Operation Wocao

Executive Summary

Operation Wocao (我操), described by Fox-IT as a Chinese-based hacking group, is assessed with high confidence to be involved in espionage activities targeting government entities and critical sectors globally. The group's operations suggest alignment with state-sponsored objectives, likely supporting the interests of the Chinese government.

Goals & Targeting

Operation Wocao appears to operate with strategic objectives centered on intelligence gathering for espionage purposes, likely supporting Chinese government interests. The group targets a diverse range of sectors, including energy, healthcare, high-tech industries, and government entities, indicating a focus on extracting sensitive information that could provide competitive or geopolitical advantages.

Operation Wocao has been observed by Fox-IT over the past two years as a persistent threat actor with suspected ties to APT20, though this link is assessed with medium confidence. The group primarily engages in cyber espionage activities aimed at gathering sensitive information from multiple sectors, including government, healthcare, energy, and high-tech industries. Victims have been identified across more than 10 countries, underscoring a global targeting scope. While specific details on the group's TTPs are limited, they likely employ sophisticated techniques to infiltrate targets and exfiltrate data.

Key Capabilities

• Spear-phishing campaigns targeting high-value individuals
• Use of custom malware for infiltration and data exfiltration
• Lateral movement within networks using valid accounts
• Malware deployment to compromise systems
• Credential dumping techniques
• Network discovery and persistence

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Operation Wocao has demonstrated a prolonged operational timeline, targeting multiple countries and sectors. Their campaigns likely involve long-term access to victim networks for data collection. Notable for their stealth and persistence, the group appears capable of maintaining presence in highly secured environments.

IOC Patterns

• Spear-phishing emails with malicious attachments
• Use of Chinese-language threat actors' communication channels
• C2 infrastructure leveraging encrypted protocols
• Network scanning and lateral movement patterns

Recommended Actions

• Monitor for spear-phishing attempts originating from domains associated with Chinese TTPs.
• Implement robust detection mechanisms for credential dumping activities.
• Enhance network segmentation to limit lateral movement.
• Conduct regular security updates and patch management across all systems.
• Deploy EDR solutions to detect and respond to malicious activity.

Suggested Tags