Icefog
Aliases: Fucobha
- First seen
- 2013-09-01 00:00:00
- Malware type
- rat, trojan
- Family
- Malware family
- Related IoCs
- 130 (71 malicious)
- Last IoC activity
- 2026-10-18 00:40:22
- Profile updated
- 2026-07-07 12:39:57
Targeted industries: defense-and-aerospace energy-and-utilities government-and-public-sector media-and-entertainment technology-and-telecommunications
Targeted regions: country_code:cn country_code:kr country_code:jp country_code:us
Context
Icefog, also known as Fucobha, is a cyber espionage malware family primarily targeting the supply chain in sectors such as defense, aerospace, and telecommunications. It has been used in precision strikes against specific organizations in South Korea and Japan, employing tactics generally attributed to state-sponsored actors.
Detection coverage
- 1 YARA rules
Detection rules
- MALPEDIA_Win_Icefog_Auto (yara-rule)
Reports & references
- go.recordedfuture.com — Cta 2021 0228 (report)
- go.recordedfuture.com — Cta 2021 0616 (report)
- slideshare.net — Cb19 Cyber Threat Landscape In Japan Revealing Threat In The Shadow By Chi En Shen Ashley Oleg Bondarenko (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Icefog (report)
- kz-cert.kz — 502 (report)
- speakerdeck.com — Into The Fog The Return Of Icefog Apt (report)
- nao-sec.org — An Overhead View Of The Royal Road (report)