MITRE ATT&CKcampaign

C0012 Operation CuckooBees

Published 2022-09-22 Modified 2026-07-31 Official page ↗
Domain
enterprise
Version
1.1
Created
2022-09-22

Description

Operation CuckooBees was a cyber espionage campaign targeting technology and manufacturing companies in East Asia, Western Europe, and North America since at least 2019. Security researchers noted the goal of Operation CuckooBees, which was still ongoing as of May 2022, was likely the theft of proprietary information, research and development documents, source code, and blueprints for various technologies. Researchers assessed Operation CuckooBees was conducted by actors affiliated with Winnti Group, APT41, and BARIUM.

Related

Uses · MITRE ATT&CK (35)

  • T1027.011 Fileless Storage sub-technique
  • T1027.010 Command Obfuscation sub-technique
  • T1588.002 Tool sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1078.002 Domain Accounts sub-technique
  • T1574.001 DLL sub-technique
  • T1069.001 Local Groups sub-technique
  • T1059.003 Windows Command Shell sub-technique
  • T1059.005 Visual Basic sub-technique
  • T1087.001 Local Account sub-technique
  • T1087.002 Domain Account sub-technique
  • T1560.001 Archive via Utility sub-technique
  • T1003.002 Security Account Manager sub-technique
  • T1036.005 Match Legitimate Resource Name or Location sub-technique
  • T1547.006 Kernel Modules and Extensions sub-technique
  • T1543.003 Windows Service sub-technique
  • T1505.003 Web Shell sub-technique
  • T1053.005 Scheduled Task sub-technique
  • T1190 Exploit Public-Facing Application technique
  • T1201 Password Policy Discovery technique
  • T1135 Network Share Discovery technique
  • S0096 Systeminfo software (tool)
  • S0105 dsquery software (tool)
  • T1005 Data from Local System technique
  • T1007 System Service Discovery technique
  • T1016 System Network Configuration Discovery technique
  • T1018 Remote System Discovery technique
  • T1033 System Owner/User Discovery technique
  • T1049 System Network Connections Discovery technique
  • T1057 Process Discovery technique
Show all 35 ›

References