Operation CuckooBees
Campaign · ATTACK:enterprise:C0012
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:C0012",
"title": "Operation CuckooBees",
"type": "Campaign",
"source_url": "https://attack.mitre.org/campaigns/C0012",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "campaign--93c23946-49af-41f4-ac03-40f9ffc7419b",
"external_id": "C0012",
"domain": "enterprise",
"created": "2022-09-22T20:07:47.208Z",
"modified": "2026-07-31T18:47:27.459Z",
"version": "1.1",
"aliases": [
"Operation CuckooBees"
],
"tactics": [
],
"source_references": [
{
"source_name": "Cybereason OperationCuckooBees May 2022",
"url": "https://www.cybereason.com/blog/operation-cuckoobees-deep-dive-into-stealthy-winnti-techniques"
}
]
}Explicit source assertions (35)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1120
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0882cca9-ed77-4c71-85e4-78988d79236f
Cybereason OperationCuckooBees May 2022ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:S0105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0c994481-fe49-4961-8b21-2864e391c85e
Cybereason OperationCuckooBees May 2022ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1018
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0d6b67b8-016a-4335-89f1-2cdb7ed778c1
Cybereason OperationCuckooBees May 2022ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1543.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--128ecd12-77db-4117-be2f-2bf5476de670
Cybereason OperationCuckooBees May 2022ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1560.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--12ee5148-c274-4c94-a0da-69316cb329d2
Cybereason OperationCuckooBees May 2022ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1133
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1b85db78-5473-4cfb-8908-13b108289df2
Cybereason OperationCuckooBees May 2022ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1c9b32f8-f78d-4580-b183-676c7203286d
Cybereason OperationCuckooBees May 2022ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2026783b-b6c7-432f-9c28-72090cb5539a
Cybereason OperationCuckooBees May 2022ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--23c72a20-1982-4207-9905-d3aa45f94c23
Cybereason OperationCuckooBees May 2022ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--269229ec-bb95-4ad1-b68e-267b2cce4f24
Cybereason OperationCuckooBees May 2022ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2f61aca0-55a8-46cb-aa37-a1789fc07c40
Cybereason OperationCuckooBees May 2022ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1201
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--55b9483d-2d73-433c-ad5a-d29dcce6e4e4
Cybereason OperationCuckooBees May 2022ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5f3f6350-5e69-4b50-a0c7-c1f04ae85976
Cybereason OperationCuckooBees May 2022ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6a9d5f63-e3f8-4980-834b-f83660095e5c
Cybereason OperationCuckooBees May 2022ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1087.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--71819612-01e7-48cf-89ea-09da4f05c2e8
Cybereason OperationCuckooBees May 2022ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--71f80d4d-daf5-4da2-811b-0ebd3365b79c
Cybereason OperationCuckooBees May 2022ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1027.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--75a779b1-7b77-40bd-86cd-7ef5e54e78c1
Cybereason OperationCuckooBees May 2022ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1087.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7903f25e-388e-4cda-bd09-bc83fa64d62e
Cybereason OperationCuckooBees May 2022ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--80e20d44-b799-4734-9de3-009f564f3ca0
Cybereason OperationCuckooBees May 2022ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--83ac4384-a6a8-42d1-9b1b-273902c57144
Cybereason OperationCuckooBees May 2022ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:S0096
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--913d20d5-aea1-49bc-826a-90b8697d691d
Cybereason OperationCuckooBees May 2022ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1069.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--938fe8be-be14-41a6-9db5-238866bb77ea
Cybereason OperationCuckooBees May 2022ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1027.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a2648a96-b282-4624-a91c-f97688c2f3b1
Cybereason OperationCuckooBees May 2022ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b2e82bbd-629f-47e6-9306-970d12d0f0bc
Cybereason OperationCuckooBees May 2022ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1505.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b3fc9f8c-9074-42b8-a144-ad97aa017dce
Cybereason OperationCuckooBees May 2022ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1003.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b69fa422-d118-4d30-948b-422e737b1116
Cybereason OperationCuckooBees May 2022ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b6d0a9fa-a908-4837-9484-91d07cde5e42
Cybereason OperationCuckooBees May 2022ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bb7ce54a-20a5-434e-99f1-ad37cbac0777
Cybereason OperationCuckooBees May 2022ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1059.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--be6891d8-5053-4877-836d-b8fd47cb74de
Cybereason OperationCuckooBees May 2022ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1135
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d7f25b51-f596-4745-8c2d-b0fa074a89b5
Cybereason OperationCuckooBees May 2022ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--db13473b-3541-4be6-a5ad-042e83b37e3e
Cybereason OperationCuckooBees May 2022ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e53818ed-808a-46f6-a266-098f19895379
Cybereason OperationCuckooBees May 2022ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1547.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e6a1906d-43d1-454c-8150-053759421b74
Cybereason OperationCuckooBees May 2022ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e9af5cec-1afb-46da-9d2c-1c0c78ea312b
Cybereason OperationCuckooBees May 2022ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ea944454-a4e9-44fb-9cf1-3f018a455740
Cybereason OperationCuckooBees May 2022