MITRE ATT&CKcampaign
C0006 Operation Honeybee
- Domain
- enterprise
- Version
- 1.1
- Created
- 2022-09-16
Description
Operation Honeybee was a campaign that targeted humanitarian aid and inter-Korean affairs organizations from at least late 2017 through early 2018. Operation Honeybee initially targeted South Korea, but expanded to include Vietnam, Singapore, Japan, Indonesia, Argentina, and Canada. Security researchers assessed the threat actors were likely Korean speakers based on metadata used in both lure documents and executables, and named the campaign "Honeybee" after the author name discovered in malicious Word documents.
Related
Uses · MITRE ATT&CK (33)
- T1027.013 Encrypted/Encoded File sub-technique
- T1583.004 Server sub-technique
- T1585.002 Email Accounts sub-technique
- T1588.004 Digital Certificates sub-technique
- T1583.001 Domains sub-technique
- S0464 SYSCON software (malware)
- T1071.002 File Transfer Protocols sub-technique
- T1074.001 Local Data Staging sub-technique
- T1574.011 Services Registry Permissions Weakness sub-technique
- T1204.002 Malicious File sub-technique
- T1569.002 Service Execution sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1059.005 Visual Basic sub-technique
- T1560.001 Archive via Utility sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1553.002 Code Signing sub-technique
- T1070.004 File Deletion sub-technique
- T1548.002 Bypass User Account Control sub-technique
- T1543.003 Windows Service sub-technique
- T1140 Deobfuscate/Decode Files or Information technique
- S0057 Tasklist software (tool)
- S0075 Reg software (tool)
- S0096 Systeminfo software (tool)
- S0106 cmd software (tool)
- T1005 Data from Local System technique
- T1036 Masquerading technique
- T1041 Exfiltration Over C2 Channel technique
- T1057 Process Discovery technique
- T1082 System Information Discovery technique
- T1083 File and Directory Discovery technique