Operation Wocao

MITRE ATT&CK: G0116 View on attack.mitre.org

Aliases: Operation Wocao

Profile updated
2026-07-07 11:28:34

Context

Operation Wocao described activities carried out by a China-based cyber espionage adversary. Operation Wocao targeted entities within the government, managed service providers, energy, health care, and technology sectors across several countries, including China, France, Germany, the United Kingdom, and the United States. Operation Wocao used similar TTPs and tools to APT20, suggesting a possible overlap.

Reports & references

  • fox-it.com — Operation Wocao Shining A Light On One Of Chinas Hidden Hacking Groups (report)
  • MITRE ATT&CK — G0116 (report)
  • fox-it.com — 201912 Report Operation Wocao (report)

Attributed from

  • Operation Wocao (campaign)

External references