NEW: Per internal DOD memo, Cybercom worried the 2010 WikiLeaks dump gave adversaries opportunity to retool/better hide their cyber-ops after learning USG was tracking them. Memo suggests DOD was tracking Operation Aurora actors (Chinese) @CyberScoopNews bit.ly/3cHa8Z3
The memo, shared by @NSArchive, suggests USG had been tracking the adversary in question for some time: “The [redacted] cables clearly state that [USG] entities have knowledge of specific adversary TTPs ... malware, toolsets, IP addresses, and domains used in intrusion activity"
(Operation Aurora, 1 of the first major industrial espionage campaigns, was first attributed to Chinese-based hackers by @Google, among the operation’s ~30 targets. WikiLeaks dump revealed the US Embassy in Beijing learned the operation was a Chinese gov-linked hacking group's)
It wasn't just this adversary Cybercom was worried about: (Cybercom warned the dump might cause OPSEC/sophistication/TTP changes, Cybercom warned it could also cause more collab between offensive cyber-ops groups...
“All organizations must be observant to potential efforts of our adversaries to leverage this new information against DoD in efforts to further their cyber initiatives," the Pentagon warned in the memo.
