DAGGER PANDA
Aliases: IceFog, Trident, RedFoxtrot, Red Wendigo, PLA Unit 69010, UAT-7290, Red Foxtrot
- First seen
- 2011-01-01 00:00:00
- Origin
- CN
- Primary motivation
- espionage
- Sophistication
- advanced
- Resource level
- government
- Actor type
- Espionage
- Related IoCs
- 1 (1 malicious)
- Last IoC activity
- 2026-09-27 10:09:44
- Profile updated
- 2026-07-07 11:48:02
Targeted industries: defense-and-aerospace government-and-public-sector manufacturing technology-and-telecommunications transportation-and-logistics
Targeted regions: country_code:jp country_code:kr
Context
Operate since at least 2011, from several locations in China, with members in Korea and Japan as well. Possibly linked to Onion Dog. This threat actor targets government institutions, military contractors, maritime and shipbuilding groups, telecommunications operators, and others, primarily in Japan and South Korea.
Reports & references
- Kaspersky — 57331 (report)
- Kaspersky — 58209 (report)
- cfr.org — Icefog (report)
- d2538mqrb7brka.cloudfront.net — Icefog (report)
- go.recordedfuture.com — Cta 2021 0616 (report)
- Cisco Talos — Uat 7290 (report)
- pwc.com — Yir Cyber Threats Report Download (report)