H3XAOperational intelligence
Live analytical pictureEvidence before assessment
TypeGroup
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[Operation Wocao](https://attack.mitre.org/groups/G0116) described activities carried out by a China-based cyber espionage adversary. [Operation Wocao](https://attack.mitre.org/groups/G0116) targeted entities within the government, managed service providers, energy, health care, and technology sectors across several countries, including China, France, Germany, the United Kingdom, and the United States. [Operation Wocao](https://attack.mitre.org/groups/G0116) used similar TTPs and tools to APT20, suggesting a possible overlap.(Citation: FoxIT Wocao December 2019)

0 recorded

Relationships

No relationships recorded.

3 external

References

mitre-attack
G0116
open
Operation Wocao
—
FoxIT Wocao December 2019
https://www.fox-it.com/media/kadlze5c/201912_report_operation_wocao.pdf
open