"Into the Fog - The Return of ICEFOG APT"
summary
ICEFOG resurfaces with two new families and an n-type payload, totaling roughly nine distinct campaigns since 2014 that target Turkey, the Philippines, Mongolia, Russia and Central Asia, plus water and agriculture firms. Malware evolves into ICEFOG P and M variants that steal Windows and browser creds via embedded sqlite3, use the CVE-2017-11882 exploit template, drop a registry-resident encrypted payload or in-memory loader, and adopt folder-monitoring and expanded C2 commands. Shared exploit templates and overlapping infrastructure link campaigns to Roaming Tiger, APT15 and possibly APT9, making simple sample-based attribution unreliable.
AI-written summary · about
chapters (14)
- 0:00Introduction and background
- 4:05Research motivation and goals
- 10:32Icefog malware variants and evolution
- 17:55New Icefog variants P and M
- 22:15Infrastructure clustering and campaign analysis
- 26:30Agriculture company attack case
- 28:38Tata news campaign targeting Mongolia
- 31:46APRA campaign in Kurdistan
- 33:37Water fight campaign targeting utilities
- 35:53APT 15 campaign in the Philippines
- 38:25Skyline campaign targeting Turkey
- 41:14Attribution and attacker profiles
- 45:48New attacker group profile
- 46:31Conclusions and future threats
related talks
33mOperation GamblingPuppet: Analysis of a Multivector and Multiplatform Campaign Targeting Online ...
34mEgregor Awakens: Taking a Tour of a Threat Action New Digs
42mDriven Response to UNC5174
32mOperation Clairvoyance: How APT Groups Spy on the Media Industry
31mThe Wolves Among Us… A Tale of APT’s Thievery
32mUsing Geopolitical Conflicts for Threat Hunting
19mOperation PZCHAO
25mGlobal Threat Brief: Hacks and Adversaries Unveiled