The Icefog APT Hits US Targets With Java BackdoorIn September 2013, we published our extensive analysis of Icefog, an APT campaign that focused on the supply chain - targeting government institutions, military contractors, maritime and ship-building groups.
Icefog, also known as the "Dagger Panda" by Crowdstrike's naming convention, infected targets mainly in South Korea and Japan. You can find our Icefog APT analysis and detailed report here.
Since the publication of our report, the Icefog attackers went completely dark, shutting down all known command-and-control servers. Nevertheless, we continued to monitor the operation by sinkholing domains and analysing victim connections. During this monitoring, we observed an interesting type of connection which seemed to indicate a Java version of Icefog, further to be referenced as "Javafog".
Meet "Lingdona"
The Icefog operation has been operational since at least 2011, with many different variants released during this time. For Microsoft Windows PCs, we identified at least 6 different generations:
- The "old" 2011 Icefog - sends stolen data by e-mail; this version was used against the Japanese House of Representatives and the House of Councillors in 2011.
- Type "1" "normal" Icefog - interacts with command-and-control servers via a set of ".aspx" scripts.
- Type "2" Icefog - interacts with a script-based proxy server that redirects commands from the attackers to another machine.
- Type "3" Icefog - a variant that uses a certain type of C&C server with scripts named "view.asp" and "update.asp"
- Type "4" Icefog - a variant that uses a certain type of C&C server with scripts named "upfile.asp"
- Icefog-NG - communicates by direct TCP connection to port 5600
In addition to these, we also identified "Macfog", a native Mac OS X implementation of Icefog that infected several hundred victims worldwide.
Source: The Icefog APT Hits US Targets With Java Backdoor
