MITRE ATT&CKcampaign

C0061 Operation Digital Eye

Published 2026-04-19 Modified 2026-07-31 Official page ↗
Domain
enterprise
Version
1.0
Created
2026-04-19

Description

Operation Digital Eye was conducted in June and July of 2024 by suspected People's Republic of China (PRC)-nexus threat actors targeting business-to-business IT service providers in Southern Europe. Operation Digital Eye activity included the use of Visual Studio Code tunnels for command and control (C2) and custom lateral movement capabilities. Overlaps in tooling between Digital Eye and previous China-nexus campaigns, Operation Soft Cell and Operation Tainted Love, indicate the potential use of shared vendors or digital quartermasters.

Related

Uses · MITRE ATT&CK (26)

  • S9028 PHPsert software (malware)
  • T1219.001 IDE Tunneling sub-technique
  • T1665 Hide Infrastructure technique
  • T1614.001 System Language Discovery sub-technique
  • T1591 Gather Victim Org Information technique
  • T1588.002 Tool sub-technique
  • T1098.004 SSH Authorized Keys sub-technique
  • T1069.001 Local Groups sub-technique
  • T1569.002 Service Execution sub-technique
  • T1059.003 Windows Command Shell sub-technique
  • T1087.001 Local Account sub-technique
  • T1003.001 LSASS Memory sub-technique
  • T1003.002 Security Account Manager sub-technique
  • T1021.001 Remote Desktop Protocol sub-technique
  • T1036.005 Match Legitimate Resource Name or Location sub-technique
  • T1070.004 File Deletion sub-technique
  • T1550.002 Pass the Hash sub-technique
  • T1543.003 Windows Service sub-technique
  • T1505.003 Web Shell sub-technique
  • S0225 sqlmap software (tool)
  • T1190 Exploit Public-Facing Application technique
  • S0002 Mimikatz software (tool)
  • S0097 Ping software (tool)
  • T1018 Remote System Discovery technique
  • T1033 System Owner/User Discovery technique
  • T1106 Native API technique

References