Operation Wocao

Campaign overview

MITRE ATT&CK historical record. Dates reflect source observations. Current activity and target-region classification are not asserted; Global denotes unclassified catalogue coverage. Operation Wocao was a cyber espionage campaign that targeted organizations around the world, including in Brazil, China, France, Germany, Italy, Mexico, Portugal, Spain, the United Kingdom, and the United States. The suspected China-based actors compromised government organizations and managed service providers, as well as aviation, construction, energy, finance, health care, insurance, offshore engineering, software development, and transportation companies.(Citation: FoxIT Wocao December 2019) Security researchers assessed the Operation Wocao actors used similar TTPs and tools as APT20, suggesting a possible overlap. Operation Wocao was named after an observed command line entry by one of the threat actors, possibly out of frustration from losing webshell access.(Citation: FoxIT Wocao December 2019)

This is a historical record and does not establish current campaign activity.

Threat actor

Not established

Attribution confidence

Not established

First documented activity

2017-12-01

End date

Not established

Estimated victims

Not established

Reported impact

Not established

Unknown attribution, confidence and impact remain unspecified. Regional labels can include unspecified targets; assess the source evidence before acting.

Documented timeline

1. 2017-12-01

   Source-reported first observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

2. 2019-12-01

   Source-reported last observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

MITRE ATT&CK techniques

• T1012 · Query Registry

  Discovery — During Operation Wocao, the threat actors executed `/c cd /d c:\windows\temp\ & reg query HKEY_CURRENT_USER\Software\<username>\PuTTY\Sessions\` to detect recent PuTTY sessions, likely to further lateral movement.(Citation: FoxIT Wocao December 2019)

• T1003.001 · LSASS Memory

  Credential Access — During Operation Wocao, threat actors used ProcDump to dump credentials from memory.(Citation: FoxIT Wocao December 2019)

• T1056.001 · Keylogging

  Collection, Credential Access — During Operation Wocao, threat actors obtained the password for the victim's password manager via a custom keylogger.(Citation: FoxIT Wocao December 2019)

• T1518.001 · Security Software Discovery

  Discovery — During Operation Wocao, threat actors used scripts to detect security software.(Citation: FoxIT Wocao December 2019)

• T1018 · Remote System Discovery

  Discovery — During Operation Wocao, threat actors used `nbtscan` and `ping` to discover remote systems, as well as `dsquery subnet` on a domain controller to retrieve all subnets in the Active Directory.(Citation: FoxIT Wocao December 2019)

• T1573.002 · Asymmetric Cryptography

  Command And Control — During Operation Wocao, threat actors' proxy implementation "Agent" upgraded the socket in use to a TLS socket.(Citation: FoxIT Wocao December 2019)

• T1587.001 · Malware

  Resource Development — During Operation Wocao, threat actors developed their own custom webshells to upload to compromised servers.(Citation: FoxIT Wocao December 2019)

• T1059.003 · Windows Command Shell

  Execution — During Operation Wocao, threat actors spawned a new `cmd.exe` process to execute commands.(Citation: FoxIT Wocao December 2019)

• T1555.005 · Password Managers

  Credential Access — During Operation Wocao, threat actors accessed and collected credentials from password managers.(Citation: FoxIT Wocao December 2019)

• T1552.004 · Private Keys

  Credential Access — During Operation Wocao, threat actors used Mimikatz to dump certificates and private keys from the Windows certificate store.(Citation: FoxIT Wocao December 2019)

• T1119 · Automated Collection

  Collection — During Operation Wocao, threat actors used a script to collect information about the infected system.(Citation: FoxIT Wocao December 2019)

• T1049 · System Network Connections Discovery

  Discovery — During Operation Wocao, threat actors collected a list of open connections on the infected system using `netstat` and checks whether it has an internet connection.(Citation: FoxIT Wocao December 2019)

• T1585.002 · Email Accounts

  Resource Development — For Operation Wocao, the threat actors registered email accounts to use during the campaign.(Citation: FoxIT Wocao December 2019)

• T1124 · System Time Discovery

  Discovery — During Operation Wocao, threat actors used the `time` command to retrieve the current time of a compromised system.(Citation: FoxIT Wocao December 2019)

