C0016: Operation Dust Storm
Operation Dust Storm was a long-standing persistent cyber espionage campaign that targeted multiple industries in Japan, South Korea, the United States, Europe, and several Southeast Asian countries. By 2015, the Operation Dust Storm threat actors shifted from government and defense-related intelligence targets to Japanese companies or Japanese subdivisions of larger foreign organizations supporting Japan's critical infrastructure, including electricity generation, oil and natural gas, finance, transportation, and construction.[1]
Operation Dust Storm threat actors also began to use Android backdoors in their operations by 2015, with all identified victims at the time residing in Japan or South Korea.[1]
Security context for executives and security teams
C0016: Operation Dust Storm describes [Operation Dust Storm](https://attack.mitre.org/campaigns/C0016) was a long-standing persistent cyber espionage campaign that targeted multiple industries in Japan, South Korea, the United States, Europe, and several Southeast Asian countries. By 2015, the [Operation Dust Storm](https://attack.mitre.org/campaigns/C0016) threat actors shifted from government and defense-related intelligence targets to Japanese companies or Japanese subdivisions of larger foreign organizations supporting Japan's critical infrastructu...
Executive priority
C0016: Operation Dust Storm is an official MITRE ATT&CK campaign. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.
Technical view
Security teams should validate C0016: Operation Dust Storm by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (the platforms named in the official object), and available local telemetry before making detection or mitigation decisions.
Likely telemetry
- Official ATT&CK relationships and object metadata
Detection direction
- Validate whether C0016: Operation Dust Storm appears in your detection coverage and tabletop scenarios.
- Use the object to align executive risk language with SOC, incident response, and detection engineering work.
- Do not treat ATT&CK relationship context as attribution without corroborating evidence.
Mitigation priorities
- Map the object to existing controls and identify missing telemetry or response ownership.
- Prioritize mitigations that reduce exposure on the listed platforms and tactics.
- Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits
Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.
This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Operation Dust Storm
Operation Dust Storm was a long-standing persistent cyber espionage campaign that targeted multiple industries in Japan, South Korea, the United States, Europe, and several Southeast Asian countries. By 2015, the Operation Dust Storm threat actors shifted from government and defense-related intelligence targets to Japanese companies or Japanese subdivisions of larger foreign organizations supporting Japan's critical infrastructure, including electricity generation, oil and natural gas, finance, transportation, and construction.[1]
Operation Dust Storm threat actors also began to use Android backdoors in their operations by 2015, with all identified victims at the time residing in Japan or South Korea.[1]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1204.002 | Malicious FileSub-technique | During Operation Dust Storm, the threat actors relied on potential victims to open a malicious Microsoft Word document sent via email.[1] |
| Enterprise | T1204.001 | Malicious LinkSub-technique | During Operation Dust Storm, the threat actors relied on a victim clicking on a malicious link sent via email.[1] |
| Enterprise | T1583.001 | DomainsSub-technique | For Operation Dust Storm, the threat actors established domains as part of their operational infrastructure.[1] |
| Enterprise | T1027.002 | Software PackingSub-technique | For Operation Dust Storm, the threat actors used UPX to pack some payloads.[1] |
| Enterprise | T1566.001 | Spearphishing AttachmentSub-technique | During Operation Dust Storm, the threat actors sent spearphishing emails that contained a malicious Microsoft Word document.[1] |
| Enterprise | T1189 | Drive-by Compromise | During Operation Dust Storm, the threat actors used a watering hole attack on a popular software reseller to exploit the then-zero-day Internet Explorer vulnerability CVE-2014-0322.[1] |
| Enterprise | T1027.013 | Encrypted/Encoded FileSub-technique | During Operation Dust Storm, the threat actors encoded some payloads with a single-byte XOR, both skipping the key itself and zeroing in an attempt to avoid exposing the key; other payloads were Base64-encoded.[1] |
| Enterprise | T1036 | Masquerading | For Operation Dust Storm, the threat actors disguised some executables as JPG files.[1] |
| Enterprise | T1218.005 | MshtaSub-technique | During Operation Dust Storm, the threat actors executed JavaScript code via `mshta.exe`.[1] |
| Enterprise | T1568 | Dynamic Resolution | For Operation Dust Storm, the threat actors used dynamic DNS domains from a variety of free providers, including No-IP, Oray, and 3322.[1] |
| Enterprise | T1059.005 | Visual BasicSub-technique | During Operation Dust Storm, the threat actors used Visual Basic scripts.[1] |
| Enterprise | T1518 | Software Discovery | During Operation Dust Storm, the threat actors deployed a file called `DeployJava.js` to fingerprint installed software on a victim system prior to exploit delivery.[1] |
| Enterprise | T1203 | Exploitation for Client Execution | During Operation Dust Storm, the threat actors exploited Adobe Flash vulnerability CVE-2011-0611, Microsoft Windows Help vulnerability CVE-2010-1885, and several Internet Explorer vulnerabilities, including CVE-2011-1255, CVE-2012-1889, and CVE-2014-0322.[1] |
| Enterprise | T1059.007 | JavaScriptSub-technique | During Operation Dust Storm, the threat actors used JavaScript code.[1] |
| Enterprise | T1585.002 | Email AccountsSub-technique | For Operation Dust Storm, the threat actors established email addresses to register domains for their operations.[1] |
| Enterprise | T1140 | Deobfuscate/Decode Files or Information | During Operation Dust Storm, attackers used VBS code to decode payloads.[1] |
| Enterprise | T1566.002 | Spearphishing LinkSub-technique | During Operation Dust Storm, the threat actors sent spearphishing emails containing a malicious link.[1] |
Groups, software, and campaigns
S0083: Misdat
Misdat is a backdoor that was used in Operation Dust Storm from 2010 to 2011.[1]
S0032: gh0st RAT
S0012: PoisonIvy
S0084: Mis-Type
Mis-Type is a backdoor hybrid that was used in Operation Dust Storm by 2012.[1]
S0086: ZLib
ZLib is a full-featured backdoor that was used as a second-stage implant during Operation Dust Storm since at least 2014. ZLib is malware and should not be confused with the legitimate compression library from which its name is derived.[1]
S0085: S-Type
S-Type is a backdoor that was used in Operation Dust Storm since at least 2013.[1]
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(2)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.2 | 1.1 | Current bundle | 6148e2934874… | ||
| 19.1 | 1.1 | Older bundle | 0477beeb6e7c… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]Cylance Dust Storm
Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.
Open source URL - [2]mitre-attackC0016Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.