Operation Digital Eye

Campaign overview

MITRE ATT&CK historical record. Dates reflect source observations. Current activity and target-region classification are not asserted; Global denotes unclassified catalogue coverage. Operation Digital Eye was conducted in June and July of 2024 by suspected People's Republic of China (PRC)-nexus threat actors targeting business-to-business IT service providers in Southern Europe. Operation Digital Eye activity included the use of Visual Studio Code tunnels for command and control (C2) and custom lateral movement capabilities. Overlaps in tooling between Digital Eye and previous China-nexus campaigns, Operation Soft Cell and Operation Tainted Love, indicate the potential use of shared vendors or digital quartermasters.(Citation: sentinelone operationDigitalEye Dec 2024)

This is a historical record and does not establish current campaign activity.

Threat actor

Not established

Attribution confidence

Not established

First documented activity

2024-06-01

End date

Not established

Estimated victims

Not established

Reported impact

Not established

Unknown attribution, confidence and impact remain unspecified. Regional labels can include unspecified targets; assess the source evidence before acting.

Documented timeline

1. 2024-06-01

   Source-reported first observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

2. 2024-07-01

   Source-reported last observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

MITRE ATT&CK techniques

• T1505.003 · Web Shell

  Persistence — During Operation Digital Eye, threat actors deployed a PHP-based webshell to maintain persistent access.(Citation: sentinelone operationDigitalEye Dec 2024)

• T1543.003 · Windows Service

  Persistence, Privilege Escalation — During Operation Digital Eye, threat actors created a service named Visual Studio Code Service to run Visual Studio code.(Citation: sentinelone operationDigitalEye Dec 2024)

• T1614.001 · System Language Discovery

  Discovery — During Operation Digital Eye, threat actors used the local language of targeted organizations to disguise file system activity.(Citation: sentinelone operationDigitalEye Dec 2024)

• T1106 · Native API

  Execution — During Operation Digital Eye, threat actors used native API such as `GetUserInfo`.(Citation: sentinelone operationDigitalEye Dec 2024)

• T1087.001 · Local Account

  Discovery — During Operation Digital Eye, threat actors used the local.exe tool to view local account information.(Citation: sentinelone operationDigitalEye Dec 2024)

• T1003.002 · Security Account Manager

  Credential Access — During Operation Digital Eye, threat actors used `reg save` to retrieve credentials from the Security Account Manager (SAM) database.(Citation: sentinelone operationDigitalEye Dec 2024)

• T1003.001 · LSASS Memory

  Credential Access — During Operation Digital Eye, threat actors targeted memory from the LSASS process to extract credentials.(Citation: sentinelone operationDigitalEye Dec 2024)

• T1018 · Remote System Discovery

  Discovery — During Operation Digital Eye, threat actors used Ping for reconnaissance.(Citation: sentinelone operationDigitalEye Dec 2024)

• T1569.002 · Service Execution

  Execution — During Operation Digital Eye, threat actors used the winsw tool to deploy a Visual Studio code executable as a Windows service.(Citation: sentinelone operationDigitalEye Dec 2024)

• T1190 · Exploit Public-Facing Application

  Initial Access — During Operation Digital Eye, threat actors used SQL injection to compromise publicly exposed web and database servers.(Citation: sentinelone operationDigitalEye Dec 2024)

• T1591 · Gather Victim Org Information

  Reconnaissance — During Operation Digital Eye, threat actors concealed malicious activity by using terms that aligned with the technological context of the targeted organization.(Citation: sentinelone operationDigitalEye Dec 2024)

• T1665 · Hide Infrastructure

  Command And Control — During Operation Digital Eye, threat actors used public Cloud infrastructure to mask malicious activity.(Citation: sentinelone operationDigitalEye Dec 2024)

• T1098.004 · SSH Authorized Keys

  Persistence, Privilege Escalation — During Operation Digital Eye, threat actors used SSH access enabled by authorized_keys files for remote execution.(Citation: sentinelone operationDigitalEye Dec 2024)

• T1021.001 · Remote Desktop Protocol

  Lateral Movement — During Operation Digital Eye, threat actors moved laterally using RDP.(Citation: sentinelone operationDigitalEye Dec 2024)

• T1219.001 · IDE Tunneling

  Command And Control — During Operation Digital Eye, threat actors created Visual Studio Code dev tunnels to access targeted endpoints through the browser-based version of Visual Studio Code.(Citation: sentinelone operationDigitalEye Dec 2024)

• T1588.002 · Tool

  Resource Development — During Operation Digital Eye, threat actors used third party tools including custom implementations of Mimikatz.(Citation: sentinelone operationDigitalEye Dec 2024)

• T1070.004 · File Deletion

  Stealth — During Operation Digital Eye, threat actors deleted files delivered to compromised hosts, often named with the pattern do.* such as do.exe.(Citation: sentinelone operationDigitalEye Dec 2024)

• T1069.001 · Local Groups

  Discovery — During Operation Digital Eye, threat actors used the local.exe tool to view group memberships.(Citation: sentinelone operationDigitalEye Dec 2024)

• T1059.003 · Windows Command Shell

  Execution — During Operation Digital Eye, threat actors used `cmd.exe` as a default method of execution for a custom version of Mimikatz named bK2o.exe.(Citation: sentinelone operationDigitalEye Dec 2024)

• T1036.005 · Match Legitimate Resource Name or Location

  Stealth — During Operation Digital Eye, threat actors attempted to make filenames appear legitimate by tailoring them to the victim organization.(Citation: sentinelone operationDigitalEye Dec 2024)

• T1033 · System Owner/User Discovery

  Discovery — During Operation Digital Eye, threat actors used `GetUserInfo` to identify current user information.(Citation: sentinelone operationDigitalEye Dec 2024)

• T1550.002 · Pass the Hash

  Lateral Movement — During Operation Digital Eye, threat actors used a pass-the-hash capability to move laterally.(Citation: sentinelone operationDigitalEye Dec 2024)

Linked indicators

0 reviewed indicators. An indicator’s presence does not establish that every resource on shared infrastructure is malicious.

No reviewed indicators are supplied. None are inferred from the campaign description.

Documented infrastructure

No reviewed infrastructure is supplied.

Sources and evidence

• MITRE ATT&CK C0061

  Official MITRE ATT&CK campaign record C0061. Derived from mitre/cti commit 50be388e93819a5d20e71cbaaeccfda157abc846. Actor links and technique mappings are attributed to this source; confidence, victims, monetary impact and infrastructure are not inferred.

External sources retain their own licences and sharing conditions. Request a correction with supporting evidence.