Skip to content

Tropic Trooper

Tropic Trooper is an unaffiliated threat group that has led targeted campaigns against targets in Taiwan, the Philippines, and Hong Kong. Tropic Trooper focuses on targeting government, healthcare, transportation, and high-tech industries and has been active since 2011.

ATT&CK ID: G0081
Techniques: 35
Tools: 6

Also tracked as Pirate Panda · KeyBoy

Vulnerabilities it has exploited

Techniques

Initial Access

Valid Accounts Replication Through Removable Media Phishing

Execution

Command and Scripting Interpreter Native API Exploitation for Client Execution User Execution Hijack Execution Flow

Persistence

Valid Accounts Server Software Component Create or Modify System Process Boot or Logon Autostart Execution

Privilege Escalation

Process Injection Valid Accounts Create or Modify System Process Boot or Logon Autostart Execution

Stealth

Obfuscated Files or Information Masquerading Process Injection Indicator Removal Valid Accounts Deobfuscate/Decode Files or Information Template Injection Hide Artifacts Hijack Execution Flow

Discovery

System Network Configuration Discovery System Owner/User Discovery Network Service Discovery System Network Connections Discovery Process Discovery System Information Discovery File and Directory Discovery Network Share Discovery Software Discovery Local Storage Discovery

Lateral Movement

Replication Through Removable Media

Collection

Automated Collection

Command and Control

Application Layer Protocol Ingress Tool Transfer Data Encoding Encrypted Channel

Exfiltration

Automated Exfiltration Exfiltration Over Physical Medium

Software

BITSAdmin · KeyBoy · PoisonIvy · ShadowPad · USBferry · YAHOYAH

MITRE ATT&CK All threat actors