C0006: Operation Honeybee
Operation Honeybee was a campaign that targeted humanitarian aid and inter-Korean affairs organizations from at least late 2017 through early 2018. Operation Honeybee initially targeted South Korea, but expanded to include Vietnam, Singapore, Japan, Indonesia, Argentina, and Canada. Security researchers assessed the threat actors were likely Korean speakers based on metadata used in both lure documents and executables, and named the campaign "Honeybee" after the author name discovered in malicious Word documents.CitationMcAfee Honeybee
Security context for executives and security teams
Operation Honeybee is an ATT&CK campaign describing activity from late 2017 to early 2018 against humanitarian aid and inter-Korean affairs organizations, initially in South Korea and later in several other countries. Its defensive value is less about a current threat claim and more about validating whether the organization can recognize a document-led intrusion that moves from user execution into Windows command-line activity, discovery, registry changes, local staging, tool transfer, command-and-control, and possible exfiltration.
Executive priority
Leaders should treat this as a readiness test for high-risk social-engineering scenarios involving mission-focused lures and sensitive data. The priority questions are: can the business prove it collects enough endpoint, email/document, command-line, registry, service, and network evidence to reconstruct this chain; can incident responders quickly determine whether data was staged or exfiltrated; and are controls around user-opened files, Windows administration utilities, and outbound file-transfer-style traffic auditable enough for compliance and crisis decision-making?
Technical view
ATT&CK provides no campaign-specific detection text and no platform on the campaign object itself. Relationship context, however, links Operation Honeybee to Windows-relevant software and behaviors including cmd, Reg, Tasklist, Systeminfo, SYSCON, malicious files, Visual Basic execution, registry modification, Windows service persistence, process/system/file discovery, local data staging, ingress tool transfer, C2 over file transfer protocols, exfiltration over C2, encoded files, masquerading, decoding, and file deletion. SOC and IR teams should validate chained visibility rather than single indicators: user-opened document or file events followed by script or command-shell execution, discovery utilities, registry/service changes, suspicious file writes or staging directories, tool download/transfer, cleanup, and outbound communications consistent with C2 or file-transfer protocols.
Likely telemetry
- Email security and attachment metadata, especially document delivery and user-open events where available
- Endpoint process creation telemetry with command-line arguments for cmd, tasklist, systeminfo, reg, Visual Basic-related execution, and child processes from document applications
- Windows Registry audit events for added, modified, or removed keys and values
- Windows service creation or modification events, including service binary paths and recovery commands
- File system events for encoded or masqueraded files, dropped tools, local staging locations, and file deletion
Detection direction
- Build detections around behavior chains, not only campaign names or historical indicators, because the ATT&CK object does not provide detection logic.
- Prioritize correlations where a user-opened file is followed by command-shell, Visual Basic, registry, service, discovery, staging, or network transfer activity.
- Tune for legitimate administrative use of cmd, reg, tasklist, and systeminfo; the detection value increases when these utilities execute from unusual parent processes, user contexts, paths, or time windows.
- Validate coverage for masquerading and encoded files by checking whether file names, locations, metadata, and decoded content are captured sufficiently for investigation.
- Review outbound file transfer protocol visibility and whether exfiltration over an existing C2 channel would be distinguishable from normal business traffic.
Mitigation priorities
- Strengthen controls and user safeguards for malicious files, including attachment handling, document execution restrictions, and user reporting workflows.
- Harden and monitor Windows administrative utilities and scripting paths used in the relationship context, especially cmd, reg, Visual Basic execution paths, service creation, and registry modification.
- Ensure endpoint logging captures process command lines, registry changes, service changes, file writes/deletions, and parent-child process relationships needed for reconstruction.
- Restrict and monitor unnecessary outbound file transfer protocols and investigate unusual external transfers from endpoints that recently executed suspicious files or discovery commands.
- Prepare IR playbooks that quickly answer whether sensitive local data was discovered, staged, transferred in, transferred out, or deleted.
Additional notes and limits
The supplied ATT&CK description identifies targeting of humanitarian aid and inter-Korean affairs organizations from late 2017 through early 2018, with expansion across several countries. Researchers assessed the actors were likely Korean speakers based on metadata in lure documents and executables, but this take does not extend that into attribution beyond the supplied wording. The strongest defensive signal comes from the related techniques and software rather than from campaign-specific detection guidance.
ATT&CK provides no official detection section, no campaign-level tactics, and no campaign-level platforms for this object. Several related techniques list broad platform coverage, but local applicability depends on the environment. Any coverage statement requires validation against the organization’s actual telemetry, controls, retention, and normal administrative behavior.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Operation Honeybee
Operation Honeybee was a campaign that targeted humanitarian aid and inter-Korean affairs organizations from at least late 2017 through early 2018. Operation Honeybee initially targeted South Korea, but expanded to include Vietnam, Singapore, Japan, Indonesia, Argentina, and Canada. Security researchers assessed the threat actors were likely Korean speakers based on metadata used in both lure documents and executables, and named the campaign "Honeybee" after the author name discovered in malicious Word documents.CitationMcAfee Honeybee
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.