Operation Wocao | Threat Actor Index

Techniques

Malware Used

Attributed Groups

Tactics Covered

About This Campaign

Operation Wocao was a cyber espionage campaign that targeted organizations around the world, including in Brazil, China, France, Germany, Italy, Mexico, Portugal, Spain, the United Kingdom, and the United States. The suspected China-based actors compromised government organizations and managed service providers, as well as aviation, construction, energy, finance, health care, insurance, offshore engineering, software development, and transportation companies. Security researchers assessed the Operation Wocao actors used similar TTPs and tools as APT20, suggesting a possible overlap. Operation Wocao was named after an observed command line entry by one of the threat actors, possibly out of frustration from losing webshell access.

Techniques by Tactic (70)

Reconnaissance

T1589 Gather Victim Identity Information

Resource Development

T1583.004 ServerT1585.002 Email AccountsT1587.001 MalwareT1588.002 Tool

Initial Access

T1078 Valid AccountsT1078.002 Domain AccountsT1078.003 Local AccountsT1133 External Remote ServicesT1190 Exploit Public-Facing Application

Execution

T1047 Windows Management InstrumentationT1053.005 Scheduled TaskT1059.001 PowerShellT1059.003 Windows Command ShellT1059.005 Visual BasicT1059.006 PythonT1106 Native APIT1569.002 Service Execution

Persistence

T1053.005 Scheduled TaskT1078 Valid AccountsT1078.002 Domain AccountsT1078.003 Local AccountsT1112 Modify RegistryT1133 External Remote ServicesT1505.003 Web Shell

Privilege Escalation