Threat intelligence / Campaign

Operation CuckooBees

[Operation CuckooBees](https://attack.mitre.org/campaigns/C0012) was a cyber espionage campaign targeting technology and manufacturing companies in East Asia, Western Europe, and North America since at least 2019. Security researchers noted the goal of [Operation CuckooBees](https://attack.mitre.org/campaigns/C0012), which was still ongoing as of May 2022, was likely the theft of proprietary information, research and development documents, source code, and blueprints for various technologies. Researchers assessed [Operation CuckooBees](https://attack.mitre.org/campaigns/C0012) was conducted by actors affiliated with [Winnti Group](https://attack.mitre.org/groups/G0044), [APT41](https://attack.mitre.org/groups/G0096), and BARIUM.(Citation: Cybereason OperationCuckooBees May 2022)

Campaign

TypeCampaign

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Operation CuckooBees](https://attack.mitre.org/campaigns/C0012) was a cyber espionage campaign targeting technology and manufacturing companies in East Asia, Western Europe, and North America since at least 2019. Security researchers noted the goal of [Operation CuckooBees](https://attack.mitre.org/campaigns/C0012), which was still ongoing as of May 2022, was likely the theft of proprietary information, research and development documents, source code, and blueprints for various technologies. Researchers assessed [Operation CuckooBees](https://attack.mitre.org/campaigns/C0012) was conducted by actors affiliated with [Winnti Group](https://attack.mitre.org/groups/G0044), [APT41](https://attack.mitre.org/groups/G0096), and BARIUM.(Citation: Cybereason OperationCuckooBees May 2022)

35 recorded

Relationships

uses

to Archive via Utility

Technique

uses

to Command Obfuscation

Technique

uses

to Data from Local System

Technique

uses

to DLL

Technique

uses

to Domain Account

Technique

uses

to Domain Accounts

Technique

uses

Tool

uses

to Exploit Public-Facing Application

Technique

uses

to External Remote Services

Technique

uses

to File and Directory Discovery

Technique

uses

to Fileless Storage

Technique

uses

to Kernel Modules and Extensions

Technique

uses

to Local Account

Technique

uses

to Local Groups

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Network Share Discovery

Technique

uses

to Password Policy Discovery

Technique

uses

to Peripheral Device Discovery

Technique

uses

to Process Discovery

Technique

uses

to Remote System Discovery

Technique

uses

to Scheduled Task

Technique

uses

to Security Account Manager

Technique

uses

Tool

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Network Connections Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to System Service Discovery

Technique

uses

to System Time Discovery

Technique

uses

Technique

uses

to Visual Basic

Technique

uses

to Web Protocols

Technique

uses

Technique

uses

to Windows Command Shell

Technique

uses

to Windows Service

Technique

2 external

References

mitre-attack

C0012

Cybereason OperationCuckooBees May 2022

https://www.cybereason.com/blog/operation-cuckoobees-deep-dive-into-stealthy-winnti-techniques