Adobe attack

On J2 January, Adobe learned of "a computer security incident involving a sophisticated, coordinated attack against corporate network systems managed by Adobe and other companies," the company said in a blog post published just minutes after Google went public with its account of the hacking incident. An Adobe spokeswoman declined to comment on whether or not the Google and Adobe attacks were related.

Other companies that have been hit include "Internet, finance, technology, media and chemical sectors," Drummond said.

On Tuesday Yahoo - another likely target - declined to say whether it had been hit, but the company did issue a brief statement in support of Google. These "kinds of attacks are deeply disturbing," Yahoo said.

Microsoft said even less about the incident. "We have no indication that any of our mail properties have been compromised," the company said via email.

"We've never seen any attacks that were on this large of a scale and were this successful against private companies," said Eli Jellenc, head of international threat intelligence with Verisign's iDefense security unit.

IDefense was called in to help some of the victim companies that Google had uncovered. According to Jellenc, the hackers sent targeted e-mail messages to victims that contained a malicious attachment containing what's known as a zero-day attack.

These attacks are typically not detected by antivirus vendors because they exploit a previously unknown software bug.

"There is an attack exploiting a zero-day vulnerability in one of the major document types," Jellenc said. "They infect whichever users they can, and leverage any contact information or any access information on the victim's computer to misrepresent themselves as that victim." The goal is to "infect someone with administrative access to the systems that hold the intellectual property that they're trying to obtain," he added.

Once they have the data they move it out of the corporate network.

The attacks followed the same game plan that security experts have seen in attacks on non-governmental organizations and the defense industry, where contractors and government agencies have been hit with similar targeted spying attacks for years now. Some of Verisign's defense partners said that they'd seen some of the same IP addresses used in previous, "very similar attacks," Jellenc said.

"Whomever is doing this, this isn't their first attack," he said. "These contractors also confirmed the China origin of the attacks."

This type of attack was described in detail in an October Northrop Grumman report, (PDF) commissioned by the US-China Economic and Security Review Commission. Analysts concluded that "China is likely using its maturing computer network exploitation capability to support intelligence collection against the U.S. government and industry by conducting a long term, sophisticated computer network exploitation campaign."

At least 10 to 20 terabytes of sensitive data had been taken from U.S. government networks as part of what the report's authors called a "long term, persistent campaign to collect sensitive but unclassified information."

For the past few years, China has been focused on moving its economy to the next level, said James Mulvenon, director of Defense Group Inc.'s Center for Intelligence Research and Analysis. China built its economy processing products for export, but it is not known for cutting-edge research and development.

The country has been taking steps to spur innovation within its borders, pressuring multinational companies to build research labs in China and developing the talent to eventually replace these businesses with indigenous competitors.

Mulvenon doesn't find it implausible that a nation such as China would spy on U.S. companies.

"If you're having trouble [innovating] or if you want to prime the pump, the best way is to go out and steal cutting-edge IP," he said. "It's a plausible explanation for why they would go after Silicon Valley companies on such a broad scale because they're really trying to jump start IT innovation in China."

John Ribeiro in Bangalore and Jeremy Kirk in London contributed to this story.