C0006: Operation Honeybee
Operation Honeybee was a campaign that targeted humanitarian aid and inter-Korean affairs organizations from at least late 2017 through early 2018. Operation Honeybee initially targeted South Korea, but expanded to include Vietnam, Singapore, Japan, Indonesia, Argentina, and Canada. Security researchers assessed the threat actors were likely Korean speakers based on metadata used in both lure documents and executables, and named the campaign "Honeybee" after the author name discovered in malicious Word documents.[1]
Security context for executives and security teams
C0006: Operation Honeybee describes [Operation Honeybee](https://attack.mitre.org/campaigns/C0006) was a campaign that targeted humanitarian aid and inter-Korean affairs organizations from at least late 2017 through early 2018. [Operation Honeybee](https://attack.mitre.org/campaigns/C0006) initially targeted South Korea, but expanded to include Vietnam, Singapore, Japan, Indonesia, Argentina, and Canada. Security researchers assessed the threat actors were likely Korean speakers based on metadata used in both lure documents and executables, and named...
Executive priority
C0006: Operation Honeybee is an official MITRE ATT&CK campaign. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.
Technical view
Security teams should validate C0006: Operation Honeybee by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (the platforms named in the official object), and available local telemetry before making detection or mitigation decisions.
Likely telemetry
- Official ATT&CK relationships and object metadata
Detection direction
- Validate whether C0006: Operation Honeybee appears in your detection coverage and tabletop scenarios.
- Use the object to align executive risk language with SOC, incident response, and detection engineering work.
- Do not treat ATT&CK relationship context as attribution without corroborating evidence.
Mitigation priorities
- Map the object to existing controls and identify missing telemetry or response ownership.
- Prioritize mitigations that reduce exposure on the listed platforms and tactics.
- Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits
Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.
This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Operation Honeybee
Operation Honeybee was a campaign that targeted humanitarian aid and inter-Korean affairs organizations from at least late 2017 through early 2018. Operation Honeybee initially targeted South Korea, but expanded to include Vietnam, Singapore, Japan, Indonesia, Argentina, and Canada. Security researchers assessed the threat actors were likely Korean speakers based on metadata used in both lure documents and executables, and named the campaign "Honeybee" after the author name discovered in malicious Word documents.[1]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1585.002 | Email AccountsSub-technique | During Operation Honeybee, attackers created email addresses to register for a free account for a control server used for the implants.[1] |
| Enterprise | T1083 | File and Directory Discovery | During Operation Honeybee, the threat actors used a malicious DLL to search for files with specific keywords.[1] |
| Enterprise | T1106 | Native API | During Operation Honeybee, the threat actors deployed malware that used API calls, including `CreateProcessAsUser`.[1] |
| Enterprise | T1070.004 | File DeletionSub-technique | During Operation Honeybee, the threat actors used batch files that reduced their fingerprint on a compromised system by deleting malware-related files.[1] |
| Enterprise | T1074.001 | Local Data StagingSub-technique | During Operation Honeybee, stolen data was copied into a text file using the format `From (- --).txt` prior to compression, encoding, and exfiltration.[1] |
| Enterprise | T1583.001 | DomainsSub-technique | During Operation Honeybee, threat actors registered domains for C2.[1] |
| Enterprise | T1027.013 | Encrypted/Encoded FileSub-technique | During Operation Honeybee, the threat actors used Base64 to encode files with a custom key.[1] |
| Enterprise | T1553.002 | Code SigningSub-technique | During Operation Honeybee, the threat actors deployed the MaoCheng dropper with a stolen Adobe Systems digital signature.[1] |
| Enterprise | T1041 | Exfiltration Over C2 Channel | During Operation Honeybee, the threat actors uploaded stolen files to their C2 servers.[1] |
