iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The headline refers to Operation Shady RAT, a cyber-espionage campaign McAfee disclosed in 2011. Its investigation positively identified 72 compromised organizations or other parties, with activity in command-and-control logs dating to mid-2006. The findings describe a historical investigation—not a newly uncovered incident or a current count of victims.
What was Operation Shady RAT?
McAfee used “RAT” to mean “Remote Access Tool” when it named the operation. The investigation examined logs from a command-and-control server used by the intruders. SecurityWeek reported that McAfee identified 72 compromised parties; the logs also included activity that investigators could not confidently connect to specific victims. Contemporary accounts described the operation as spanning 14 countries over about five years.
Reports sometimes rounded the total to “70” or described it as “more than 70.” Those figures refer to the same 2011 investigation, but the clearest reported count is 72 positively identified parties. They are historical findings, not a measurement of organizations still compromised today.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesHow many organizations and what kinds were affected?
The reported victims represented governments, multinational businesses, nonprofits, defense contractors and international sports organizations. Among those named in contemporary coverage were the U.S. federal government; the governments of Canada, Taiwan, South Korea and Vietnam; the United Nations; the International Olympic Committee; and the World Anti-Doping Agency.
#1 Best Overall
Dark Reading reported that 49 of the 72 victims were based in the United States and separately cited 14 U.S. defense contractors. Dark Reading and The Register reported a figure of 13 defense contractors in another count; these are source-specific figures and should not be conflated. The congressional record also repeated McAfee’s description of more than 70 public and private organizations in 14 countries.
How did the attackers get in?
Contemporary reporting based on McAfee’s account described a targeted email-and-exploit route. The attackers selected employees whose organizational access could be useful, then sent spear-phishing messages containing an exploit. If a recipient opened the exploit on an unpatched system, it could install implant malware and establish communication with command-and-control infrastructure.
Rank #2
After gaining a foothold, operators could escalate privileges, move laterally through a network, and create additional persistent footholds before stealing selected information. The reports describe the campaign’s methods; they do not establish that every victim experienced every step in exactly the same way.
What information did the attackers seek?
Contemporary reports listed a broad range of potentially valuable material, including government secrets, email archives, legal contracts, source code, bug databases, design schematics, negotiation plans, oil and gas auction details, and SCADA configurations. The variety points to an espionage operation aimed at information with strategic, commercial or operational value, rather than a single category of data.
McAfee threat-research vice president Dmitri Alperovitch characterized the potential impact as an unprecedented transfer of wealth, arguing that stolen information could reveal secrets or give a competitor an advantage. That was his assessment of the risk; the reporting did not quantify a financial loss attributable to the operation.
Who was behind Operation Shady RAT?
The sources cited here do not establish a definitive perpetrator. SecurityWeek noted that McAfee’s report did not identify the adversary. The U.S.-China Economic and Security Review Commission later described links to China as speculative and pointed out that McAfee’s original report did not mention China. It would therefore be inaccurate to state that China was conclusively responsible.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What the 2011 findings do—and do not—show
The investigation established a substantial, multi-year intrusion campaign and a set of positively identified victims based on the server logs and contemporary reporting. It does not establish how many organizations remain affected now, provide a reliable total for economic losses, or prove a state sponsor. Keeping those limits attached to the historical figures is essential when interpreting a headline written at the time of disclosure.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
