DAGGER PANDA

🔴 High
Also known as: ATK 23, ATK23, DAGGER PANDA, Dagger Panda, Fucobha, Ice Fog, IceFog, Icefog, PLA Unit 69010, Red Foxtrot, Red Wendigo, RedFoxtrot, SectorB06, Temp.Trident, Trident, UAT-7290

Operate since at least 2011, from several locations in China, with members in Korea and Japan as well. Possibly linked to Onion Dog. This threat actor targets government institutions, military contractors, maritime and shipbuilding groups, telecommunications operators, and others, primarily in Japan and South Korea.

🌍 Country China
📅 Activity 2013 — 2013
⚡ Risk Level High
🎯 Incident Type Espionage
Other Maritime Military Government, Administration Telecoms Government
2013
2013

Targeted Victims

South Korea United States Japan Germany China

Associated Operations

2014-01 2015 2016 2018 2018/2019 India Kazakhstan Since the publication of our report Target: An unknown entity in the Philippines. Target: Government Target: Kazach officials. Target: Organizations in Turkey and Kazakhstan. Target: Water source provider The Icefog APT Hits US Targets With Java Backdoor Uzbekistan and Tajikistan. and finance organizations in Russia and Mongolia. and government entities in Turkey banks further to be referenced as “Javafog”. https://securelist.com/the-icefog-apt-hits-us-targets-with-java-backdoor/58209/ https://www.zdnet.com/article/ancient-icefog-apt-malware-spotted-again-in-new-wave-of-attacks/ media shutting down all known command-and-control servers. Nevertheless the Icefog attackers went completely dark we continued to monitor the operation by sinkholing domains and nalyzing victim connections. During this monitoring we observed an interesting type of connection which seemed to indicate a Java version of Icefog “APPER” Campaign “PHKIGHT” Campaign “SKYLINE” Campaign “TOPNEWS” Campaign “WATERFIGHT” Campaign

Introduction

Operate since at least 2011, from several locations in China, with members in Korea and Japan as well. Possibly linked to Onion Dog. This threat actor targets government institutions, military contractors, maritime and shipbuilding groups, telecommunications operators, and others, primarily in Japan and South Korea.

Activities and Tactics

Targeted Sectors: Other, Maritime, Military, Government, Administration, Telecoms, Government

Country of Origin: 🇨🇳 China

Risk Level: High

First Seen: 2013

Last Activity: 2013

Incident Type: Espionage

Suspected Victims: South Korea, United States, Japan, Germany, China

Notable Campaigns

  • 2014-01
  • 2015
  • 2016
  • 2018
  • 2018/2019
  • India
  • Kazakhstan
  • Since the publication of our report
  • Target: An unknown entity in the Philippines.
  • Target: Government
  • Target: Kazach officials.
  • Target: Organizations in Turkey and Kazakhstan.
  • Target: Water source provider
  • The Icefog APT Hits US Targets With Java Backdoor
  • Uzbekistan
  • and Tajikistan.
  • and finance organizations in Russia and Mongolia.
  • and government entities in Turkey
  • banks
  • further to be referenced as “Javafog”.
  • https://securelist.com/the-icefog-apt-hits-us-targets-with-java-backdoor/58209/
  • https://www.zdnet.com/article/ancient-icefog-apt-malware-spotted-again-in-new-wave-of-attacks/
  • media
  • shutting down all known command-and-control servers. Nevertheless
  • the Icefog attackers went completely dark
  • we continued to monitor the operation by sinkholing domains and nalyzing victim connections. During this monitoring
  • we observed an interesting type of connection which seemed to indicate a Java version of Icefog
  • “APPER” Campaign
  • “PHKIGHT” Campaign
  • “SKYLINE” Campaign
  • “TOPNEWS” Campaign
  • “WATERFIGHT” Campaign

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No atomic indicators are listed in this profile. The APTnotes snapshot indexes 1 public reports that may contain IOCs; see Source Attribution for dataset links.

Malware and Tools

  • China Chopper
  • OnionDuke
  • Dagger Three (C2 software):
  • Fucobha Backdoor:
  • IceFog:
  • RoyalRoad RTF Weaponizer:
  • PlugX-Talisman:
  • ShadowPad:
  • GUNTERS:
  • 8.t Dropper:
  • Dagger Three:
  • Javafog:
  • ShadowPad Winnti:

Attribution and Evidence

Country of Origin: China Additional attribution information pending cataloguing.

References

References pending cataloguing.