Operation Honeybee

Campaign overview

MITRE ATT&CK historical record. Dates reflect source observations. Current activity and target-region classification are not asserted; Global denotes unclassified catalogue coverage. Operation Honeybee was a campaign that targeted humanitarian aid and inter-Korean affairs organizations from at least late 2017 through early 2018. Operation Honeybee initially targeted South Korea, but expanded to include Vietnam, Singapore, Japan, Indonesia, Argentina, and Canada. Security researchers assessed the threat actors were likely Korean speakers based on metadata used in both lure documents and executables, and named the campaign "Honeybee" after the author name discovered in malicious Word documents.(Citation: McAfee Honeybee)

This is a historical record and does not establish current campaign activity.

Threat actor

Not established

Attribution confidence

Not established

First documented activity

2017-08-01

End date

Not established

Estimated victims

Not established

Reported impact

Not established

Unknown attribution, confidence and impact remain unspecified. Regional labels can include unspecified targets; assess the source evidence before acting.

Documented timeline

1. 2017-08-01

   Source-reported first observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

2. 2018-02-01

   Source-reported last observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

MITRE ATT&CK techniques

• T1585.002 · Email Accounts

  Resource Development — During Operation Honeybee, attackers created email addresses to register for a free account for a control server used for the implants.(Citation: McAfee Honeybee)

• T1083 · File and Directory Discovery

  Discovery — During Operation Honeybee, the threat actors used a malicious DLL to search for files with specific keywords.(Citation: McAfee Honeybee)

• T1106 · Native API

  Execution — During Operation Honeybee, the threat actors deployed malware that used API calls, including `CreateProcessAsUser`.(Citation: McAfee Honeybee)

• T1070.004 · File Deletion

  Stealth — During Operation Honeybee, the threat actors used batch files that reduced their fingerprint on a compromised system by deleting malware-related files.(Citation: McAfee Honeybee)

• T1074.001 · Local Data Staging

  Collection — During Operation Honeybee, stolen data was copied into a text file using the format `From <COMPUTER-NAME> (<Month>-<Day> <Hour>-<Minute>-<Second>).txt` prior to compression, encoding, and exfiltration.(Citation: McAfee Honeybee)

• T1583.001 · Domains

  Resource Development — During Operation Honeybee, threat actors registered domains for C2.(Citation: McAfee Honeybee)

• T1027.013 · Encrypted/Encoded File

  Stealth — During Operation Honeybee, the threat actors used Base64 to encode files with a custom key.(Citation: McAfee Honeybee)

• T1553.002 · Code Signing

  Defense Impairment — During Operation Honeybee, the threat actors deployed the MaoCheng dropper with a stolen Adobe Systems digital signature.(Citation: McAfee Honeybee)

• T1041 · Exfiltration Over C2 Channel

  Exfiltration — During Operation Honeybee, the threat actors uploaded stolen files to their C2 servers.(Citation: McAfee Honeybee)

• T1112 · Modify Registry

  Defense Impairment, Persistence — During Operation Honeybee, the threat actors used batch files that modified registry keys.(Citation: McAfee Honeybee)

• T1059.003 · Windows Command Shell

  Execution — During Operation Honeybee, various implants used batch scripting and `cmd.exe` for execution.(Citation: McAfee Honeybee)

• T1082 · System Information Discovery

  Discovery — During Operation Honeybee, the threat actors collected the computer name, OS, and other system information using `cmd /c systeminfo > %temp%\ temp.ini`.(Citation: McAfee Honeybee)

• T1569.002 · Service Execution

  Execution — During Operation Honeybee, threat actors ran <code>sc start</code> to start the COMSysApp as part of the service hijacking and <code>sc stop</code> to stop and reconfigure the COMSysApp.(Citation: McAfee Honeybee)

• T1560.001 · Archive via Utility

  Collection — During Operation Honeybee, the threat actors uses zip to pack collected files before exfiltration.(Citation: McAfee Honeybee)

• T1574.011 · Services Registry Permissions Weakness

  Stealth, Execution — During Operation Honeybee, the threat actors used a batch file that modified the COMSysApp service to load a malicious ipnet.dll payload and to load a DLL into the `svchost.exe` process.(Citation: McAfee Honeybee)

• T1588.004 · Digital Certificates

  Resource Development — For Operation Honeybee, the threat actors stole a digital signature from Adobe Systems to use with their MaoCheng dropper.(Citation: McAfee Honeybee)

• T1071.002 · File Transfer Protocols

  Command And Control — During Operation Honeybee, the threat actors had the ability to use FTP for C2.(Citation: McAfee Honeybee)

• T1548.002 · Bypass User Account Control

  Privilege Escalation — During Operation Honeybee, the threat actors used the malicious NTWDBLIB.DLL and `cliconfig.exe` to bypass UAC protections.(Citation: McAfee Honeybee)

• T1005 · Data from Local System

  Collection — During Operation Honeybee, the threat actors collected data from compromised hosts.(Citation: McAfee Honeybee)

• T1543.003 · Windows Service

  Persistence, Privilege Escalation — During Operation Honeybee, threat actors installed DLLs and backdoors as Windows services.(Citation: McAfee Honeybee)

• T1583.004 · Server

  Resource Development — For Operation Honeybee, at least one identified persona was used to register for a free account for a control server.(Citation: McAfee Honeybee)

• T1036.005 · Match Legitimate Resource Name or Location

  Stealth — During Operation Honeybee, the threat actors used a legitimate Windows executable and secure directory for their payloads to bypass UAC.(Citation: McAfee Honeybee)

• T1204.002 · Malicious File

  Execution — During Operation Honeybee, threat actors relied on a victim to enable macros within a malicious Word document.(Citation: McAfee Honeybee)

• T1105 · Ingress Tool Transfer

  Command And Control — During Operation Honeybee, the threat actors downloaded additional malware and malicious scripts onto a compromised host.(Citation: McAfee Honeybee)

• T1059.005 · Visual Basic

  Execution — For Operation Honeybee, the threat actors used a Visual Basic script embedded within a Word document to download an implant.(Citation: McAfee Honeybee)

• T1057 · Process Discovery

  Discovery — During Operation Honeybee, the threat actors obtained a list of running processes on a victim machine using `cmd /c tasklist > %temp%\temp.ini`.(Citation: McAfee Honeybee)

• T1140 · Deobfuscate/Decode Files or Information

  Stealth — During Operation Honeybee, malicious files were decoded prior to execution.(Citation: McAfee Honeybee)

• T1036 · Masquerading

  Stealth — During Operation Honeybee, the threat actors modified the MaoCheng dropper so its icon appeared as a Word document.(Citation: McAfee Honeybee)

Linked indicators

0 reviewed indicators. An indicator’s presence does not establish that every resource on shared infrastructure is malicious.

No reviewed indicators are supplied. None are inferred from the campaign description.

Documented infrastructure

No reviewed infrastructure is supplied.

Sources and evidence

• MITRE ATT&CK C0006

  Official MITRE ATT&CK campaign record C0006. Derived from mitre/cti commit 50be388e93819a5d20e71cbaaeccfda157abc846. Actor links and technique mappings are attributed to this source; confidence, victims, monetary impact and infrastructure are not inferred.

External sources retain their own licences and sharing conditions. Request a correction with supporting evidence.