• T1571 · Non-Standard Port

  Command And Control — During Operation Wocao, the threat actors used uncommon high ports for its backdoor C2, including ports 25667 and 47000.(Citation: FoxIT Wocao December 2019)

• T1686.003 · Windows Host Firewall

  Defense Impairment — During Operation Wocao, threat actors used PowerShell to add and delete rules in the Windows firewall.(Citation: FoxIT Wocao December 2019)

• T1111 · Multi-Factor Authentication Interception

  Credential Access — During Operation Wocao, threat actors used a custom collection method to intercept two-factor authentication soft tokens.(Citation: FoxIT Wocao December 2019)

• T1190 · Exploit Public-Facing Application

  Initial Access — During Operation Wocao, threat actors gained initial access by exploiting vulnerabilities in JBoss webservers.(Citation: FoxIT Wocao December 2019)

• T1090.003 · Multi-hop Proxy

  Command And Control — During Operation Wocao, threat actors executed commands through the installed web shell via Tor exit nodes.(Citation: FoxIT Wocao December 2019)

• T1074.001 · Local Data Staging

  Collection — During Operation Wocao, threat actors staged archived files in a temporary directory prior to exfiltration.(Citation: FoxIT Wocao December 2019)

• T1033 · System Owner/User Discovery

  Discovery — During Operation Wocao, threat actors enumerated sessions and users on a remote host, and identified privileged users logged into a targeted system.(Citation: FoxIT Wocao December 2019)

• T1071.001 · Web Protocols

  Command And Control — During Operation Wocao, threat actors’ XServer tool communicated using HTTP and HTTPS.(Citation: FoxIT Wocao December 2019)

• T1569.002 · Service Execution

  Execution — During Operation Wocao, threat actors created services on remote systems for execution purposes.(Citation: FoxIT Wocao December 2019)

• T1005 · Data from Local System

  Collection — During Operation Wocao, threat actors exfiltrated files and directories of interest from the targeted system.(Citation: FoxIT Wocao December 2019)

• T1115 · Clipboard Data

  Collection — During Operation Wocao, threat actors collected clipboard data in plaintext.(Citation: FoxIT Wocao December 2019)

• T1583.004 · Server

  Resource Development — For Operation Wocao, the threat actors purchased servers with Bitcoin to use during the operation.(Citation: FoxIT Wocao December 2019)

• T1560.001 · Archive via Utility

  Collection — During Operation Wocao, threat actors archived collected files with WinRAR, prior to exfiltration.(Citation: FoxIT Wocao December 2019)

• T1106 · Native API

  Execution — During Operation Wocao, threat actors used the `CreateProcessA` and `ShellExecute` API functions to launch commands after being injected into a selected process.(Citation: FoxIT Wocao December 2019)

• T1069.001 · Local Groups

  Discovery — During Operation Wocao, threat actors used the command `net localgroup administrators` to list all administrators part of a local group.(Citation: FoxIT Wocao December 2019)

• T1078 · Valid Accounts

  Stealth, Persistence, Privilege Escalation, Initial Access — During Operation Wocao, threat actors used valid VPN credentials to gain initial access.(Citation: FoxIT Wocao December 2019)

• T1135 · Network Share Discovery

  Discovery — During Operation Wocao, threat actors discovered network disks mounted to the system using netstat.(Citation: FoxIT Wocao December 2019)

• T1070.004 · File Deletion

  Stealth — During Operation Wocao, the threat actors consistently removed traces of their activity by first overwriting a file using `/c cd /d c:\windows\temp\ & copy \\<IP ADDRESS>\c$\windows\system32\devmgr.dll \\<IP ADDRESS>\c$\windows\temp\LMAKSW.ps1 /y` and then deleting the overwritten file using `/c cd /d c:\windows\temp\ & del \\<IP ADDRESS>\c$\windows\temp\LMAKSW.ps1`.(Citation: FoxIT Wocao December 2019)

• T1685.005 · Clear Windows Event Logs

  Defense Impairment — During Operation Wocao, the threat actors deleted all Windows system and security event logs using `/Q /c wevtutil cl system` and `/Q /c wevtutil cl security`.(Citation: FoxIT Wocao December 2019)

