympics, which pointed investigators toward intelligence gathering rather than profit; reports at the time widely assumed the People's Republic of China was responsible. The way in was not costly zero-day exploits but spear phishing: carefully crafted emails sent to specific people, with attachments that installed the RAT. From that foothold, the attackers mapped internal networks, harvested credentials, escalated privileges and moved laterally to the servers holding valuable data, posing as legitimate administrators.

• The roughly five-year dwell time ran from mid-2006 until McAfee's 2011 report.
• Stolen data left in small amounts disguised as ordinary encrypted web traffic to avoid bandwidth alarms.
• Attackers researched organizational charts through open sources to make their lures look like routine internal documents.
• Infected attachments could exploit unpatched word processors or PDF readers while a decoy document opened normally.
• The case pushed defenders from perimeter security toward continuous internal monitoring and zero trust.