Tropic Trooper
KeyBoy is an alias of Tropic Trooper, also known as Pirate Panda. Tropic Trooper is an APT group active since 2011. The group has traditionally targeted government, healthcare, transportation, and high-tech sectors in Taiwan, the Philippines, and Hong Kong. Kaspersky also assessed with high confidence that Tropic Trooper conducted a persistent cyber-espionage campaign against a Middle Eastern government entity beginning in June 2023 and observed through 2024, and also observed related targeting of a government entity in Malaysia. The reported intrusion tradecraft included compromise of a public Umbraco CMS server with a new .NET-based China Chopper web shell variant, followed by deployment of post-exploitation tools and DLL search-order hijacking loaders to deliver Crowdoor and maintain persistence. The post-exploitation toolset included Fscan, Swor, Neo-reGeorg, ByPassGodzilla, and batch scripts. Kaspersky linked the activity to Tropic Trooper with high confidence based on code overlap, shared RC4 keys, tooling, and similarities to prior campaigns, while also noting overlap with FamousSparrow-associated tradecraft. Observed tactics, techniques, and procedures in the provided content include luring victims into executing malware via malicious email attachments; use of HTTP and SSL for command-and-control; use of shellcode with XOR decryption and Base64-encoded command strings; use of scripts and Windows command scripts; collection of host network topology; monitoring file modified times; enumeration of running processes using pslist; scanning for saved usernames with letmein; automated collection via a USBferry attack; creation of hidden directories under C:\ProgramData\Apple\Updates\ and C:\Users\Public\Documents\Flash; creation of Startup folder shortcuts for persistence; and installation of a Windows service pointing to a malicious DLL dropped to disk. In the Crowdoor-related activity, persistence was also established by creating a Windows service named WinStore or, if that failed, by setting HKCU\Software\Microsoft\Windows\CurrentVersion\Run\WinStore. The content also notes that Tropic Trooper has been reported abusing Visual Studio Code in its attacks.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
54 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
24 malware families attributed to this actor across reporting.
19 additional families tracked in Mallory.
Associated vulnerabilities
8 CVEs this actor has used in observed campaigns. 8 of them exploited in the wild.
...has exploited client software vulnerabilities for execution, such as Microsoft Word CVE-2012-0158...
...has exploited Office vulnerabilities such as CVE-2017-11882...
...has exploited Microsoft Office vulnerabilities... CVE-2018-0802.
This detection identifies instances where Windows Explorer.exe spawns PowerShell or cmd.exe processes, particularly focusing on executions initiated by LNK files. This behavior is associated with the ZDI-CAN-25373 Windows shortcut zero-day vulnerability, where specially crafted LNK files are used to trigger malicious code execution through cmd.exe or powershell.exe. This technique has been actively exploited by multiple APT groups in targeted attacks through both HTTP and SMB delivery methods.
In our telemetry, we noticed exploitation attempts of several CVEs (CVE-2021-34473, CVE-2021-34523 and CVE-2021-31207 in Microsoft Exchange, CVE-2023-26360 in Adobe ColdFusion). Therefore, we believe with moderate confidence that these web shells were dropped by exploiting an existing unpatched vulnerability.
3 more CVEs tied to this actor tracked in Mallory.
Observables
76 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Listed as an associated threat actor for exploitation activity related to abuse of the Windows Cloud Files API / cldapi.dll detection.
Conducting a sophisticated campaign targeting Chinese-speaking individuals using a trojanized SumatraPDF reader, deploying AdaptixC2 Beacon, abusing GitHub for command-and-control, and leveraging Microsoft Visual Studio Code tunnels for remote access.
Listed as a threat actor associated with exploitation and privilege-escalation detection coverage for Windows admin password changes by non-admin users.
Listed as a threat actor associated with exploitation for privilege escalation and Windows service persistence/installation in the detection annotations.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.