Threat Actor

Operation Wocao

Also known as: Operation Wocao

Operation Wocao described activities carried out by a China-based cyber espionage adversary. Operation Wocao targeted entities within the government, managed service providers, energy, health care, and technology sectors across several countries, including China, France, Germany, the United Kingdom, and the United States. Operation Wocao used similar TTPs and tools to APT20, suggesting a possible overlap.

0
indicators on this record

Properties

Last source
MITRE ATT&CK
STIX ID
intrusion-set--28f04ed3-8e91-4805-b1f6-869020517871
In Signal since
initial import (Sep 2026)
Retrieved at
2026-10-18T13:40:41+00:00
Origin source
attack_description
Type
intrusion-set
Origin country
CN

Explore this actor's full graph with Ninja Signal

Search in SpektrOpen Signal Desktop
Operation Wocao — Threat Actor Profile — Ninja Signal | Ninja Signal