| Enterprise | T1112 | Modify Registry | During Operation Honeybee, the threat actors used batch files that modified registry keys.[1] |
| Enterprise | T1059.003 | Windows Command ShellSub-technique | During Operation Honeybee, various implants used batch scripting and `cmd.exe` for execution.[1] |
| Enterprise | T1082 | System Information Discovery | During Operation Honeybee, the threat actors collected the computer name, OS, and other system information using `cmd /c systeminfo > %temp%\ temp.ini`.[1] |
| Enterprise | T1569.002 | Service ExecutionSub-technique | During Operation Honeybee, threat actors ran |
| Enterprise | T1560.001 | Archive via UtilitySub-technique | During Operation Honeybee, the threat actors uses zip to pack collected files before exfiltration.[1] |
| Enterprise | T1574.011 | Services Registry Permissions WeaknessSub-technique | During Operation Honeybee, the threat actors used a batch file that modified the COMSysApp service to load a malicious ipnet.dll payload and to load a DLL into the `svchost.exe` process.[1] |
| Enterprise | T1588.004 | Digital CertificatesSub-technique | For Operation Honeybee, the threat actors stole a digital signature from Adobe Systems to use with their MaoCheng dropper.[1] |
| Enterprise | T1071.002 | File Transfer ProtocolsSub-technique | During Operation Honeybee, the threat actors had the ability to use FTP for C2.[1] |
| Enterprise | T1548.002 | Bypass User Account ControlSub-technique | During Operation Honeybee, the threat actors used the malicious NTWDBLIB.DLL and `cliconfig.exe` to bypass UAC protections.[1] |
| Enterprise | T1005 | Data from Local System | During Operation Honeybee, the threat actors collected data from compromised hosts.[1] |
| Enterprise | T1543.003 | Windows ServiceSub-technique | During Operation Honeybee, threat actors installed DLLs and backdoors as Windows services.[1] |
| Enterprise | T1583.004 | ServerSub-technique | For Operation Honeybee, at least one identified persona was used to register for a free account for a control server.[1] |
| Enterprise | T1036.005 | Match Legitimate Resource Name or LocationSub-technique | During Operation Honeybee, the threat actors used a legitimate Windows executable and secure directory for their payloads to bypass UAC.[1] |
| Enterprise | T1204.002 | Malicious FileSub-technique | During Operation Honeybee, threat actors relied on a victim to enable macros within a malicious Word document.[1] |
| Enterprise | T1105 | Ingress Tool Transfer | During Operation Honeybee, the threat actors downloaded additional malware and malicious scripts onto a compromised host.[1] |
| Enterprise | T1059.005 | Visual BasicSub-technique | For Operation Honeybee, the threat actors used a Visual Basic script embedded within a Word document to download an implant.[1] |
| Enterprise | T1057 | Process Discovery | During Operation Honeybee, the threat actors obtained a list of running processes on a victim machine using `cmd /c tasklist > %temp%\temp.ini`.[1] |
| Enterprise | T1140 | Deobfuscate/Decode Files or Information | During Operation Honeybee, malicious files were decoded prior to execution.[1] |
| Enterprise | T1036 | Masquerading | During Operation Honeybee, the threat actors modified the MaoCheng dropper so its icon appeared as a Word document.[1] |
Groups, software, and campaigns
S0464: SYSCON
S0075: Reg
S0057: Tasklist
S0096: Systeminfo
Systeminfo is a Windows utility that can be used to gather detailed information about a computer. [1]
S0106: cmd
cmd is the Windows command-line interpreter that can be used to interact with systems and execute other processes and utilities. [1]
Cmd.exe contains native functionality to perform many operations to interact with the system, including listing files in a directory (e.g., dir [2]), deleting files (e.g., del [3]), and copying files (e.g., copy [4]).
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(2)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.2 | 1.1 | Current bundle | b5ce5df35345… | ||
| 19.1 | 1.1 | Older bundle | e91e1bb369de… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]McAfee Honeybee
Sherstobitoff, R. (2018, March 02). McAfee Uncovers Operation Honeybee, a Malicious Document Campaign Targeting Humanitarian Aid Groups. Retrieved May 16, 2018.
Open source URL - [2]mitre-attackC0006Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.