• T1001 · Data Obfuscation

  Command And Control — During Operation Wocao, threat actors encrypted IP addresses used for "Agent" proxy hops with RC4.(Citation: FoxIT Wocao December 2019)

• T1588.002 · Tool

  Resource Development — For Operation Wocao, the threat actors obtained a variety of open source tools, including JexBoss, KeeThief, and BloodHound.(Citation: FoxIT Wocao December 2019)

• T1558.003 · Kerberoasting

  Credential Access — During Operation Wocao, threat actors used PowerSploit's `Invoke-Kerberoast` module to request encrypted service tickets and bruteforce the passwords of Windows service accounts offline.(Citation: FoxIT Wocao December 2019)

• T1021.002 · SMB/Windows Admin Shares

  Lateral Movement — During Operation Wocao, threat actors used Impacket's smbexec.py as well as accessing the C$ and IPC$ shares to move laterally.(Citation: FoxIT Wocao December 2019)

• T1570 · Lateral Tool Transfer

  Lateral Movement — During Operation Wocao, threat actors used SMB to copy files to and from target systems.(Citation: FoxIT Wocao December 2019)

• T1059.005 · Visual Basic

  Execution — During Operation Wocao, threat actors used VBScript to conduct reconnaissance on targeted systems.(Citation: FoxIT Wocao December 2019)

• T1016.001 · Internet Connection Discovery

  Discovery — During Operation Wocao, threat actors used a Visual Basic script that checked for internet connectivity.(Citation: FoxIT Wocao December 2019)

• T1087.002 · Domain Account

  Discovery — During Operation Wocao, threat actors used the `net` command to retrieve information about domain accounts.(Citation: FoxIT Wocao December 2019)

• T1078.002 · Domain Accounts

  Stealth, Persistence, Privilege Escalation, Initial Access — During Operation Wocao, threat actors used domain credentials, including domain admin, for lateral movement and privilege escalation.(Citation: FoxIT Wocao December 2019)

• T1055 · Process Injection

  Stealth, Privilege Escalation — During Operation Wocao, threat actors injected code into a selected process, which in turn launches a command as a child process of the original.(Citation: FoxIT Wocao December 2019)

• T1083 · File and Directory Discovery

  Discovery — During Operation Wocao, threat actors gathered a recursive directory listing to find files and directories of interest.(Citation: FoxIT Wocao December 2019)

• T1589 · Gather Victim Identity Information

  Reconnaissance — During Operation Wocao, threat actors targeted people based on their organizational roles and privileges.(Citation: FoxIT Wocao December 2019)

• T1059.006 · Python

  Execution — During Operation Wocao, threat actors' backdoors were written in Python and compiled with py2exe.(Citation: FoxIT Wocao December 2019)

• T1112 · Modify Registry

  Defense Impairment, Persistence — During Operation Wocao, the threat actors enabled Wdigest by changing the `HKLM\SYSTEM\\ControlSet001\\Control\\SecurityProviders\\WDigest` registry value from 0 (disabled) to 1 (enabled).(Citation: FoxIT Wocao December 2019)

• T1090.001 · Internal Proxy

  Command And Control — During Operation Wocao, threat actors proxied traffic through multiple infected systems.(Citation: FoxIT Wocao December 2019)

• T1090 · Proxy

  Command And Control — During Operation Wocao, threat actors used a custom proxy tool called "Agent" which has support for multiple hops.(Citation: FoxIT Wocao December 2019)

• T1041 · Exfiltration Over C2 Channel

  Exfiltration — During Operation Wocao, threat actors used the XServer backdoor to exfiltrate data.(Citation: FoxIT Wocao December 2019)

• T1036.005 · Match Legitimate Resource Name or Location

  Stealth — During Operation Wocao, the threat actors renamed some tools and executables to appear as legitimate programs.(Citation: FoxIT Wocao December 2019)

• T1007 · System Service Discovery

  Discovery — During Operation Wocao, threat actors used the `tasklist` command to search for one of its backdoors.(Citation: FoxIT Wocao December 2019)

