Icefog, Dagger Panda
Icefog, Dagger Panda is a China-attributed nation-state APT group with an espionage motive, tracked by Brandefense. It targets 8 sectors, including Government and Technology, in 28 countries, including the United States and the United Kingdom.
- Icefog
- Dagger Panda
- ATK 23
- Red Wendigo
- Origin
- China
- Techniques
- 0
- Exploited CVEs
- No CVE data
- First seen
- Jan 1, 2011
- Record updated
Who They Target.
About Icefog, Dagger Panda.
“Icefog” is an Advanced Persistent Threat that has been active since at least 2011, targeting mostly Japan and South Korea. Known targets include governmental institutions, military contractors, maritime and shipbuilding groups, telecom operators, industrial and high-tech companies and mass media. The name “Icefog” comes from a string used in the command-and-control server name in one of the samples. The command-and-control software is named “Dagger Three”, in the Chinese language. During Icefog attacks, several other malicious tools and backdoors were uploaded to the victims’ machines, for data exfiltration and lateral movement. The later group {{RedAlpha}} has infrastructure overlap with Icefog.
Last updated Sep 11, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.