Icefog

Icefog, also known as Fucobha, is a cyberespionage threat actor active since at least 2011, primarily targeting South Korea and Japan, with additional documented targeting in Taiwan. Its targets include government institutions, military contractors, maritime and shipbuilding organizations, telecommunications and satellite operators, industrial and technology companies, software developers, research organizations, and mass media. Japanese parliamentary institutions were among its early targets. Its national origin and state sponsorship have not been conclusively established. Icefog is distinct from TA428; shared infrastructure or tooling does not establish that the two are the same actor. Icefog is characterized by focused, operator-driven, hit-and-run intrusions. Operators inspect compromised systems and network configurations, identify specific documents and credentials, deploy additional tools as needed, archive and exfiltrate selected information, and then abandon victims. Initial access methods include spear-phishing attachments and malicious links, exploitation of patched Microsoft Office and Oracle Java vulnerabilities, and abuse of Windows Help macros. Document exploits have included CVE-2012-0158 and CVE-2012-1856, while Java exploits have included CVE-2013-0422 and CVE-2012-1723. The actor's tooling includes multiple Windows Icefog backdoor variants, the custom TCP-based Icefog-NG variant, and the macOS backdoor Macfog. These implants support system reconnaissance, remote command execution, file transfer, and deployment of additional malware. Operators have used password and hash dumpers, browser and email credential-recovery utilities, and tools supporting lateral movement. Windows variants employ DLL search-order hijacking and persistence mechanisms, while Macfog uses launch-agent persistence and was distributed through trojanized applications on Chinese-language forums. Operators also screen apparent virtual machines and fake victims before interacting with them.