Threat Actors Tropic Trooper

Tropic Trooper

G0081 TLP:CLEAR

Active

Kill Chain Analysis Generate Graph Hunt Package

Also known as: Pirate Panda, KeyBoy, KeyBoys, Tropic Trooper, BRONZE HOBART, G0081, Red Orthrus, Earth Centaur

Description

Tropic Trooper is an unaffiliated threat group that has led targeted campaigns against targets in Taiwan, the Philippines, and Hong Kong. Tropic Trooper focuses on targeting government, healthcare, transportation, and high-tech industries and has been active since 2011.(Citation: TrendMicro Tropic Trooper Mar 2018)(Citation: Unit 42 Tropic Trooper Nov 2016)(Citation: TrendMicro Tropic Trooper May 2020)

TTP Summary

Southeast Asia

Goals & Targeting

Targeted Sectors

Government

Healthcare

Transportation

Targeted Countries / Regions

AI Analysis

· 1 week ago

Executive Summary

Tropic Trooper, also known as Pirate Panda or KeyBoys, is a sophisticated cyber espionage group targeting government, healthcare, transportation, and high-tech industries primarily in Taiwan. The group has been active since at least 2011 and is known for using a variety of advanced persistence techniques and tools to achieve its objectives.

Goals & Targeting

Tropic Trooper's strategic objectives appear to be primarily centered on espionage, with a focus on gathering sensitive information from government and critical infrastructure sectors in Taiwan. The group's targeting profile suggests a regional focus in Southeast Asia, particularly against high-value targets such as transportation and healthcare organizations. This indicates that Tropic Trooter seeks to disrupt or gain unauthorized access to critical systems, possibly for political or strategic advantages.

Enhanced Description

Tropic Trooper is an unaffiliated threat group that has conducted targeted campaigns against organizations in Southeast Asia, including Taiwan, the Philippines, and Hong Kong. The group focuses on espionage activities, aiming to gather sensitive information from government agencies, healthcare institutions, and transportation sectors. Tropic Trooter's activities have been tracked since 2011, with recent activity noted as late as May 2020. The group is known for leveraging a range of tactics, including malicious files, encrypted communication channels, and file-less malware to maintain persistence and evade detection. Its operational capabilities include the use of tools such as KeyBoy, USBferry, PoisonIvy, and YAHOYAH.

Key Capabilities

Espionage activities targeting government and critical infrastructure
Deployment of file-less malware and malicious DLLs
Use of encrypted communication channels for C2
Leverage of removable media and USB-based attacks
Persistence techniques including registry run keys and startup folders

MITRE ATT&CK Tactics

Reconnaissance

Initial Access

Execution

Persistence

Defense Evasion

Discovery

Collection

Exfiltration

I.T. Infrastructure

ATT&CK Techniques

T1566.001

T1070.004

T1203

T1574.001

T1573

T1059.003

T1071.004

T1221

Software / Tooling

KeyBoy

USBferry

PoisonIvy

YAHOYAH

ShadowPad

Campaigns & Victims

Tropic Trooper has been linked to several campaigns targeting Southeast Asian organizations, with activity observed as recently as May 2020. The group's campaigns typically involve long-term access to systems, leveraging persistence techniques and encrypted communication channels. Notable victims have included government agencies and critical infrastructure entities in Taiwan. Tropic Trooter's modus operandi suggests a patient and methodical approach to maintaining access and avoiding detection.

IOC Patterns

Use of malicious DLLs and file-less malware
Encrypted or asymmetric cryptography for communication
USB-based attacks and persistence mechanisms
Registry modifications and startup folder entries
Network traffic anomalies using web protocols or DNS

Recommended Actions

Implement robust USB device policies and monitoring to detect suspicious activity.
Monitor for file-less malware activities and process injection techniques.
Use endpoint detection and response (EDR) solutions to identify malicious activities.
Regularly audit system configurations and remove unnecessary services or startup entries.
Enhance network monitoring for anomalies related to known Tropic Trooper TTPs.

Suggested Tags

espionage

APT

cyber-espionage

Taiwan

Southeast Asia

government-targeted

Confidence Assessment

Confidence in Tropic Trooter's attributes is high, based on multiple intelligence sources and observed activities spanning over a decade. However, some details about the group's exact affiliations and complete list of campaigns remain uncertain due to limited public disclosure.

