🇻🇳

Honeybee

APT Group Information theft and espionage ETDA ✓

Also Known As 1 names

G0072

Target Countries 7

Countries highlighted in red

Argentina Canada Indonesia Japan Republic of Korea Singapore Vietnam

Sectors Targeted

Those involved in humanitarian aid and inter-Korean affairs

Details

Origin 🇻🇳 VN

Last Updated 01 Jun 2022

MITRE ATT&CK 5

T1047 T1078.001 T1203 T1566.001 T1571

Related Zero-Days

No zero-day CVE linked to this actor

Known Names 2 entries

Honeybee McAfee

G0072 MITRE

Observed Target Countries 7

Based on ETDA data — countries highlighted in red

Argentina Canada Indonesia Japan Singapore South Korea Vietnam

Description

(McAfee) McAfee Advanced Threat Research analysts have discovered a new operation targeting humanitarian aid organizations and using North Korean political topics as bait to lure victims into opening malicious Microsoft Word documents. Our analysts have named this Operation Honeybee, based on the names of the malicious documents used in the attacks. Advanced Threat Research analysts have also discovered malicious documents authored by the same actor that indicate a tactical shift. These documents do not contain the typical lures by this actor, instead using Word compatibility messages to entice victims into opening them. The Advanced Threat Research team also observed a heavy concentration of the implant in Vietnam from January 15–17.

Tools Used 2

Syscon Living off the Land

Reports & References 1

https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/mcafee-uncovers-operation-honeybee-malicious-document-campaign-targeting-humanitarian-aid-groups/

ETDA Profile

Honeybee

Origin

[Unknown]

First Seen 2017

Motivation

Information theft and espionage

MITRE ATT&CK Groups

https://attack.mitre.org/groups/G0072/

View on ETDA APT Groups ↗