Threat Actor 🇨🇳 China

DAGGER PANDA

Also known as: IceFog · Trident · RedFoxtrot · Red Wendigo · PLA Unit 69010 · UAT-7290 · Red Foxtrot

Operate since at least 2011, from several locations in China, with members in Korea and Japan as well. Possibly linked to Onion Dog. This threat actor targets government institutions, military contractors, maritime and shipbuilding groups, telecommunications operators, and others, primarily in Japan and South Korea.

Indicators of Compromise 12

Domain 8[.]8[.]8[.]8 Filename .pkgdb Filename Bulbature Filename DriveSwitch Filename RushDrop Filename SilentRaid Filename busybox Filename chargen Filename daytime SHA-256 59568d0e2da98bad46f0e3165bcf8adadbf724d617ccebcfdaeafbb097b81596 SHA-256 723c1e59accbb781856a8407f1e64f36038e324d3f0bdb606d35c359ade08200 SHA-256 961ac6942c41c959be471bd7eea6e708f3222a8a607b51d59063d5c58c54a38d

MITRE ATT&CK TTPs 11

Obfuscated Files or Information

Defense Evasion

Process Discovery

Command And Control

System Information Discovery

File and Directory Discovery

Command And Control

Ingress Tool Transfer

Command And Control

System Time Discovery

External Remote Services

Source Articles

UAT-7290 targets high value telecommunications infrastructure in South Asia

Cisco Talos has identified a sophisticated China-nexus APT group tracked as UAT-7290, active since at least 2022, targeting high-value telecommunications infrastructure in South Asia and recently expanding into Southeastern Europe. The group conducts espionage and establishes Operational Relay Box (ORB) nodes using a suite of custom and open-source malware, including RushDrop, DriveSwitch, SilentRaid, and Bulbature. UAT-7290 leverages one-day exploits, SSH brute-forcing, and publicly available proof-of-concept code to compromise edge devices and gain initial access. Technical overlaps with APT10 and Red Foxtrot, as well as shared infrastructure and malware traits, suggest ties to Chinese state-sponsored actors.