C0012: Operation CuckooBees
Operation CuckooBees was a cyber espionage campaign targeting technology and manufacturing companies in East Asia, Western Europe, and North America since at least 2019. Security researchers noted the goal of Operation CuckooBees, which was still ongoing as of May 2022, was likely the theft of proprietary information, research and development documents, source code, and blueprints for various technologies. Researchers assessed Operation CuckooBees was conducted by actors affiliated with Winnti Group, APT41, and BARIUM.[1]
Security context for executives and security teams
C0012: Operation CuckooBees describes [Operation CuckooBees](https://attack.mitre.org/campaigns/C0012) was a cyber espionage campaign targeting technology and manufacturing companies in East Asia, Western Europe, and North America since at least 2019. Security researchers noted the goal of [Operation CuckooBees](https://attack.mitre.org/campaigns/C0012), which was still ongoing as of May 2022, was likely the theft of proprietary information, research and development documents, source code, and blueprints for various technologies. Researchers assessed [...
Executive priority
C0012: Operation CuckooBees is an official MITRE ATT&CK campaign. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.
Technical view
Security teams should validate C0012: Operation CuckooBees by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (the platforms named in the official object), and available local telemetry before making detection or mitigation decisions.
Likely telemetry
- Official ATT&CK relationships and object metadata
Detection direction
- Validate whether C0012: Operation CuckooBees appears in your detection coverage and tabletop scenarios.
- Use the object to align executive risk language with SOC, incident response, and detection engineering work.
- Do not treat ATT&CK relationship context as attribution without corroborating evidence.
Mitigation priorities
- Map the object to existing controls and identify missing telemetry or response ownership.
- Prioritize mitigations that reduce exposure on the listed platforms and tactics.
- Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits
Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.
This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Operation CuckooBees
Operation CuckooBees was a cyber espionage campaign targeting technology and manufacturing companies in East Asia, Western Europe, and North America since at least 2019. Security researchers noted the goal of Operation CuckooBees, which was still ongoing as of May 2022, was likely the theft of proprietary information, research and development documents, source code, and blueprints for various technologies. Researchers assessed Operation CuckooBees was conducted by actors affiliated with Winnti Group, APT41, and BARIUM.[1]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1120 | Peripheral Device Discovery | During Operation CuckooBees, the threat actors used the `fsutil fsinfo drives` command as part of their advanced reconnaissance.[1] |
| Enterprise | T1018 | Remote System Discovery | During Operation CuckooBees, the threat actors used the `net view` and `ping` commands as part of their advanced reconnaissance.[1] |
| Enterprise | T1543.003 | Windows ServiceSub-technique | During Operation CuckooBees, the threat actors modified the `IKEEXT` and `PrintNotify` Windows services for persistence.[1] |
| Enterprise | T1560.001 | Archive via UtilitySub-technique | During Operation CuckooBees, the threat actors used the Makecab utility to compress and a version of WinRAR to create password-protected archives of stolen data prior to exfiltration.[1] |
| Enterprise | T1133 | External Remote Services | During Operation CuckooBees, the threat actors enabled WinRM over HTTP/HTTPS as a backup persistence mechanism using the following command: `cscript //nologo "C:\Windows\System32\winrm.vbs" set winrm/config/service@{EnableCompatibilityHttpsListener="true"}`.[1] |
| Enterprise | T1083 | File and Directory Discovery | During Operation CuckooBees, the threat actors used `dir c:\\` to search for files.[1] |
| Enterprise | T1082 | System Information Discovery | During Operation CuckooBees, the threat actors used the `systeminfo` command to gather details about a compromised system.[1] |
| Enterprise | T1124 | System Time Discovery | During Operation CuckooBees, the threat actors used the `net time` command as part of their advanced reconnaissance.[1] |
| Enterprise | T1078.002 | Domain AccountsSub-technique | During Operation CuckooBees, the threat actors used compromised domain administrator credentials as part of their lateral movement.[1] |
| Enterprise | T1016 | System Network Configuration Discovery | During Operation CuckooBees, the threat actors used `ipconfig`, `nbtstat`, `tracert`, `route print`, and `cat /etc/hosts` commands.[1] |
| Enterprise | T1201 | Password Policy Discovery | During Operation CuckooBees, the threat actors used the `net accounts` command as part of their advanced reconnaissance.[1] |
| Enterprise | T1588.002 | ToolSub-technique | For Operation CuckooBees, the threat actors obtained publicly-available JSP code that was used to deploy a webshell onto a compromised server.[1] |
