DAGGER_PANDA__2013__icefog.pdf

Kaspersky’s report analyzes the Icefog APT (aka Dagger Three), an espionage-focused campaign active since ~2011 that targets primarily Japan and South Korea. It documents spear‑phishing delivery (Office, Java, HLP, HWP exploits), Windows and macOS backdoors (interactive Icefog/Macfog variants, including Icefog‑NG), lateral movement and credential‑harvesting tools, extensive C2 infrastructure and sinkholed domains, victim profiling (defense, shipbuilding, telecom, media), IoCs (domains, malware MD5s, mutexes, paths) and mitigation guidance.