DAGGER PANDA
Also known as IceFog, Trident, RedFoxtrot, Red Wendigo, PLA Unit 69010, UAT-7290, Red Foxtrot
Operate since at least 2011, from several locations in China, with members in Korea and Japan as well. Possibly linked to Onion Dog. This threat actor targets government institutions, military contractors, maritime and shipbuilding groups, telecommunications operators, and others, primarily in Japan and South Korea.
Targets: Government, Military, South Korea, United States, Japan, Germany, China
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
Recent activity
- Trident: Dual-stream APT attribution over heterogeneous threat knowledge graphs https:// infosec.pub/post/54607698 [ https:// infosec.pub/u/digicat ] # blueteammastodon · Nov 7, 2026
- Trident: Dual-stream APT attribution over heterogeneous threat knowledge graphsreddit · Nov 7, 2026
- @ SecureOwl So a couple of the journalists I reached out too were able to get a statement out of the Navy on this, pasted below. So far the Seattle Times is themastodon · Oct 28, 2026
- Behind the scenes at the NeXT Computer officehn · Oct 27, 2026
References
- https://securelist.com/the-icefog-apt-a-tale-of-cloak-and-three-daggers/57331/
- https://securelist.com/the-icefog-apt-hits-us-targets-with-java-backdoor/58209/
- https://www.cfr.org/interactive/cyber-operations/icefog
- https://d2538mqrb7brka.cloudfront.net/wp-content/uploads/sites/43/2018/03/20133739/icefog.pdf
- https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/cyber-year-in-retrospect/yir-cyber-threats-report-download.pdf
- https://go.recordedfuture.com/hubfs/reports/cta-2021-0616.pdf
- https://blog.talosintelligence.com/uat-7290/
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.