Introduction
Tropic Trooper is an unaffiliated threat group that has led targeted campaigns against targets in Taiwan, the Philippines, and Hong Kong. Tropic Trooper focuses on targeting government, healthcare, transportation, and high-tech industries and has been active since 2011. TrendMicro Tropic Trooper Mar 2018 Unit 42 Tropic Trooper Nov 2016 TrendMicro Tropic Trooper May 2020
Activities and Tactics
Information pending cataloguing.
Notable Campaigns
Information pending cataloguing.
Tactics, Techniques, and Procedures (TTPs)
- T1543.003 Windows Service
- T1070.004 File Deletion
- T1566.001 Spearphishing Attachment
- T1105 Ingress Tool Transfer
- T1057 Process Discovery
- T1204.002 Malicious File
- T1573 Encrypted Channel
- T1071.001 Web Protocols
- T1564.001 Hidden Files and Directories
- T1221 Template Injection
- T1033 System Owner/User Discovery
- T1046 Network Service Discovery
- T1016 System Network Configuration Discovery
- T1052.001 Exfiltration over USB
- T1547.001 Registry Run Keys / Startup Folder
- T1505.003 Web Shell
- T1573.002 Asymmetric Cryptography
- T1059.003 Windows Command Shell
- T1106 Native API
- T1574.001 DLL
- T1083 File and Directory Discovery
- T1027.013 Encrypted/Encoded File
- T1036.005 Match Legitimate Resource Name or Location
- T1132.001 Standard Encoding
- T1078.003 Local Accounts
- T1680 Local Storage Discovery
- T1547.004 Winlogon Helper DLL
- T1203 Exploitation for Client Execution
- T1071.004 DNS
- T1119 Automated Collection
- T1055.001 Dynamic-link Library Injection
- T1020 Automated Exfiltration
- T1135 Network Share Discovery
- T1082 System Information Discovery
- T1518.001 Security Software Discovery
- T1140 Deobfuscate/Decode Files or Information
- T1049 System Network Connections Discovery
- T1027.003 Steganography
- T1518 Software Discovery
- T1091 Replication Through Removable Media
ATT&CK technique IDs (denormalized)
- T1016
- T1020
- T1027.003
- T1027.013
- T1033
- T1036.005
- T1046
- T1049
- T1052.001
- T1055.001
- T1057
- T1059.003
- T1070.004
- T1071.001
- T1071.004
- T1078.003
- T1082
- T1083
- T1091
- T1105
- T1106
- T1119
- T1132.001
- T1135
- T1140
- T1203
- T1204.002
- T1221
- T1505.003
- T1518
- T1518.001
- T1543.003
- T1547.001
- T1547.004
- T1564.001
- T1566.001
- T1573
- T1573.002
- T1574.001
- T1680
Notable Indicators of Compromise (IOCs)
No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.
Malware and Tools
MITRE ATT&CK Software
- USBferry (S0452) — malware
- ShadowPad (S0596) — malware
- PoisonIvy (S0012) — malware
- BITSAdmin (S0190) — tool
- YAHOYAH (S0388) — malware
- KeyBoy (S0387) — malware
Attribution and Evidence
Information pending cataloguing.
References
[1] mitre-attack [5] Crowdstrike Pirate Panda April 2020 Busselen, M. (2020, April 7). On-demand Webcast: CrowdStrike Experts on COVID-19 Cybersecurity Challenges and Recommendations. Retrieved May 20, 2020. [6] TrendMicro Tropic Trooper May 2020 Chen, J.. (2020, May 12). Tropic Trooper’s Back: USBferry Attack Targets Air gapped Environments. Retrieved May 20, 2020. [7] TrendMicro Tropic Trooper Mar 2018 Horejsi, J., et al. (2018, March 14). Tropic Trooper’s New Strategy. Retrieved November 9, 2018. [8] Unit 42 Tropic Trooper Nov 2016 Ray, V. (2016, November 22). Tropic Trooper Targets Taiwanese Government and Fossil Fuel Provider With Poison Ivy. Retrieved November 9, 2018.