Threat intelligence / Campaign

Operation Digital Eye

[Operation Digital Eye](https://attack.mitre.org/campaigns/C0061) was conducted in June and July of 2024 by suspected People's Republic of China (PRC)-nexus threat actors targeting business-to-business IT service providers in Southern Europe. [Operation Digital Eye](https://attack.mitre.org/campaigns/C0061) activity included the use of Visual Studio Code tunnels for command and control (C2) and custom lateral movement capabilities. Overlaps in tooling between Digital Eye and previous China-nexus campaigns, Operation Soft Cell and Operation Tainted Love, indicate the potential use of shared vendors or digital quartermasters.(Citation: sentinelone operationDigitalEye Dec 2024)

Campaign

TypeCampaign

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Operation Digital Eye](https://attack.mitre.org/campaigns/C0061) was conducted in June and July of 2024 by suspected People's Republic of China (PRC)-nexus threat actors targeting business-to-business IT service providers in Southern Europe. [Operation Digital Eye](https://attack.mitre.org/campaigns/C0061) activity included the use of Visual Studio Code tunnels for command and control (C2) and custom lateral movement capabilities. Overlaps in tooling between Digital Eye and previous China-nexus campaigns, Operation Soft Cell and Operation Tainted Love, indicate the potential use of shared vendors or digital quartermasters.(Citation: sentinelone operationDigitalEye Dec 2024)

26 recorded

Relationships

uses

to Exploit Public-Facing Application

Technique

uses

to File Deletion

Technique

uses

to Gather Victim Org Information

Technique

uses

to Hide Infrastructure

Technique

uses

to IDE Tunneling

Technique

uses

to Local Account

Technique

uses

to Local Groups

Technique

uses

to LSASS Memory

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

Tool

uses

Technique

uses

to Pass the Hash

Technique

uses

Malware

uses

Tool

uses

to Remote Desktop Protocol

Technique

uses

to Remote System Discovery

Technique

uses

to Security Account Manager

Technique

uses

to Service Execution

Technique

uses

Tool

uses

to SSH Authorized Keys

Technique

uses

to System Language Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

Technique

uses

Technique

uses

to Windows Command Shell

Technique

uses

to Windows Service

Technique

2 external

References

mitre-attack

C0061

sentinelone operationDigitalEye Dec 2024

https://www.sentinelone.com/labs/operation-digital-eye-chinese-apt-compromises-critical-digital-infrastructure-via-visual-studio-code-tunnels/