• T1120 · Peripheral Device Discovery

  Discovery — During Operation Wocao, threat actors discovered removable disks attached to a system.(Citation: FoxIT Wocao December 2019)

• T1003.006 · DCSync

  Credential Access — During Operation Wocao, threat actors used Mimikatz's DCSync to dump credentials from the memory of the targeted system.(Citation: FoxIT Wocao December 2019)

• T1027.005 · Indicator Removal from Tools

  Stealth — During Operation Wocao, threat actors edited variable names within the Impacket suite to avoid automated detection.(Citation: FoxIT Wocao December 2019)

• T1053.005 · Scheduled Task

  Execution, Persistence, Privilege Escalation — During Operation Wocao, threat actors used scheduled tasks to execute malicious PowerShell code on remote systems.(Citation: FoxIT Wocao December 2019)

• T1082 · System Information Discovery

  Discovery — During Operation Wocao, threat actors discovered the OS versions of systems connected to a targeted network.(Citation: FoxIT Wocao December 2019)

• T1027.010 · Command Obfuscation

  Stealth — During Operation Wocao, threat actors executed PowerShell commands which were encoded or compressed using Base64, zlib, and XOR.(Citation: FoxIT Wocao December 2019)

• T1059.001 · PowerShell

  Execution — During Operation Wocao, threat actors used PowerShell on compromised systems.(Citation: FoxIT Wocao December 2019)

• T1047 · Windows Management Instrumentation

  Execution — During Operation Wocao, threat actors has used WMI to execute commands.(Citation: FoxIT Wocao December 2019)

• T1046 · Network Service Discovery

  Discovery — During Operation Wocao, threat actors scanned for open ports and used nbtscan to find NETBIOS nameservers.(Citation: FoxIT Wocao December 2019)

• T1095 · Non-Application Layer Protocol

  Command And Control — During Operation Wocao, threat actors used a custom protocol for command and control.(Citation: FoxIT Wocao December 2019)

• T1016 · System Network Configuration Discovery

  Discovery — During Operation Wocao, threat actors discovered the local network configuration with `ipconfig`.(Citation: FoxIT Wocao December 2019)

• T1133 · External Remote Services

  Persistence, Initial Access — During Operation Wocao, threat actors used stolen credentials to connect to the victim's network via VPN.(Citation: FoxIT Wocao December 2019)

• T1505.003 · Web Shell

  Persistence — During Operation Wocao, threat actors used their own web shells, as well as those previously placed on target systems by other threat actors, for reconnaissance and lateral movement.(Citation: FoxIT Wocao December 2019)

• T1518 · Software Discovery

  Discovery — During Operation Wocao, threat actors collected a list of installed software on the infected system.(Citation: FoxIT Wocao December 2019)

• T1680 · Local Storage Discovery

  Discovery — During Operation Wocao, threat actors discovered the local disks attached to the system and their hardware information including manufacturer and model.(Citation: FoxIT Wocao December 2019)

• T1105 · Ingress Tool Transfer

  Command And Control — During Operation Wocao, threat actors downloaded additional files to the infected system.(Citation: FoxIT Wocao December 2019)

• T1078.003 · Local Accounts

  Stealth, Persistence, Privilege Escalation, Initial Access — During Operation Wocao, threat actors used local account credentials found during the intrusion for lateral movement and privilege escalation.(Citation: FoxIT Wocao December 2019)

• T1057 · Process Discovery

  Discovery — During Operation Wocao, the threat actors used `tasklist` to collect a list of running processes on an infected system.(Citation: FoxIT Wocao December 2019)

Linked indicators

0 reviewed indicators. An indicator’s presence does not establish that every resource on shared infrastructure is malicious.

No reviewed indicators are supplied. None are inferred from the campaign description.

Documented infrastructure

No reviewed infrastructure is supplied.

Sources and evidence

• MITRE ATT&CK C0014

  Official MITRE ATT&CK campaign record C0014. Derived from mitre/cti commit 50be388e93819a5d20e71cbaaeccfda157abc846. Actor links and technique mappings are attributed to this source; confidence, victims, monetary impact and infrastructure are not inferred.

External sources retain their own licences and sharing conditions. Request a correction with supporting evidence.