Operation CuckooBees

Campaign overview

MITRE ATT&CK historical record. Dates reflect source observations. Current activity and target-region classification are not asserted; Global denotes unclassified catalogue coverage. Operation CuckooBees was a cyber espionage campaign targeting technology and manufacturing companies in East Asia, Western Europe, and North America since at least 2019. Security researchers noted the goal of Operation CuckooBees, which was still ongoing as of May 2022, was likely the theft of proprietary information, research and development documents, source code, and blueprints for various technologies. Researchers assessed Operation CuckooBees was conducted by actors affiliated with Winnti Group, APT41, and BARIUM.(Citation: Cybereason OperationCuckooBees May 2022)

This is a historical record and does not establish current campaign activity.

Threat actor

Not established

Attribution confidence

Not established

First documented activity

2019-12-01

End date

Not established

Estimated victims

Not established

Reported impact

Not established

Unknown attribution, confidence and impact remain unspecified. Regional labels can include unspecified targets; assess the source evidence before acting.

Documented timeline

1. 2019-12-01

   Source-reported first observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

2. 2022-05-01

   Source-reported last observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

MITRE ATT&CK techniques

• T1120 · Peripheral Device Discovery

  Discovery — During Operation CuckooBees, the threat actors used the `fsutil fsinfo drives` command as part of their advanced reconnaissance.(Citation: Cybereason OperationCuckooBees May 2022)

• T1018 · Remote System Discovery

  Discovery — During Operation CuckooBees, the threat actors used the `net view` and `ping` commands as part of their advanced reconnaissance.(Citation: Cybereason OperationCuckooBees May 2022)

• T1543.003 · Windows Service

  Persistence, Privilege Escalation — During Operation CuckooBees, the threat actors modified the `IKEEXT` and `PrintNotify` Windows services for persistence.(Citation: Cybereason OperationCuckooBees May 2022)

• T1560.001 · Archive via Utility

  Collection — During Operation CuckooBees, the threat actors used the Makecab utility to compress and a version of WinRAR to create password-protected archives of stolen data prior to exfiltration.(Citation: Cybereason OperationCuckooBees May 2022)

• T1133 · External Remote Services

  Persistence, Initial Access — During Operation CuckooBees, the threat actors enabled WinRM over HTTP/HTTPS as a backup persistence mechanism using the following command: `cscript //nologo "C:\Windows\System32\winrm.vbs" set winrm/config/service@{EnableCompatibilityHttpsListener="true"}`.(Citation: Cybereason OperationCuckooBees May 2022)

• T1083 · File and Directory Discovery

  Discovery — During Operation CuckooBees, the threat actors used `dir c:\\` to search for files.(Citation: Cybereason OperationCuckooBees May 2022)

• T1082 · System Information Discovery

  Discovery — During Operation CuckooBees, the threat actors used the `systeminfo` command to gather details about a compromised system.(Citation: Cybereason OperationCuckooBees May 2022)

• T1124 · System Time Discovery

  Discovery — During Operation CuckooBees, the threat actors used the `net time` command as part of their advanced reconnaissance.(Citation: Cybereason OperationCuckooBees May 2022)

• T1078.002 · Domain Accounts

  Stealth, Persistence, Privilege Escalation, Initial Access — During Operation CuckooBees, the threat actors used compromised domain administrator credentials as part of their lateral movement.(Citation: Cybereason OperationCuckooBees May 2022)

• T1016 · System Network Configuration Discovery

  Discovery — During Operation CuckooBees, the threat actors used `ipconfig`, `nbtstat`, `tracert`, `route print`, and `cat /etc/hosts` commands.(Citation: Cybereason OperationCuckooBees May 2022)

• T1201 · Password Policy Discovery

  Discovery — During Operation CuckooBees, the threat actors used the `net accounts` command as part of their advanced reconnaissance.(Citation: Cybereason OperationCuckooBees May 2022)

• T1588.002 · Tool

  Resource Development — For Operation CuckooBees, the threat actors obtained publicly-available JSP code that was used to deploy a webshell onto a compromised server.(Citation: Cybereason OperationCuckooBees May 2022)

• T1036.005 · Match Legitimate Resource Name or Location

  Stealth — During Operation CuckooBees, the threat actors renamed a malicious executable to `rundll32.exe` to allow it to blend in with other Windows system files.(Citation: Cybereason OperationCuckooBees May 2022)

• T1087.001 · Local Account

  Discovery — During Operation CuckooBees, the threat actors used the `net user` command to gather account information.(Citation: Cybereason OperationCuckooBees May 2022)

• T1033 · System Owner/User Discovery

  Discovery — During Operation CuckooBees, the threat actors used the `query user` and `whoami` commands as part of their advanced reconnaissance.(Citation: Cybereason OperationCuckooBees May 2022)

• T1027.010 · Command Obfuscation

  Stealth — During Operation CuckooBees, the threat actors executed an encoded VBScript file.(Citation: Cybereason OperationCuckooBees May 2022)

