MITRE ATT&CKcampaign
C0014 Operation Wocao
- Domain
- enterprise
- Version
- 1.2
- Created
- 2022-09-27
Description
Operation Wocao was a cyber espionage campaign that targeted organizations around the world, including in Brazil, China, France, Germany, Italy, Mexico, Portugal, Spain, the United Kingdom, and the United States. The suspected China-based actors compromised government organizations and managed service providers, as well as aviation, construction, energy, finance, health care, insurance, offshore engineering, software development, and transportation companies.
Security researchers assessed the Operation Wocao actors used similar TTPs and tools as APT20, suggesting a possible overlap. Operation Wocao was named after an observed command line entry by one of the threat actors, possibly out of frustration from losing webshell access.
Related
Uses · MITRE ATT&CK (79)
- T1685.005 Clear Windows Event Logs sub-technique
- T1686.003 Windows Host Firewall sub-technique
- T1680 Local Storage Discovery technique
- T1027.010 Command Obfuscation sub-technique
- S0645 Wevtutil software (tool)
- T1016.001 Internet Connection Discovery sub-technique
- T1555.005 Password Managers sub-technique
- S0521 BloodHound software (tool)
- T1589 Gather Victim Identity Information technique
- T1583.004 Server sub-technique
- T1585.002 Email Accounts sub-technique
- T1587.001 Malware sub-technique
- T1588.002 Tool sub-technique
- T1027.005 Indicator Removal from Tools sub-technique
- T1573.002 Asymmetric Cryptography sub-technique
- T1071.001 Web Protocols sub-technique
- T1090.001 Internal Proxy sub-technique
- T1090.003 Multi-hop Proxy sub-technique
- T1571 Non-Standard Port technique
- T1074.001 Local Data Staging sub-technique
- T1078.002 Domain Accounts sub-technique
- T1078.003 Local Accounts sub-technique
- T1069.001 Local Groups sub-technique
- T1570 Lateral Tool Transfer technique
- T1569.002 Service Execution sub-technique
- T1059.001 PowerShell sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1059.005 Visual Basic sub-technique
- T1059.006 Python sub-technique
- T1087.002 Domain Account sub-technique
References
- https://www.fox-it.com/media/kadlze5c/201912_report_operation_wocao.pdf FoxIT Wocao December 2019