Threat intelligence / Campaign

Operation Honeybee

[Operation Honeybee](https://attack.mitre.org/campaigns/C0006) was a campaign that targeted humanitarian aid and inter-Korean affairs organizations from at least late 2017 through early 2018. [Operation Honeybee](https://attack.mitre.org/campaigns/C0006) initially targeted South Korea, but expanded to include Vietnam, Singapore, Japan, Indonesia, Argentina, and Canada. Security researchers assessed the threat actors were likely Korean speakers based on metadata used in both lure documents and executables, and named the campaign "Honeybee" after the author name discovered in malicious Word documents.(Citation: McAfee Honeybee)

Campaign

TypeCampaign

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

33 recorded

Relationships

uses

to Archive via Utility

Technique

uses

to Bypass User Account Control

Technique

uses

to cmd

Tool

uses

to Code Signing

Technique

uses

to Data from Local System

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Digital Certificates

Technique

uses

to Domains

Technique

uses

to Email Accounts

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to File Transfer Protocols

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Local Data Staging

Technique

uses

to Malicious File

Technique

uses

to Masquerading

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Modify Registry

Technique

uses

to Native API

Technique

uses

to Process Discovery

Technique

uses

to Reg

Tool

uses

to Server

Technique

uses

to Service Execution

Technique

uses

to Services Registry Permissions Weakness

Technique

uses

to SYSCON

Malware

uses

to Systeminfo

Tool

uses

to System Information Discovery

Technique

uses

to Tasklist

Tool

uses

to Visual Basic

Technique

uses

to Windows Command Shell

Technique

uses

to Windows Service

Technique

2 external

References

mitre-attack

C0006

open

McAfee Honeybee

https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-uncovers-operation-honeybee-malicious-document-campaign-targeting-humanitarian-aid-groups/

open