DAGGER PANDAThreat actor
- pla unit 69010
- red foxtrot
- red wendigo
- redfoxtrot
- Trident
- UAT-7290
Operate since at least 2011, from several locations in China, with members in Korea and Japan as well. Possibly linked to Onion Dog. This threat actor targets government institutions, military contractors, maritime and shipbuilding groups, telecommunications operators, and others, primarily in Japan and South Korea.From MISP Galaxy
Last reported 1 month ago, by Huntress12 reports
ATT&CK techniques
6 of 95 · each with the sentence it comes from- T1543.003Windows Service
“System Services: Service Execution – T1543.003”
- T1036Masquerading
“… distributing a modified variant of the gh0st RAT, attributed to the Dragon Breath APT (APT-Q-27), through trojanized NSIS installers masquerading as legitimate software such as Google Chrome and Microsoft Teams.”
- T1059Command and Scripting Interpreter
“Windows Command Shell – T1059.003 Command and Scripting Interpreter”
- T1059.003Windows Command Shell
“Windows Command Shell – T1059.003 Command and Scripting Interpreter”
- T1505.003Web Shell
“BLUEBEAM Web Shell Deployment”
- T1569.002Service Execution
“System Services: Service Execution – T1569.002”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
12 reports, newest first · the exact sentence from each-
OAuth Token Theft Through Microsoft's Front Door“…ure 9: TheThis lower panel scrolls the same record down to the field that matters: User agent Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; MSAuthHost/1.0; rv:11.0) like Gecko.”
-
Beware the SparroWock: The backdoor that bites, the commands that catch“Trident loader scheme”
-
Predators for Hire: Commercial Surveillance Vendors Overview“…CVE-2016-4657 - remote code execution, CVE-2016-4655 info disclosure, and CVE-2016-4656, elevation of privileges), collectively dubbed “Trident”.”
-
Inside .NET Loader Analysis: From Malspam to In-Memory Loader“…s three remote files using a hardcoded legacy Internet Explorer 8 User-Agent “Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; WOW64; Trident/4.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.21022; .NET CLR 3.5.30729; .NET CLR 3.0.30618; InfoPath.2; OfficeLiveC…”
-
Exploitation of KnowledgeDeliver via ViewState Deserialization Vulnerability“Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) chromeframe/10.0.648.205 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36”
-
U.S. Public Sector Under Siege: Threat Intelligence for Q1 2026“A related China-linked threat group, UAT-7290, was simultaneously targeting U.S.”
-
Trial, Error & Typos: Malware Isn't Always 'Sophisticated'“POST /Login.aspx ReturnUrl=[REDACTED] 443 - 103.36.25.169 Mozilla/5.0+(compatible;+MSIE+9.0;+Windows+NT+6.1;+Trident/5.0)+chromeframe/10.0.648.205 - 200 0 0 406”
-
RONINGLOADER: DragonBreath’s New Path to PPL Abuse“…, the malware tries to communicate with a hardcoded URL hxxp://www.baidu.com/ with the user-agent “Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko”, but this appears to be dead code, likely due to either a removed feature or placeholder code for future versi…”
-
The DPRK strikes using a new variant of RUSTBUCKET“The request is accompanied by a User-Agent string formatted as Mozilla%2F4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident%2F4.0).”
-
APT41 World Tour 2021 on a tight schedule“"user-agent": "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MANM; MANM)"”
-
Big airline heist“"UserAgent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko",”
-
Malware Deep Dive: Examining A PowerShell Payload“…se64.b64decode("/OiJAAAAYInlMdJki1Iw...")b'\xfc\xe8\x89\x00\x00[SNIP]\x00\x00Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0; ASU2JS)\x00XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\x00Y1\xffWWWWQh:Vy\xa7\xff\xd5[SNIP]'”
Indicators in its reports
named in the reports above- ns1.colunm[.]tkin 2 reports
- colunm[.]tkin 2 reports
- 185.118.166[.]66in 2 reports
- cs.colunm[.]tkin 2 reports
Copy these 4 indicators · defanged
Thanks — we review every report.