Operation CuckooBees was a cyber espionage campaign targeting technology and manufacturing companies in East Asia, Western Europe, and North America since at least 2019. Security researchers noted the goal of Operation CuckooBees, which was still ongoing as of May 2022, was likely the theft of proprietary information, research and development documents, source code, and blueprints for various technologies. Researchers assessed Operation CuckooBees was conducted by actors affiliated with Winnti Group, APT41, and BARIUM.[1]
33
TechniquesTop 11%
10
Tactics68th pct
2
Tools & malware63rd pct
0
Threat groupsNone recorded
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
During Operation CuckooBees, the threat actors leveraged a custom tool to dump OS credentials and used following commands: reg save HKLM\\SYSTEM system.hiv, reg save HKLM\\SAM sam.hiv, and reg save HKLM\\SECURITY security.hiv, to dump SAM, SYSTEM and SECURITY hives.2
Reach is how much of ATT&CK this campaign touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 56 ATT&CK campaigns only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
Reach
Techniques33Top 11%
89th percentile · 89% of 56 ATT&CK campaigns have this many Enterprise techniques or fewer.
Tactics1068th pct
68th percentile · 68% of 56 ATT&CK campaigns have this many tactics spanned or fewer.
Tools & malware263rd pct
63rd percentile · 63% of 56 ATT&CK campaigns have this many tools and malware or fewer.
Threat groups055% tie · 3 values
55% of the population shares a single value across only 3 distinct values, so a percentile here would rank the tie, not the entity.
Coverage
Rules / technique29medTop 16%
84th percentile · 84% of 56 ATT&CK campaigns have this many detection rules per technique or fewer.
Tests / technique7medTop 5%
95th percentile · 95% of 56 ATT&CK campaigns have this many atomic tests per technique or fewer.
Data comps / technique4med43% tie · 7 values
43% of the population shares a single value across only 7 distinct values, so a percentile here would rank the tie, not the entity.
Mitigations / technique1med38th pct
38th percentile · 62% of 56 ATT&CK campaigns have more mitigations per technique.
6 of 8 axes carry an honest rank on this page. Coverage medians are taken across this campaign’s 33 Enterprise techniques.
Range
Technique Campaign use over its cumulative rule count.
The following analytic identifies access to the /api/v1/configuration/users/user-roles/user-role/rest-userrole1/web/web-bookmarks/bookmark endpoint, which is associated with CVE-2023-46805 and CVE-2024-21887 vulnerabilities. (...)
The following analytic detects potential exploitation of the Adobe ColdFusion vulnerability, CVE-2023-26360, which allows unauthenticated arbitrary file read. (...)
Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.
The following analytic detects the execution of tools commonly exploited by cybercriminals, such as those used for unauthorized access, network scanning, privilege escalation, password dumping or data exfiltration. (...)
The following analytic detects the assignment of high-risk Graph API permissions in Azure AD, specifically Application.ReadWrite.All, AppRoleAssignment.ReadWrite.All, and RoleManagement.ReadWrite.Directory. (...)