Operation Honeybee

Also known asOperation Honeybee

Operation Honeybee is a named intrusion campaign associated with post-compromise host reconnaissance, privilege escalation through User Account Control bypass, file discovery, command-and-control infrastructure setup, and defense-evasion through masquerading. Reported tradecraft includes collecting victim host details such as computer name and operating system information, searching local files for specific keywords, and registering command-and-control domains to support the operation. The campaign also used a malicious DLL together with a legitimate executable to bypass UAC protections, indicating an emphasis on obtaining elevated execution on compromised Windows systems. Additional observed behavior includes modifying a dropper so that it appeared to be a benign document, reflecting the use of masquerading to improve execution success and reduce suspicion. Based on the supplied facts, Operation Honeybee is best characterized as a targeted intrusion campaign with capabilities spanning reconnaissance, privilege escalation, defense evasion, and post-exploitation activity.

Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

Start free trial

MITRE ATT&CK

Tradecraft

8 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

4 of 15 tactics11 techniques×N= number of intelligence reports citing this technique

MITRE ATT&CK

TA0002

Execution

2 techniques

T1059

Command and Scripting Interpreter

T1059.003

Windows Command Shell

T1204

User Execution

T1204.002

Malicious File

TA0004

Privilege Escalation

1 technique

T1548

Abuse Elevation Control Mechanism

T1548.002

Bypass User Account Control

TA0005

Stealth

2 techniques

T1027×2

Obfuscated Files or Information

T1036

Masquerading

TA0007

Discovery

3 techniques

T1057

Process Discovery

T1082

System Information Discovery

T1083

File and Directory Discovery

ACTIVITY FEED

Recent activity

10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

10 SOURCESView more in app

mitre attack websiteNews

Oct 25, 2022

System Information Discovery, Technique T1082 - Enterprise | MITRE ATT&CK®

Campaign in which operators used cmd and systeminfo to collect computer name, OS, and other system details.

mitre attack websiteNews

Oct 15, 2019

Abuse Elevation Control Mechanism: Bypass User Account Control, Sub-technique T1548.002 - Enterprise | MITRE ATT&CK®

Campaign involving UAC bypass using a malicious DLL and cliconfig.exe.

mitre attack websiteNews

Mar 7, 2018

File and Directory Discovery, Technique T1083 - Enterprise | MITRE ATT&CK®

Campaign used a malicious DLL to search for files containing specific keywords.

mitre attack websiteNews

Mar 20, 2015

System Information Discovery, Technique T1082 - Enterprise | MITRE ATT&CK®

Operation involving collection of computer name and OS details using systeminfo redirected to a temp file.

+6 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.

Start free trial

Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping8

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables

Domains, IPs, and hashes tied to this actor, refreshed continuously.

Operation Honeybee

Also known asOperation Honeybee