McAfee Honeybee

During Operation Honeybee, the threat actors collected data from compromised hosts.

During Operation Honeybee, the threat actors used Base64 to encode files with a custom key.

During Operation Honeybee, the threat actors modified the MaoCheng dropper so its icon appeared as a Word document.

During Operation Honeybee, the threat actors used a legitimate Windows executable and secure directory for their payloads to bypass UAC.

During Operation Honeybee, the threat actors uploaded stolen files to their C2 servers.

During Operation Honeybee, the threat actors obtained a list of running processes on a victim machine using `cmd /c tasklist > %temp%\temp.ini`.

During Operation Honeybee, various implants used batch scripting and `cmd.exe` for execution.

For Operation Honeybee, the threat actors used a Visual Basic script embedded within a Word document to download an implant.

During Operation Honeybee, the threat actors used batch files that reduced their fingerprint on a compromised system by deleting malware-related files.

During Operation Honeybee, the threat actors had the ability to use FTP for C2.

During Operation Honeybee, stolen data was copied into a text file using the format `From <COMPUTER-NAME> (<Month>-<Day> <Hour>-<Minute>-<Second>).txt` prior to compression, encoding, and exfiltration.

During Operation Honeybee, the threat actors collected the computer name, OS, and other system information using `cmd /c systeminfo > %temp%\ temp.ini`.

During Operation Honeybee, the threat actors used a malicious DLL to search for files with specific keywords.

During Operation Honeybee, the threat actors downloaded additional malware and malicious scripts onto a compromised host.

During Operation Honeybee, the threat actors deployed malware that used API calls, including `CreateProcessAsUser`.

During Operation Honeybee, the threat actors used batch files that modified registry keys.

During Operation Honeybee, malicious files were decoded prior to execution.

During Operation Honeybee, threat actors relied on a victim to enable macros within a malicious Word document.

During Operation Honeybee, threat actors installed DLLs and backdoors as Windows services.

During Operation Honeybee, the threat actors used the malicious NTWDBLIB.DLL and `cliconfig.exe` to bypass UAC protections.

During Operation Honeybee, the threat actors deployed the MaoCheng dropper with a stolen Adobe Systems digital signature.

During Operation Honeybee, the threat actors uses zip to pack collected files before exfiltration.

During Operation Honeybee, threat actors ran sc start to start the COMSysApp as part of the service hijacking and sc stop to stop and reconfigure the COMSysApp.

During Operation Honeybee, the threat actors used a batch file that modified the COMSysApp service to load a malicious ipnet.dll payload and to load a DLL into the `svchost.exe` process.

During Operation Honeybee, threat actors registered domains for C2.

For Operation Honeybee, at least one identified persona was used to register for a free account for a control server.

During Operation Honeybee, attackers created email addresses to register for a free account for a control server used for the implants.

For Operation Honeybee, the threat actors stole a digital signature from Adobe Systems to use with their MaoCheng dropper.