icefog.pdf (5 MB)

Kaspersky describes Icefog as an interactive APT backdoor set active since at least 2011, targeting mostly Japan and South Korea across government, military contractor, maritime, shipbuilding, telecom, industrial, high-tech, and media organizations. The campaign used spear-phishing with Microsoft Office exploits, Java exploit links, WinHelp abuse, and HWP vectors to deploy Icefog/Fucobha malware. Operators controlled infected systems manually rather than relying on automatic exfiltration, uploading additional backdoors and lateral-movement tools as needed to collect data from live victim environments. The report documents command-and-control infrastructure, infection statistics, attribution discussion, mitigation guidance, and IOCs for both Windows and Mac OS X variants.