Honeybee__2018__Operation_Honeybee.pdf

McAfee Advanced Threat Research discovered Operation Honeybee, a targeted malware campaign using malicious Word documents and VBA macros to deploy a SYSCON backdoor and persist via service DLL installation and UAC bypass; the campaign targeted humanitarian aid groups across multiple countries, used custom Base64-like encoding and stolen code-signing, and includes numerous IOCs (file hashes, domains, FTP/C2 listings) and detailed TTPs for detection and mitigation.