LiveActive security incident?Get immediate response
MITRE ATT&CK® Campaign

C0012: Operation CuckooBees

Operation CuckooBees was a cyber espionage campaign targeting technology and manufacturing companies in East Asia, Western Europe, and North America since at least 2019. Security researchers noted the goal of Operation CuckooBees, which was still ongoing as of May 2022, was likely the theft of proprietary information, research and development documents, source code, and blueprints for various technologies. Researchers assessed Operation CuckooBees was conducted by actors affiliated with Winnti Group, APT41, and BARIUM.[1]

EnterpriseC0012CampaignObject v1.1Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

Operation CuckooBees matters because the ATT&CK record describes a long-running cyber espionage campaign focused on technology and manufacturing organizations and likely aimed at stealing proprietary information, R&D documents, source code, and blueprints. For leaders, the decision value is not only “who did it,” but whether the organization can prove it would notice credential access, domain and host discovery, stealthy command execution, persistence through scheduled tasks, and collection from local systems before sensitive intellectual property is staged or removed.

Executive priority

Prioritize this as an intellectual property and operational resilience scenario for technology, manufacturing, engineering, and supply-chain environments. Executives should ask whether crown-jewel repositories, engineering workstations, build systems, file shares, and Active Directory are covered by usable telemetry and response playbooks. The ATT&CK relationships point to identity abuse, credential access, discovery, stealth, persistence, command-and-control over web protocols, and local data collection, making this relevant to incident readiness, IAM control validation, SOC detection quality, and compliance evidence around access monitoring and protection of sensitive data.

Technical view

ATT&CK does not provide a campaign-level detection section, so defenders should validate coverage through the related software and techniques. The relationship set includes Windows and Active Directory-relevant behaviors such as dsquery, Systeminfo, SAM credential access, Windows Command Shell, Visual Basic, scheduled tasks, domain account abuse, account/group discovery, and multiple host/network discovery techniques. SOC and IR teams should test whether they can correlate discovery bursts, unusual command-line activity, scheduled task creation or modification, credential-access indicators involving SAM material, domain account anomalies, suspicious use of administrative utilities, web-protocol C2-like traffic, and access to sensitive local files or repositories.

Likely telemetry

  • Endpoint process creation and command-line logging, especially for command shell, Visual Basic-related execution, systeminfo, dsquery, account/group enumeration, service discovery, and file/directory discovery
  • Windows security events and endpoint telemetry related to SAM access, local account activity, domain account use, and privilege context
  • Active Directory logs for domain account enumeration, dsquery-like activity, unusual LDAP/query patterns, and anomalous domain account authentication
  • Scheduled task creation, modification, execution, and related registry or system event records
  • File access telemetry for sensitive local data, engineering files, source code locations, blueprints, R&D documents, and high-value file shares where available

Detection direction

  • Build detections around behavior chains rather than single utilities: discovery commands followed by credential access, scheduled task persistence, domain account use, and sensitive file access should be higher priority than isolated administrative commands.
  • Tune for false positives from administrators, IT automation, inventory tools, and server management activity; baseline expected use of systeminfo, dsquery, account/group enumeration, service queries, and scheduled tasks by role and host group.
  • Validate visibility into Active Directory and identity telemetry, because the relationship set includes domain account abuse and domain account discovery; endpoint-only monitoring may miss the context needed to distinguish legitimate administration from suspicious reconnaissance.
  • Review whether command obfuscation and masquerading reduce current detection quality; simple string matching may be insufficient when commands are encoded, renamed, or placed in trusted-looking locations.
  • Confirm monitoring covers both host and network discovery, including process, service, network configuration, network connection, remote system, peripheral, file, and directory discovery behaviors.

Mitigation priorities

  • Start with crown-jewel mapping: identify systems and repositories holding proprietary information, R&D documents, source code, and blueprints, then confirm logging, access controls, and response ownership for those assets.
  • Harden identity and Active Directory controls: reduce unnecessary domain privileges, monitor privileged and service accounts, and review domain account authentication patterns for unusual use.
  • Limit credential exposure on endpoints by enforcing least privilege, protecting local administrator access, and monitoring access to SAM-related credential material.
  • Control and audit scheduled task usage, command shell execution, scripting activity, and administrative utilities without blocking legitimate operations blindly.
  • Improve endpoint and network telemetry retention so IR teams can reconstruct discovery, persistence, credential access, and collection sequences across hosts.
Additional notes and limits

The campaign description states targeting of technology and manufacturing companies in East Asia, Western Europe, and North America since at least 2019, with activity reported as ongoing as of May 2022. Researchers assessed affiliation with Winnti Group, APT41, and BARIUM, but this take treats that as source-provided assessment rather than independent attribution. Relationship context is especially useful here because the campaign object itself has no specified platforms, tactics, or detection text.