ATT&CK Techniques

Collection

1 technique

T1119

Automated Collection

Tropic Trooper has collected information automatically using the adversary's USBferry attack.(Citation: TrendMicro Tropic Trooper May 2020)

Command & Control

6 techniques

T1071.001

Web Protocols

Tropic Trooper has used HTTP in communication with the C2.(Citation: Anomali Pirate Panda April 2020)(Citation: TrendMicro Tropic Trooper May 2020)

T1071.004

DNS

Tropic Trooper's backdoor has communicated to the C2 over the DNS protocol.(Citation: TrendMicro Tropic Trooper May 2020)

T1105

Ingress Tool Transfer

Tropic Trooper has used a delivered trojan to download additional files.(Citation: TrendMicro Tropic Trooper May 2020)

T1132.001

Standard Encoding

Tropic Trooper has used base64 encoding to hide command strings delivered from the C2.(Citation: TrendMicro Tropic Trooper May 2020)

T1573

Encrypted Channel

Tropic Trooper has encrypted traffic with the C2 to prevent network detection.(Citation: TrendMicro Tropic Trooper May 2020)

T1573.002

Asymmetric Cryptography

Tropic Trooper has used SSL to connect to C2 servers.(Citation: TrendMicro Tropic Trooper Mar 2018)(Citation: TrendMicro Tropic Trooper May 2020)

Discovery

11 techniques

T1016

System Network Configuration Discovery

Tropic Trooper has used scripts to collect the host's network topology.(Citation: TrendMicro Tropic Trooper May 2020)

T1033

System Owner/User Discovery

Tropic Trooper used <code>letmein</code> to scan for saved usernames on the target system.(Citation: TrendMicro TropicTrooper 2015)

T1046

Network Service Discovery

Tropic Trooper used <code>pr</code> and an openly available tool to scan for open ports on target systems.(Citation: TrendMicro TropicTrooper 2015)(Citation: TrendMicro Tropic Trooper May 2020)

T1049

System Network Connections Discovery

Tropic Trooper has tested if the localhost network is available and other connection capability on an infected system using command scripts.(Citation: TrendMicro Tropic Trooper May 2020)

T1057

Process Discovery

Tropic Trooper is capable of enumerating the running processes on the system using <code>pslist</code>.(Citation: Unit 42 Tropic Trooper Nov 2016)(Citation: TrendMicro Tropic Trooper May 2020)

T1082

System Information Discovery

Tropic Trooper has detected a target system’s OS version.(Citation: TrendMicro TropicTrooper 2015)(Citation: TrendMicro Tropic Trooper May 2020)

T1083

File and Directory Discovery

Tropic Trooper has monitored files' modified time.(Citation: TrendMicro Tropic Trooper May 2020)

T1135

Network Share Discovery

Tropic Trooper used <code>netview</code> to scan target systems for shared resources.(Citation: TrendMicro TropicTrooper 2015)

T1518

Software Discovery

Tropic Trooper's backdoor could list the infected system's installed software.(Citation: TrendMicro Tropic Trooper May 2020)

T1518.001

Security Software Discovery

Tropic Trooper can search for anti-virus software running on the system.(Citation: Unit 42 Tropic Trooper Nov 2016)

T1680

Local Storage Discovery

Tropic Trooper has detected a target system’s system volume information.(Citation: TrendMicro TropicTrooper 2015)(Citation: TrendMicro Tropic Trooper May 2020)

Execution

4 techniques

T1059.003

Windows Command Shell

Tropic Trooper has used Windows command scripts.(Citation: TrendMicro Tropic Trooper May 2020)

T1106

Native API

Tropic Trooper has used multiple Windows APIs including HttpInitialize, HttpCreateHttpHandle, and HttpAddUrl.(Citation: TrendMicro Tropic Trooper May 2020)

T1203

Exploitation for Client Execution

Tropic Trooper has executed commands through Microsoft security vulnerabilities, including CVE-2017-11882, CVE-2018-0802, and CVE-2012-0158.(Citation: TrendMicro Tropic Trooper Mar 2018)(Citation: Unit 42 Tropic Trooper Nov 2016)

T1204.002

Malicious File

Tropic Trooper has lured victims into executing malware via malicious e-mail attachments.(Citation: Anomali Pirate Panda April 2020)

Exfiltration

2 techniques

T1020

Automated Exfiltration

Tropic Trooper has used a copy function to automatically exfiltrate sensitive data from air-gapped systems using USB storage.(Citation: TrendMicro Tropic Trooper May 2020)

T1052.001

Exfiltration over USB

Tropic Trooper has exfiltrated data using USB storage devices.(Citation: TrendMicro Tropic Trooper May 2020)

Initial Access

1 technique

T1566.001

Spearphishing Attachment

Tropic Trooper sent spearphishing emails that contained malicious Microsoft Office and fake installer file attachments.(Citation: Unit 42 Tropic Trooper Nov 2016)(Citation: TrendMicro TropicTrooper 2015)(Citation: CitizenLab Tropic Trooper Aug 2018)(Citation: Anomali Pirate Panda April 2020)(Citation: TrendMicro Tropic Trooper May 2020)

Lateral Movement

1 technique

T1091

Replication Through Removable Media

Tropic Trooper has attempted to transfer USBferry from an infected USB device by copying an Autorun function to the target machine.(Citation: TrendMicro Tropic Trooper May 2020)

Persistence

4 techniques

T1505.003

Web Shell

Tropic Trooper has started a web service in the target host and wait for the adversary to connect, acting as a web shell.(Citation: TrendMicro Tropic Trooper May 2020)

