Operation_Wocao__2019__201912_Report_Operation_Wacao.pdf

Operation Wocao is Fox-IT's detailed analysis of a Chinese state-aligned APT (likely APT20) that used JBoss webshells, stolen VPN/Windows credentials (including stolen RSA SecurID soft-tokens), and custom backdoors (XServer, Agent) plus keyloggers and reconnaissance scripts to infiltrate and exfiltrate data from victims across government and multiple industries in at least 10 countries; the report includes tooling hashes, attack walkthroughs, MITRE ATT&CK mappings and defensive recommendations.