- Category
- State · Attributed to a state or working for one.
- Origin
- China(high confidence)
- Sponsor
- State-sponsored
- Motivation
- Espionage; Information theft and espionage
- Seen
- 2011–2013
- Status
- Dormant
- Sources
- 9 sources carry it
- Identifier
- GINC-APT-0081 · dagger-panda
ChinaWhat it is
Operate since at least 2011, from several locations in China, with members in Korea and Japan as well. Possibly linked to Onion Dog. This threat actor targets government institutions, military contractors, maritime and shipbuilding groups, telecommunications operators, and others, primarily in Japan and South Korea.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Cisco Talos
- UAT-7290
- CrowdStrike
- NOMAD PANDA, Icefog, Dagger Panda
- Government agency
- PLA Unit 69010
- Mandiant
- TEMP.Trident
- NSHC
- SectorB06
- PwC
- Red Foxtrot, Red Wendigo
- Thales
- ATK23
- Other names
- Icefog, Moshen Dragon, RedFoxtrot, ATK 23, Fucobha, Ice Fog, Trident
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Targets
- Countries
- Afghanistan, Australia, Austria, Belarus, Canada, China, France, Germany, Hong Kong, India, Italy, Japan, Kazakhstan, Malaysia, Maldives, Mongolia, Netherlands, Pakistan, Philippines, Russia, Singapore, South Korea, Sri Lanka, Taiwan, Tajikistan, Türkiye, United Kingdom, United States, Uzbekistan
- Sectors
- Aerospace, Defense, Government, Government, Administration, High-Tech, Maritime, Maritime and Shipbuilding, Media, Military, Other, Telecommunications, Telecoms, Utilities
Tools
The tools and malware families the sources tie to it.
- 8.t Dropper
- 8.t exploit document builder
- Backdoor.Oldrea
- China Chopper
- Cyber Eye RAT
- CyberGate
- Dagger Three
- Dagger Three (C2 software)
- Fucobha Backdoor
- GUNTERS
- IceFog
- Javafog
- OnionDuke
- PlugX
- PlugX-Talisman
- RoyalRoad RTF Weaponizer
- ShadowPad
- ShadowPad Winnti
- Xploit
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de