This document discusses the cyber mercenary group known as Icefog and their tactics, tools, and targets. Icefog operates in smaller, more agile crews that are assigned to specific projects. They utilize improved hit-and-run tactics and have targeted profiles in military, shipbuilding, satellites, and mass media. The document also notes near intractable supply chain issues and that smaller, agile cyber mercenary groups pose risks through economic espionage and hit-and-run attacks.

1. Icefog the Cybermercenaries
Precision hit-and-run and the new supply chain
superfund sites
Kurt Baumgartner, @k_sec
Principal Security Researcher, Kaspersky Lab

2. Annual .gov, .com incidents

3. APT Jumping Puddles

4. 2013 Research Releases

5. Patterns in the Activity?
• Operational playbooks
• Capability improvements
and sharing
• Hit-and-run cybermercenaries

6. Icefog: A Tale of Cloak and
Three Daggers
• Mitigation information
Effective defense
Gov/CERT victim identification
• Private report
Exhaustive attacker and
operational information
*IceFog’s C&C software was named “三尖刀” –
which means “three daggers” or “three knives” –
its also ancient Chinese weapon.

7. Icefog as CyberMercenaries
• Agile, smaller crews
assigned per “project”
• Improved hit-and-run
tactics for hire
• Seemingly scattered
target profiles

8. Really, More Than Three
Daggers
• Target profiles reveal potential interests
• Military, shipbuilding, satellite, mass media
• Icefog Toolset
• Microsoft Windows “Fucobha”, Mac OS X
“Macfog”
• Exploits, lateral movement set, Java EoP
• Simple xor over http exfiltration

9. Present Threats to the
Global Supply Chain

10. Conclusions
• Near intractable supply chain issues
• Smaller, agile cyber-mercenary crews
• Hit-and-run economic espionage and other risk
• Public Icefog Report: http://www.securelist.com

11. Thank You!
Kurt Baumgartner, @k_sec
Principal Security Researcher, Kaspersky Lab