During Operation Wocao, threat actors encrypted IP addresses used for "Agent" proxy hops with RC4.3
campaign
Operation Wocao C0014
- First seen
- December 2017
- Last seen
- December 2019
- Created
- 27 September 2022
- Last modified
- 31 July 2026
Operation Wocao was a cyber espionage campaign that targeted organizations around the world, including in Brazil, China, France, Germany, Italy, Mexico, Portugal, Spain, the United Kingdom, and the United States. The suspected China-based actors compromised government organizations and managed service providers, as well as aviation, construction, energy, finance, health care, insurance, offshore engineering, software development, and transportation companies.[1]
Security researchers assessed the Operation Wocao actors used similar TTPs and tools as APT20, suggesting a possible overlap. Operation Wocao was named after an observed command line entry by one of the threat actors, possibly out of frustration from losing webshell access.[2]
70
TechniquesTop 2%
14
TacticsTop 4%
9
Tools & malwareTop 5%
0
Threat groupsNone recorded
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
MITRE reference C0014
During Operation Wocao, threat actors used ProcDump to dump credentials from memory.4
During Operation Wocao, threat actors used Mimikatz's DCSync to dump credentials from the memory of the targeted system.5
During Operation Wocao, threat actors exfiltrated files and directories of interest from the targeted system.6
During Operation Wocao, threat actors used the tasklist command to search for one of its backdoors.7
During Operation Wocao, the threat actors executed /c cd /d c:\windows\temp\ & reg query HKEY_CURRENT_USER\Software\<username>\PuTTY\Sessions\ to detect recent PuTTY sessions, likely to further lateral movement.8
Standing C0014
Reach is how much of ATT&CK this campaign touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 56 ATT&CK campaigns only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
Reach
Techniques70Top 2%
98th percentile · 98% of 56 ATT&CK campaigns have this many Enterprise techniques or fewer.
Tactics14Top 4%
96th percentile · 96% of 56 ATT&CK campaigns have this many tactics spanned or fewer.
Tools & malware9Top 5%
95th percentile · 95% of 56 ATT&CK campaigns have this many tools and malware or fewer.
Threat groups055% tie · 3 values
55% of the population shares a single value across only 3 distinct values, so a percentile here would rank the tie, not the entity.
Coverage
Rules / technique15med57th pct
57th percentile · 57% of 56 ATT&CK campaigns have this many detection rules per technique or fewer.
Tests / technique4med
Detection coverage C0014
2098 distinct rules cover the 70 techniques recorded for this campaign. The 2470 technique-to-rule mappings resolve to 2098 distinct rules, because one rule can cover several techniques. 1404 Sigma · 694 Splunk.
66 covered by at least one rule4 with no coverage2098 distinct rules in total
tf
Loading...Drag headers to reorder | Drag edges to resize
tf
Loading detections...
| Select | Title | Description | Category | Status | Event | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
© 2026 The MITRE Corporation. ATT&CK® and D3FEND™ data reproduced with permission. SigmaHQ detection rules licensed under DRL 1.1. attack.mitre.org · d3fend.mitre.org · CAR analytics licensed under Apache 2.0 · car.mitre.org