T1543.003

Windows Service

Tropic Trooper has installed a service pointing to a malicious DLL dropped to disk.(Citation: PWC KeyBoys Feb 2017)

T1547.001

Registry Run Keys / Startup Folder

Tropic Trooper has created shortcuts in the Startup folder to establish persistence.(Citation: Anomali Pirate Panda April 2020)(Citation: TrendMicro Tropic Trooper May 2020)

T1547.004

Winlogon Helper DLL

Tropic Trooper has created the Registry key <code>HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell</code> and sets the value to establish persistence.(Citation: Unit 42 Tropic Trooper Nov 2016)(Citation: TrendMicro Tropic Trooper May 2020)

Stealth

10 techniques

T1027.003

Steganography

Tropic Trooper has used JPG files with encrypted payloads to mask their backdoor routines and evade detection.(Citation: TrendMicro Tropic Trooper May 2020)

T1027.013

Encrypted/Encoded File

Tropic Trooper has encrypted configuration files.(Citation: TrendMicro Tropic Trooper Mar 2018)(Citation: TrendMicro Tropic Trooper May 2020)

T1036.005

Match Legitimate Resource Name or Location

Tropic Trooper has hidden payloads in Flash directories and fake installer files.(Citation: TrendMicro Tropic Trooper May 2020)

T1055.001

Dynamic-link Library Injection

Tropic Trooper has injected a DLL backdoor into dllhost.exe and svchost.exe.(Citation: TrendMicro Tropic Trooper Mar 2018)(Citation: TrendMicro Tropic Trooper May 2020)

T1070.004

File Deletion

Tropic Trooper has deleted dropper files on an infected system using command scripts.(Citation: TrendMicro Tropic Trooper May 2020)

T1078.003

Local Accounts

Tropic Trooper has used known administrator account credentials to execute the backdoor directly.(Citation: TrendMicro Tropic Trooper May 2020)

T1140

Deobfuscate/Decode Files or Information

Tropic Trooper used shellcode with an XOR algorithm to decrypt a payload. Tropic Trooper also decrypted image files which contained a payload.(Citation: Unit 42 Tropic Trooper Nov 2016)(Citation: TrendMicro Tropic Trooper May 2020)

T1221

Template Injection

Tropic Trooper delivered malicious documents with the XLSX extension, typically used by OpenXML documents, but the file itself was actually an OLE (XLS) document.(Citation: Unit 42 Tropic Trooper Nov 2016)

T1564.001

Hidden Files and Directories

Tropic Trooper has created a hidden directory under <code>C:\ProgramData\Apple\Updates\</code> and <code>C:\Users\Public\Documents\Flash\</code>.(Citation: TrendMicro Tropic Trooper Mar 2018)(Citation: TrendMicro Tropic Trooper May 2020)

T1574.001

DLL

Tropic Trooper has been known to side-load DLLs using a valid version of a Windows Address Book and Windows Defender executable with one of their tools.(Citation: CitizenLab KeyBoy Nov 2016)(Citation: Anomali Pirate Panda April 2020)

Software / Tooling

S0387

KeyBoy

Family

(Citation: Unit 42 Tropic Trooper Nov 2016)(Citation: CitizenLab Tropic Trooper Aug 2018)

PcShare

Poison Ivy

PoisonIvy

(Citation: Unit 42 Tropic Trooper Nov 2016)

S0596

ShadowPad

Family

(Citation: Recorded Future RedEcho Feb 2021)

S0452

USBferry

Family

(Citation: TrendMicro Tropic Trooper May 2020)

S0388

YAHOYAH

Family

(Citation: TrendMicro TropicTrooper 2015)

Campaigns / Victims

No campaigns linked yet.

Observed Data

No observed data linked yet.

Indicators of Compromise

No IOCs linked yet.

References

Crowdstrike Pirate Panda April 2020 — Busselen, M. (2020, April 7). On-demand Webcast: CrowdStrike Experts on COVID-19 Cybersecurity Challenges and Recommendations. Retrieved May 20, 2020.
TrendMicro Tropic Trooper May 2020 — Chen, J.. (2020, May 12). Tropic Trooper’s Back: USBferry Attack Targets Air gapped Environments. Retrieved May 20, 2020.
TrendMicro Tropic Trooper Mar 2018 — Horejsi, J., et al. (2018, March 14). Tropic Trooper’s New Strategy. Retrieved November 9, 2018.
Unit 42 Tropic Trooper Nov 2016 — Ray, V. (2016, November 22). Tropic Trooper Targets Taiwanese Government and Fossil Fuel Provider With Poison Ivy. Retrieved November 9, 2018.

Intel Summary

Techniques

Tools

Campaigns

IOCs

Observed Data

Tactics

Details

MITRE ID: G0081
Type: Unknown
Resource Level: Government
Primary Motivation: Espionage
Country of Origin: China (CN)
Confidence: 90%
Added: May 2, 2026
STIX ID: intrusion-set--56319646-eb6e-41fc-ae53-aadfa7adb924

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.