• T1087.002 · Domain Account

  Discovery — During Operation CuckooBees, the threat actors used the `dsquery` and `dsget` commands to get domain environment information and to query users in administrative groups.(Citation: Cybereason OperationCuckooBees May 2022)

• T1053.005 · Scheduled Task

  Execution, Persistence, Privilege Escalation — During Operation CuckooBees, the threat actors used scheduled tasks to execute batch scripts for lateral movement with the following command: `SCHTASKS /Create /S <IP Address> /U <Username> /p <Password> /SC ONCE /TN test /TR <Path to a Batch File> /ST <Time> /RU SYSTEM.`(Citation: Cybereason OperationCuckooBees May 2022)

• T1190 · Exploit Public-Facing Application

  Initial Access — During Operation CuckooBees, the threat actors exploited multiple vulnerabilities in externally facing servers.(Citation: Cybereason OperationCuckooBees May 2022)

• T1069.001 · Local Groups

  Discovery — During Operation CuckooBees, the threat actors used the `net group` command as part of their advanced reconnaissance.(Citation: Cybereason OperationCuckooBees May 2022)

• T1027.011 · Fileless Storage

  Stealth — During Operation CuckooBees, the threat actors stroed payloads in Windows CLFS (Common Log File System) transactional logs.(Citation: Cybereason OperationCuckooBees May 2022)

• T1059.003 · Windows Command Shell

  Execution — During Operation CuckooBees, the threat actors used batch scripts to perform reconnaissance.(Citation: Cybereason OperationCuckooBees May 2022)

• T1505.003 · Web Shell

  Persistence — During Operation CuckooBees, the threat actors generated a web shell within a vulnerable Enterprise Resource Planning Web Application Server as a persistence mechanism.(Citation: Cybereason OperationCuckooBees May 2022)

• T1003.002 · Security Account Manager

  Credential Access — During Operation CuckooBees, the threat actors leveraged a custom tool to dump OS credentials and used following commands: `reg save HKLM\\SYSTEM system.hiv`, `reg save HKLM\\SAM sam.hiv`, and `reg save HKLM\\SECURITY security.hiv`, to dump SAM, SYSTEM and SECURITY hives.(Citation: Cybereason OperationCuckooBees May 2022)

• T1071.001 · Web Protocols

  Command And Control — During Operation CuckooBees, the threat actors enabled HTTP and HTTPS listeners.(Citation: Cybereason OperationCuckooBees May 2022)

• T1049 · System Network Connections Discovery

  Discovery — During Operation CuckooBees, the threat actors used the `net session`, `net use`, and `netstat` commands as part of their advanced reconnaissance.(Citation: Cybereason OperationCuckooBees May 2022)

• T1059.005 · Visual Basic

  Execution — During Operation CuckooBees, the threat actors executed an encoded VBScript file using `wscript` and wrote the decoded output to a text file.(Citation: Cybereason OperationCuckooBees May 2022)

• T1135 · Network Share Discovery

  Discovery — During Operation CuckooBees, the threat actors used the `net share` command as part of their advanced reconnaissance.(Citation: Cybereason OperationCuckooBees May 2022)

• T1574.001 · DLL

  Stealth, Execution — During Operation CuckooBees, the threat actors used the legitimate Windows services `IKEEXT` and `PrintNotify` to side-load malicious DLLs.(Citation: Cybereason OperationCuckooBees May 2022)

• T1057 · Process Discovery

  Discovery — During Operation CuckooBees, the threat actors used the `tasklist` command as part of their advanced reconnaissance.(Citation: Cybereason OperationCuckooBees May 2022)

• T1547.006 · Kernel Modules and Extensions

  Persistence, Privilege Escalation — During Operation CuckooBees, attackers used a signed kernel rootkit to establish additional persistence.(Citation: Cybereason OperationCuckooBees May 2022)

• T1007 · System Service Discovery

  Discovery — During Operation CuckooBees, the threat actors used the `net start` command as part of their initial reconnaissance.(Citation: Cybereason OperationCuckooBees May 2022)

• T1005 · Data from Local System

  Collection — During Operation CuckooBees, the threat actors collected data, files, and other information from compromised networks.(Citation: Cybereason OperationCuckooBees May 2022)

Linked indicators

0 reviewed indicators. An indicator’s presence does not establish that every resource on shared infrastructure is malicious.

No reviewed indicators are supplied. None are inferred from the campaign description.

Documented infrastructure

No reviewed infrastructure is supplied.

Sources and evidence

• MITRE ATT&CK C0012

  Official MITRE ATT&CK campaign record C0012. Derived from mitre/cti commit 50be388e93819a5d20e71cbaaeccfda157abc846. Actor links and technique mappings are attributed to this source; confidence, victims, monetary impact and infrastructure are not inferred.

External sources retain their own licences and sharing conditions. Request a correction with supporting evidence.