No official detection guidance is provided for the campaign object, and the campaign-level platforms and tactics are not specified. Telemetry and control recommendations are inferred only from the supplied ATT&CK relationships and official description; local validation is required to determine actual exposure, logging coverage, and detection effectiveness. The supplied fields do not support claiming current activity, customer exposure, guaranteed detection, or confirmed exploitation in any specific environment.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Operation CuckooBees

Operation CuckooBees was a cyber espionage campaign targeting technology and manufacturing companies in East Asia, Western Europe, and North America since at least 2019. Security researchers noted the goal of Operation CuckooBees, which was still ongoing as of May 2022, was likely the theft of proprietary information, research and development documents, source code, and blueprints for various technologies. Researchers assessed Operation CuckooBees was conducted by actors affiliated with Winnti Group, APT41, and BARIUM.[1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

33 rows
DomainIDNameRelationship / procedure
EnterpriseT1120Peripheral Device Discovery

During Operation CuckooBees, the threat actors used the `fsutil fsinfo drives` command as part of their advanced reconnaissance.[1]

EnterpriseT1018Remote System Discovery

During Operation CuckooBees, the threat actors used the `net view` and `ping` commands as part of their advanced reconnaissance.[1]

EnterpriseT1543.003Windows ServiceSub-technique

During Operation CuckooBees, the threat actors modified the `IKEEXT` and `PrintNotify` Windows services for persistence.[1]

EnterpriseT1560.001Archive via UtilitySub-technique

During Operation CuckooBees, the threat actors used the Makecab utility to compress and a version of WinRAR to create password-protected archives of stolen data prior to exfiltration.[1]

EnterpriseT1133External Remote Services

During Operation CuckooBees, the threat actors enabled WinRM over HTTP/HTTPS as a backup persistence mechanism using the following command: `cscript //nologo "C:\Windows\System32\winrm.vbs" set winrm/config/service@{EnableCompatibilityHttpsListener="true"}`.[1]

EnterpriseT1083File and Directory Discovery

During Operation CuckooBees, the threat actors used `dir c:\\` to search for files.[1]

EnterpriseT1082System Information Discovery

During Operation CuckooBees, the threat actors used the `systeminfo` command to gather details about a compromised system.[1]

EnterpriseT1124System Time Discovery

During Operation CuckooBees, the threat actors used the `net time` command as part of their advanced reconnaissance.[1]

EnterpriseT1078.002Domain AccountsSub-technique

During Operation CuckooBees, the threat actors used compromised domain administrator credentials as part of their lateral movement.[1]

EnterpriseT1016System Network Configuration Discovery

During Operation CuckooBees, the threat actors used `ipconfig`, `nbtstat`, `tracert`, `route print`, and `cat /etc/hosts` commands.[1]

EnterpriseT1201Password Policy Discovery

During Operation CuckooBees, the threat actors used the `net accounts` command as part of their advanced reconnaissance.[1]

EnterpriseT1588.002ToolSub-technique

For Operation CuckooBees, the threat actors obtained publicly-available JSP code that was used to deploy a webshell onto a compromised server.[1]

EnterpriseT1036.005Match Legitimate Resource Name or LocationSub-technique

During Operation CuckooBees, the threat actors renamed a malicious executable to `rundll32.exe` to allow it to blend in with other Windows system files.[1]

EnterpriseT1087.001Local AccountSub-technique

During Operation CuckooBees, the threat actors used the `net user` command to gather account information.[1]

EnterpriseT1033System Owner/User Discovery

During Operation CuckooBees, the threat actors used the `query user` and `whoami` commands as part of their advanced reconnaissance.[1]

EnterpriseT1027.010Command ObfuscationSub-technique

During Operation CuckooBees, the threat actors executed an encoded VBScript file.[1]

EnterpriseT1087.002Domain AccountSub-technique

During Operation CuckooBees, the threat actors used the `dsquery` and `dsget` commands to get domain environment information and to query users in administrative groups.[1]

EnterpriseT1053.005Scheduled TaskSub-technique

During Operation CuckooBees, the threat actors used scheduled tasks to execute batch scripts for lateral movement with the following command: `SCHTASKS /Create /S /U /p /SC ONCE /TN test /TR /ST /RU SYSTEM.`[1]

EnterpriseT1190Exploit Public-Facing Application

During Operation CuckooBees, the threat actors exploited multiple vulnerabilities in externally facing servers.[1]

EnterpriseT1069.001Local GroupsSub-technique

During Operation CuckooBees, the threat actors used the `net group` command as part of their advanced reconnaissance.[1]

EnterpriseT1027.011Fileless StorageSub-technique

During Operation CuckooBees, the threat actors stroed payloads in Windows CLFS (Common Log File System) transactional logs.[1]

EnterpriseT1059.003Windows Command ShellSub-technique

During Operation CuckooBees, the threat actors used batch scripts to perform reconnaissance.[1]

EnterpriseT1505.003Web ShellSub-technique

During Operation CuckooBees, the threat actors generated a web shell within a vulnerable Enterprise Resource Planning Web Application Server as a persistence mechanism.[1]

