H3XAOperational intelligence
Live analytical pictureEvidence before assessment
TypeCampaign
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[Operation Dust Storm](https://attack.mitre.org/campaigns/C0016) was a long-standing persistent cyber espionage campaign that targeted multiple industries in Japan, South Korea, the United States, Europe, and several Southeast Asian countries. By 2015, the [Operation Dust Storm](https://attack.mitre.org/campaigns/C0016) threat actors shifted from government and defense-related intelligence targets to Japanese companies or Japanese subdivisions of larger foreign organizations supporting Japan's critical infrastructure, including electricity generation, oil and natural gas, finance, transportation, and construction.(Citation: Cylance Dust Storm) [Operation Dust Storm](https://attack.mitre.org/campaigns/C0016) threat actors also began to use Android backdoors in their operations by 2015, with all identified victims at the time residing in Japan or South Korea.(Citation: Cylance Dust Storm)

23 recorded

Relationships

usesTechnique
usesTechnique
usesTechnique
usesTechnique
usesTechnique
usesMalware
usesTechnique
usesTechnique
usesTechnique
usesTechnique
usesMalware
usesMalware
usesTechnique
usesMalware
usesTechnique
usesTechnique
usesTechnique
usesTechnique
usesMalware
usesTechnique
uses
to ZLib
Malware
2 external

References

mitre-attack
C0016
open
Cylance Dust Storm
https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf
open