Honeybee
Honeybee is a nation-state APT group with an espionage motive, tracked by Brandefense. It targets organisations in 7 countries, including Canada and Indonesia.
- G0072
- Techniques
- 0
- Exploited CVEs
- No CVE data
- First seen
- Jan 1, 2017
- Record updated
Who They Target.
About Honeybee.
Our analysts have named this Operation Honeybee, based on the names of the malicious documents used in the attacks. Advanced Threat Research analysts have also discovered malicious documents authored by the same actor that indicate a tactical shift. These documents do not contain the typical lures by this actor, instead using Word compatibility messages to entice victims into opening them. The Advanced Threat Research team also observed a heavy concentration of the implant in Vietnam from January 15-17.
Last updated Sep 11, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.