EnterpriseT1003.002Security Account ManagerSub-technique

During Operation CuckooBees, the threat actors leveraged a custom tool to dump OS credentials and used following commands: `reg save HKLM\\SYSTEM system.hiv`, `reg save HKLM\\SAM sam.hiv`, and `reg save HKLM\\SECURITY security.hiv`, to dump SAM, SYSTEM and SECURITY hives.[1]

EnterpriseT1071.001Web ProtocolsSub-technique

During Operation CuckooBees, the threat actors enabled HTTP and HTTPS listeners.[1]

EnterpriseT1049System Network Connections Discovery

During Operation CuckooBees, the threat actors used the `net session`, `net use`, and `netstat` commands as part of their advanced reconnaissance.[1]

EnterpriseT1059.005Visual BasicSub-technique

During Operation CuckooBees, the threat actors executed an encoded VBScript file using `wscript` and wrote the decoded output to a text file.[1]

EnterpriseT1135Network Share Discovery

During Operation CuckooBees, the threat actors used the `net share` command as part of their advanced reconnaissance.[1]

EnterpriseT1574.001DLLSub-technique

During Operation CuckooBees, the threat actors used the legitimate Windows services `IKEEXT` and `PrintNotify` to side-load malicious DLLs.[1]

EnterpriseT1057Process Discovery

During Operation CuckooBees, the threat actors used the `tasklist` command as part of their advanced reconnaissance.[1]

EnterpriseT1547.006Kernel Modules and ExtensionsSub-technique

During Operation CuckooBees, attackers used a signed kernel rootkit to establish additional persistence.[1]

EnterpriseT1007System Service Discovery

During Operation CuckooBees, the threat actors used the `net start` command as part of their initial reconnaissance.[1]

EnterpriseT1005Data from Local System

During Operation CuckooBees, the threat actors collected data, files, and other information from compromised networks.[1]

Associated objects

Groups, software, and campaigns

ToolEnterprise

S0105: dsquery

dsquery is a command-line utility that can be used to query Active Directory for information from a system within a domain. [1] It is typically installed only on Windows Server versions but can be installed on non-server variants through the Microsoft-provided Remote Server Administration Tools bundle.

Windows
Relationship explorer

All related ATT&CK context

uses · TechniqueT1120: Peripheral Device DiscoveryEnterpriseuses · ToolS0105: dsqueryEnterpriseuses · TechniqueT1018: Remote System DiscoveryEnterpriseuses · TechniqueT1543.003: Windows ServiceEnterpriseuses · TechniqueT1560.001: Archive via UtilityEnterpriseuses · TechniqueT1133: External Remote ServicesEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1124: System Time DiscoveryEnterpriseuses · TechniqueT1078.002: Domain AccountsEnterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1201: Password Policy DiscoveryEnterpriseuses · TechniqueT1588.002: ToolEnterpriseuses · TechniqueT1036.005: Match Legitimate Resource Name or LocationEnterpriseuses · TechniqueT1087.001: Local AccountEnterpriseuses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1027.010: Command ObfuscationEnterpriseuses · TechniqueT1087.002: Domain AccountEnterpriseuses · TechniqueT1053.005: Scheduled TaskEnterpriseuses · TechniqueT1190: Exploit Public-Facing ApplicationEnterpriseuses · ToolS0096: SysteminfoEnterpriseuses · TechniqueT1069.001: Local GroupsEnterpriseuses · TechniqueT1027.011: Fileless StorageEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.1
Created
Modified
Raw hash
9f48d5ffdee7aff0...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.1Current bundle9f48d5ffdee7…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  2. [2]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  3. [3]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  4. [4]
    mitre-attackC0012
    Open source URL
  5. [5]
    mitre-attackC0012
    Open source URL
  6. [6]
    mitre-attackC0012
    Open source URL
  7. [7]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  8. [8]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  9. [9]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  10. [10]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  11. [11]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  12. [12]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  13. [13]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  14. [14]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  15. [15]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  16. [16]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  17. [17]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  18. [18]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  19. [19]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  20. [20]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  21. [21]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  22. [22]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  23. [23]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  24. [24]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  25. [25]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  26. [26]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  27. [27]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  28. [28]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  29. [29]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  30. [30]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  31. [31]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  32. [32]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  33. [33]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  34. [34]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  35. [35]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  36. [36]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  37. [37]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  38. [38]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  39. [39]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  40. [40]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  41. [41]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  42. [42]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  43. [43]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  44. [44]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  45. [45]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  46. [46]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  47. [47]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  48. [48]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  49. [49]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  50. [50]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  51. [51]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  52. [52]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  53. [53]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  54. [54]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  55. [55]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  56. [56]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  57. [57]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  58. [58]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  59. [59]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  60. [60]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  61. [61]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  62. [62]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  63. [63]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  64. [64]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  65. [65]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  66. [66]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  67. [67]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  68. [68]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  69. [69]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  70. [70]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  71. [71]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use