| Enterprise | T1036.005 | Match Legitimate Resource Name or LocationSub-technique | During Operation CuckooBees, the threat actors renamed a malicious executable to `rundll32.exe` to allow it to blend in with other Windows system files.[1] |
| Enterprise | T1087.001 | Local AccountSub-technique | During Operation CuckooBees, the threat actors used the `net user` command to gather account information.[1] |
| Enterprise | T1033 | System Owner/User Discovery | During Operation CuckooBees, the threat actors used the `query user` and `whoami` commands as part of their advanced reconnaissance.[1] |
| Enterprise | T1027.010 | Command ObfuscationSub-technique | During Operation CuckooBees, the threat actors executed an encoded VBScript file.[1] |
| Enterprise | T1087.002 | Domain AccountSub-technique | During Operation CuckooBees, the threat actors used the `dsquery` and `dsget` commands to get domain environment information and to query users in administrative groups.[1] |
| Enterprise | T1053.005 | Scheduled TaskSub-technique | During Operation CuckooBees, the threat actors used scheduled tasks to execute batch scripts for lateral movement with the following command: `SCHTASKS /Create /S /U /p /SC ONCE /TN test /TR /ST /RU SYSTEM.`[1] |
| Enterprise | T1190 | Exploit Public-Facing Application | During Operation CuckooBees, the threat actors exploited multiple vulnerabilities in externally facing servers.[1] |
| Enterprise | T1069.001 | Local GroupsSub-technique | During Operation CuckooBees, the threat actors used the `net group` command as part of their advanced reconnaissance.[1] |
| Enterprise | T1027.011 | Fileless StorageSub-technique | During Operation CuckooBees, the threat actors stroed payloads in Windows CLFS (Common Log File System) transactional logs.[1] |
| Enterprise | T1059.003 | Windows Command ShellSub-technique | During Operation CuckooBees, the threat actors used batch scripts to perform reconnaissance.[1] |
| Enterprise | T1505.003 | Web ShellSub-technique | During Operation CuckooBees, the threat actors generated a web shell within a vulnerable Enterprise Resource Planning Web Application Server as a persistence mechanism.[1] |
| Enterprise | T1003.002 | Security Account ManagerSub-technique | During Operation CuckooBees, the threat actors leveraged a custom tool to dump OS credentials and used following commands: `reg save HKLM\\SYSTEM system.hiv`, `reg save HKLM\\SAM sam.hiv`, and `reg save HKLM\\SECURITY security.hiv`, to dump SAM, SYSTEM and SECURITY hives.[1] |
| Enterprise | T1071.001 | Web ProtocolsSub-technique | During Operation CuckooBees, the threat actors enabled HTTP and HTTPS listeners.[1] |
| Enterprise | T1049 | System Network Connections Discovery | During Operation CuckooBees, the threat actors used the `net session`, `net use`, and `netstat` commands as part of their advanced reconnaissance.[1] |
| Enterprise | T1059.005 | Visual BasicSub-technique | During Operation CuckooBees, the threat actors executed an encoded VBScript file using `wscript` and wrote the decoded output to a text file.[1] |
| Enterprise | T1135 | Network Share Discovery | During Operation CuckooBees, the threat actors used the `net share` command as part of their advanced reconnaissance.[1] |
| Enterprise | T1574.001 | DLLSub-technique | During Operation CuckooBees, the threat actors used the legitimate Windows services `IKEEXT` and `PrintNotify` to side-load malicious DLLs.[1] |
| Enterprise | T1057 | Process Discovery | During Operation CuckooBees, the threat actors used the `tasklist` command as part of their advanced reconnaissance.[1] |
| Enterprise | T1547.006 | Kernel Modules and ExtensionsSub-technique | During Operation CuckooBees, attackers used a signed kernel rootkit to establish additional persistence.[1] |
| Enterprise | T1007 | System Service Discovery | During Operation CuckooBees, the threat actors used the `net start` command as part of their initial reconnaissance.[1] |
| Enterprise | T1005 | Data from Local System | During Operation CuckooBees, the threat actors collected data, files, and other information from compromised networks.[1] |
Groups, software, and campaigns
S0105: dsquery
dsquery is a command-line utility that can be used to query Active Directory for information from a system within a domain. [1] It is typically installed only on Windows Server versions but can be installed on non-server variants through the Microsoft-provided Remote Server Administration Tools bundle.
S0096: Systeminfo
Systeminfo is a Windows utility that can be used to gather detailed information about a computer. [1]
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(3)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 20.0 | 1.1 | Current bundle | 97134851237d… | ||
| 19.2 | 1.1 | Older bundle | 97134851237d… | ||
| 19.1 | 1.1 | Older bundle | 9f48d5ffdee7… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]Cybereason OperationCuckooBees May 2022
Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.
Open source URL - [2]mitre-attackC0012Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.