aol.pm

Operation Honeybee

Campaign · ATTACK:enterprise:C0006

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:C0006",
  "title": "Operation Honeybee",
  "type": "Campaign",
  "source_url": "https://attack.mitre.org/campaigns/C0006",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "campaign--4553292d-12c6-4a93-934d-12160370d4e0",
  "external_id": "C0006",
  "domain": "enterprise",
  "created": "2022-09-16T21:08:54.358Z",
  "modified": "2026-07-31T18:47:19.919Z",
  "version": "1.1",
  "aliases": [
    "Operation Honeybee"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "McAfee Honeybee",
      "url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-uncovers-operation-honeybee-malicious-document-campaign-targeting-humanitarian-aid-groups/"
    }
  ]
}

Explicit source assertions (33)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:C0006 → uses → ATTACK:enterprise:T1585.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--02838a73-1e42-4fda-a27b-044d14f303d9

McAfee Honeybee

ATTACK:enterprise:C0006 → uses → ATTACK:enterprise:S0464

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0ebf98b6-2cd2-4672-a330-201e9c7a2932

McAfee Honeybee

ATTACK:enterprise:C0006 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--15fd646c-172b-4458-945a-69a07a5648bb

McAfee Honeybee

ATTACK:enterprise:C0006 → uses → ATTACK:enterprise:T1106

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--28427b29-2088-44f7-8acd-5df104dcb8ee

McAfee Honeybee

ATTACK:enterprise:C0006 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3b4aaacf-d721-4bad-a64e-37d48c6b847d

McAfee Honeybee

ATTACK:enterprise:C0006 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3c3646c8-56a5-443a-a71f-a32ea6269750

McAfee Honeybee

ATTACK:enterprise:C0006 → uses → ATTACK:enterprise:T1583.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--44bfcd86-2fa2-4e00-a9af-ab66d4d834cd

McAfee Honeybee

ATTACK:enterprise:C0006 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--45803290-efab-46d3-873d-0c4f19f5e406

McAfee Honeybee

ATTACK:enterprise:C0006 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5b6f04b3-9178-45af-be77-bdde4cf47db1

McAfee Honeybee

ATTACK:enterprise:C0006 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--69e152de-4cf5-416b-a52b-c6a067f1789e

McAfee Honeybee

ATTACK:enterprise:C0006 → uses → ATTACK:enterprise:S0075

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--76f9794c-5791-4fe7-b3c8-39dbdee11967

McAfee Honeybee

ATTACK:enterprise:C0006 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7af7bfc3-7b1b-41aa-b162-47c222390815

McAfee Honeybee

ATTACK:enterprise:C0006 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--826301cd-9f66-4e5d-a63a-8b0283f1e2fe

McAfee Honeybee

ATTACK:enterprise:C0006 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8b6f5eed-f21e-41db-a858-32bb0d12e593

McAfee Honeybee

ATTACK:enterprise:C0006 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--968911f0-2158-4c76-9fab-562a00ecc418

McAfee Honeybee

ATTACK:enterprise:C0006 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--973ed739-22d9-433f-ba63-f4881639a22d

McAfee Honeybee

ATTACK:enterprise:C0006 → uses → ATTACK:enterprise:T1574.011

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--981648bc-e5b1-46b3-adf6-92caae84cfa4

McAfee Honeybee

ATTACK:enterprise:C0006 → uses → ATTACK:enterprise:T1588.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--989a5b4d-14d3-4942-8326-91d677e4d38a

McAfee Honeybee

ATTACK:enterprise:C0006 → uses → ATTACK:enterprise:T1071.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9d7fb3cf-ccee-4f04-b7ef-ee42c320e513

McAfee Honeybee

ATTACK:enterprise:C0006 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a88fe386-79eb-48d0-a982-033b6f75845a

McAfee Honeybee

ATTACK:enterprise:C0006 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a9062634-d5c3-4154-bea0-e4e76821d944

McAfee Honeybee

ATTACK:enterprise:C0006 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a9468e2e-1525-4311-8f11-d63b5d6b4e58

McAfee Honeybee

ATTACK:enterprise:C0006 → uses → ATTACK:enterprise:S0057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--abb6d14e-e76f-4437-8006-1a084ecd5e1b

McAfee Honeybee

ATTACK:enterprise:C0006 → uses → ATTACK:enterprise:T1583.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b923a6b3-acae-4ecf-bb56-63188d0e4553

McAfee Honeybee

ATTACK:enterprise:C0006 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bc1bee0f-2e60-452d-8e11-3ba3993ebbd9

McAfee Honeybee

ATTACK:enterprise:C0006 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--be9e89ef-de70-44e3-b3cb-73844f069ac4

McAfee Honeybee

ATTACK:enterprise:C0006 → uses → ATTACK:enterprise:S0096

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c4880d8d-3d07-49f6-875b-00b573faebf3

McAfee Honeybee

ATTACK:enterprise:C0006 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c9d15fcf-d9f2-4f03-aabf-0e84523efc2b

McAfee Honeybee

ATTACK:enterprise:C0006 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d36067ad-c612-46bb-b857-bb2d74f8f3c2

McAfee Honeybee

ATTACK:enterprise:C0006 → uses → ATTACK:enterprise:S0106

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dc107dd0-bf7c-4b8d-9262-e487a1ac9f2c

McAfee Honeybee

ATTACK:enterprise:C0006 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e169d920-59ab-4a07-928e-858b878fd7bc

McAfee Honeybee

ATTACK:enterprise:C0006 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f813e8ab-96d7-4880-a3c2-50e164d4bd66

McAfee Honeybee

ATTACK:enterprise:C0006 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ff7ecfd6-bbe0-4fc6-9ea2-551ff2359157

McAfee Honeybee

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.