According to sources, a new Advanced Persistent Threat (APT) group dubbed "Icefog" was detected, targeting maritime actors such as shipyards and naval defence industry. The main maritime targets publickly disclosed were located in South Korea, and in the US for one undisclosed Oil and Gas corporation.
The initial spearphishing attacks mostly used Microsoft Office and Java exploits. The specialized backdoor named "Icefog" (or "Fucobha") was compatible with both Windows and Mac OS X platforms. The attackers were able to gain access to sensitive documents and plans, as well as emails credentials.
Over 4,000 machines were detected infected at a global level. Though the majority of these were in Asia, and in Korea for the maritime and naval sector, a significant number of undisclosed targets were also traced back to the USA, Europe, and Australia.