McAfee ATR identified Operation Honeybee as a malicious-document campaign targeting humanitarian aid organizations with North Korea-themed lures, later shifting to Word compatibility-message decoys submitted largely from South Korea. The documents used VBA macros with a custom alphabet to decode CAB files, drop SYSCON-related implants, and configure COMSysApp service persistence through DLLs loaded under svchost.exe, with UAC-bypass components such as cliconfg.exe. Related samples included a DPRK Red Cross-themed document and a signed Win32 dropper using an Adobe certificate, while infrastructure tied to the persona [email protected] included 1113427185.ifastnet.org and Byethost-hosted accounts. The report matters because it links shared author metadata, encoding keys, PDB paths, and C2 registration patterns across Honeybee and related SYSCON activity without requiring broader attribution than the source supports.