Tropic Trooper

Tropic Trooper, also known as KeyBoy and Pirate Panda, is a China-backed, state-sponsored cyberespionage actor targeting government, healthcare, transportation, and high-technology organizations in Taiwan, the Philippines, and Hong Kong. The group develops custom espionage tools and uses targeted social engineering to compromise systems and maintain access to victim networks. Initial-access techniques include spearphishing with malicious Microsoft Office documents and fake installer attachments. Document lures have advertised job vacancies at organizations of potential sociopolitical interest to recipients. Observed campaigns exploited Microsoft Equation Editor vulnerabilities CVE-2017-11882 and CVE-2018-0802, then abused Windows Installer and Background Intelligent Transfer Service utilities for malware installation and execution. Tropic Trooper uses DLL side-loading through legitimate applications and injects DLL backdoors into legitimate Windows processes. Its tooling includes the FakeRun loader and TClient backdoor. TClient reads an externally stored encrypted configuration and uses SSL-based command-and-control communications. Other concealment techniques include XOR-encrypted payloads, payload-bearing images, string obfuscation, and encrypted configuration files. The group establishes persistence through Startup-folder shortcuts and Windows services pointing to malicious DLLs. It also uses Windows command scripts and host-based web services functioning as web shells to support remote access and post-compromise operations.