On January 14, 2010, Microsoft published Security Advisory 979352, documenting an Internet Explorer vulnerability that attackers were already using. That advisory is the most defensible anchor point for one of the most consequential espionage campaigns of its era: Operation Aurora. The supplied evidence places the intrusion activity in late 2009 and early 2010, but no precise first-attack date is established, which is why the disclosure date—rather than an inferred date of first exploitation—marks the entry on the timeline. The corrective update would not arrive until a week later.
Operation Aurora deserves careful vocabulary. "Operation Aurora" is the name of the broader espionage campaign, while CVE-2010-0249 is the browser vulnerability it used as an entry vector. The two are not synonyms, and conflating them is the first mistake to avoid when writing about this incident.
CVE-2010-0249 is a use-after-free memory corruption flaw in Microsoft Internet Explorer, mapped to CWE-416. Its impact was remote code execution: when a victim viewed a specially crafted page in an affected browser, an attacker could run code on the machine. Internet Explorer 6, 7 and 8 are identified as affected, and the eventual cumulative bulletin was rated Critical for most supported releases, including versions 5.01, 6, 7 and 8. Reporting lists a wide operating-system footprint at the time—Windows 2000, Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008 and Windows 7.
NVD-derived reporting assigns a modern CVSS 3.1 base score of 8.8 (High), with a network attack vector, low attack complexity, no privileges required, required user interaction, and high impact to confidentiality, integrity and availability. That score is useful for comparison, but it should not be presented as the contemporaneous reason the incident mattered. The score was calculated within a scoring framework that came later; the operational significance came from targeted exploitation against strategically important organizations.
Internet Explorer maintained internal objects representing page and event state. In the vulnerable path, script and manipulated Document Object Model content could cause an object to be deleted while another part of the browser still held a pointer to it. The browser could then use that stale pointer as though it referenced a valid object. That is the essence of a use-after-free: object lifetime and pointer validity fall out of sync.
The reported implementation details involved the IHTMLEventObj4 interface and the CEventObj class. From an engineering perspective, the security boundary failed because attacker-controlled page behavior could influence both the release of an object and the subsequent access to the memory it had occupied. If the vacated allocation were refilled with attacker-influenced data, the stale pointer could be steered toward code the attacker controlled.
The remote delivery path still required the browser to process malicious content. Campaign reporting describes spear-phishing messages that directed selected recipients to compromised or attacker-controlled websites. Visiting the page in a vulnerable browser triggered the memory-corruption path and let code run with the logged-on user's privileges. A user without administrative rights limited the system-wide damage compared with a user running as administrator—an early argument for least privilege.
CVE-2010-0249 served as a principal zero-day entry point in Operation Aurora. Reporting links successful exploitation to installation of the Hydraq backdoor—also tracked as Trojan.Hydraq—which gave attackers persistent remote access after the initial browser compromise.
McAfee named the operation "Aurora" after a folder reference found in the malware source code. Security reporting and MITRE-linked analysis associate the campaign with Elderwood, described as a suspected China-nexus actor. That formulation should be preserved carefully: the evidence supports a widely reported research attribution, not a judicial finding about specific operators. The distinction between "linked by researchers to" and "proven in court" matters in this kind of story.
The targeted organizations included Google and more than 20 other major organizations, according to the compiled reporting. The attackers pursued intellectual property—including source code—and access to sensitive accounts, including accounts associated with human-rights activists.
The strongest supported impact is strategic rather than numerical. Attackers gained footholds in major organizations and pursued source code, intellectual property and sensitive account access. The evidence says more than 20 organizations were targeted—which is not the same as more than 20 confirmed breaches. Turning a count of targeted companies into a breach count is exactly the kind of overreach the underlying reporting does not support.
No authoritative confirmed-host total or financial-loss figure exists in the supplied evidence. It is also worth separating compromise of an employee endpoint from demonstrated access to source repositories or account systems; those are different levels of impact, and the reporting does not collapse them into a single number.
Studying historical intrusions means keeping malware samples, disk images and forensic captures on fast, isolated storage. The Samsung T7 Portable SSD is a reliable external drive for offline analysis labs and evidence handling.
Amazon Affiliate Link
Microsoft released the out-of-band MS10-002 cumulative Internet Explorer update on January 21, 2010. It fixed CVE-2010-0249 along with other Internet Explorer vulnerabilities and was distributed generally through Windows Update, with Microsoft advising immediate installation. The update changed how Internet Explorer handled objects in memory, validated parameters and filtered HTML attributes.
Before the patch, proposed defenses included disabling Active Scripting and enabling Data Execution Prevention (DEP). These measures reduced exploitability but were not substitutes for correcting the underlying object-lifetime flaw. Running as a least-privileged user also constrained the authority inherited by injected code. The lesson pattern here recurs across this entire timeline: pre-patch mitigations buy time; they do not close the hole.
Operation Aurora demonstrated how a browser zero-day, social engineering and a purpose-built remote-access implant could be combined into a strategic intrusion against software producers. Its importance lies in the complete operational chain: carefully selected users, malicious web content, client-side memory corruption, durable access and theft objectives focused on intellectual property.
It also exposed the security implications of administrative browsing and concentrated access. A browser process did not need to be the ultimate target; it only needed to become the first trusted process captured inside an organization. Once that foothold existed, the attacker's real objective—the source tree, the account systems—was reachable from the inside. That reframing, from "a browser bug" to "the first hop in a strategic operation," is the reason Operation Aurora still anchors the modern zero-day conversation.