Threat intelligence / Campaign

Operation Wocao

[Operation Wocao](https://attack.mitre.org/campaigns/C0014) was a cyber espionage campaign that targeted organizations around the world, including in Brazil, China, France, Germany, Italy, Mexico, Portugal, Spain, the United Kingdom, and the United States. The suspected China-based actors compromised government organizations and managed service providers, as well as aviation, construction, energy, finance, health care, insurance, offshore engineering, software development, and transportation companies.(Citation: FoxIT Wocao December 2019) Security researchers assessed the [Operation Wocao](https://attack.mitre.org/campaigns/C0014) actors used similar TTPs and tools as APT20, suggesting a possible overlap. [Operation Wocao](https://attack.mitre.org/campaigns/C0014) was named after an observed command line entry by one of the threat actors, possibly out of frustration from losing webshell access.(Citation: FoxIT Wocao December 2019)

Campaign

TypeCampaign

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Operation Wocao](https://attack.mitre.org/campaigns/C0014) was a cyber espionage campaign that targeted organizations around the world, including in Brazil, China, France, Germany, Italy, Mexico, Portugal, Spain, the United Kingdom, and the United States. The suspected China-based actors compromised government organizations and managed service providers, as well as aviation, construction, energy, finance, health care, insurance, offshore engineering, software development, and transportation companies.(Citation: FoxIT Wocao December 2019) Security researchers assessed the [Operation Wocao](https://attack.mitre.org/campaigns/C0014) actors used similar TTPs and tools as APT20, suggesting a possible overlap. [Operation Wocao](https://attack.mitre.org/campaigns/C0014) was named after an observed command line entry by one of the threat actors, possibly out of frustration from losing webshell access.(Citation: FoxIT Wocao December 2019)

79 recorded

Relationships

uses

to Archive via Utility

Technique

uses

to Asymmetric Cryptography

Technique

uses

to Automated Collection

Technique

uses

Tool

uses

to Clear Windows Event Logs

Technique

uses

to Clipboard Data

Technique

uses

to Command Obfuscation

Technique

uses

to Data from Local System

Technique

uses

to Data Obfuscation

Technique

uses

Technique

uses

to Domain Account

Technique

uses

to Domain Accounts

Technique

uses

Tool

uses

to Email Accounts

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to Exploit Public-Facing Application

Technique

uses

to External Remote Services

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to Gather Victim Identity Information

Technique

uses

Tool

uses

to Indicator Removal from Tools

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Internal Proxy

Technique

uses

to Internet Connection Discovery

Technique

uses

to Kerberoasting

Technique

uses

Technique

uses

to Lateral Tool Transfer

Technique

uses

to Local Accounts

Technique

uses

to Local Data Staging

Technique

uses

to Local Groups

Technique

uses

to Local Storage Discovery

Technique

uses

to LSASS Memory

Technique

uses

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

Tool

uses

to Modify Registry

Technique

uses

to Multi-Factor Authentication Interception

Technique

uses

to Multi-hop Proxy

Technique

uses

Technique

uses

Tool

uses

to Network Service Discovery

Technique

uses

to Network Share Discovery

Technique

uses

to Non-Application Layer Protocol

Technique

uses

to Non-Standard Port

Technique

uses

to Password Managers

Technique

uses

to Peripheral Device Discovery

Technique

uses

Technique

uses

Tool

uses

to Private Keys

Technique

uses

to Process Discovery

Technique

uses

to Process Injection

Technique

uses

Technique

uses

Tool

uses

Technique

uses

to Query Registry

Technique

uses

to Remote System Discovery

Technique

uses

to Scheduled Task

Technique

uses

to Security Software Discovery

Technique

uses

Technique

uses

to Service Execution

Technique

uses

to SMB/Windows Admin Shares

Technique

uses

to Software Discovery

Technique

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Network Connections Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to System Service Discovery

Technique

uses

to System Time Discovery

Technique

uses

Technique

uses

to Tor

Tool

uses

to Valid Accounts

Technique

uses

to Visual Basic

Technique

uses

to Web Protocols

Technique

uses

Technique

uses

Tool

uses

to Windows Command Shell

Technique

uses

to Windows Host Firewall

Technique

uses

to Windows Management Instrumentation

Technique

2 external

References

mitre-attack

C0014

FoxIT Wocao December 2019

https://www.fox-it.com/media/kadlze5c/201912_report_operation_wocao.pdf