Tropic Trooper

Names and who uses them

• Tropic TrooperOur name
• Pirate PandaCrowdStrike
• KeyBoyPalo Alto Networks

Targets

Sectors: Government, Healthcare, Transport

Regions: Taiwan, Hong Kong

Known techniques

• T1016System Network Configuration Discovery
• T1020Automated Exfiltration
• T1027.003Steganography
• T1027.013Encrypted/Encoded File
• T1033System Owner/User Discovery
• T1036.005Match Legitimate Resource Name or Location
• T1046Network Service Discovery
• T1049System Network Connections Discovery
• T1052.001Exfiltration over USB
• T1055.001Dynamic-link Library Injection
• T1057Process Discovery
• T1059.003Windows Command Shell
• T1070.004File Deletion
• T1071.001Web Protocols
• T1071.004DNS
• T1078.003Local Accounts
• T1082System Information Discovery
• T1083File and Directory Discovery
• T1091Replication Through Removable Media
• T1105Ingress Tool Transfer
• T1106Native API
• T1119Automated Collection
• T1132.001Standard Encoding
• T1135Network Share Discovery
• T1140Deobfuscate/Decode Files or Information
• T1203Exploitation for Client Execution
• T1204.002Malicious File
• T1221Template Injection
• T1505.003Web Shell
• T1518Software Discovery
• T1518.001Security Software Discovery
• T1543.003Windows Service
• T1547.001Registry Run Keys / Startup Folder
• T1547.004Winlogon Helper DLL
• T1564.001Hidden Files and Directories
• T1566.001Spearphishing Attachment
• T1573Encrypted Channel
• T1573.002Asymmetric Cryptography
• T1574.001DLL
• T1680Local Storage Discovery

Malware and tools used