MalwareUsed by 1 actor

BKDR_TEBSHELL.ZTGK

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Tropic Trooper

Hey! Welcome Server 2.0’s backdoor (detected as BKDR_TEBSHELL.ZTGK) – This is the latest version of the backdoor, available in 32-bit and 64-bit versions, which uses an invisible web shell for remote control and network security evasion.

via trend micro blog historicblog.trendmicro.com

MITRE ATT&CK

Techniques & procedures

6 distinct techniques documented for this family, organized by ATT&CK tactic.

Persistence

3 techniques

T1112Modify RegistryEvidence1

change registry to disable error display, and launch the service

T1505.003Web ShellEvidence1

This is the latest version of the backdoor, available in 32-bit and 64-bit versions, which uses an invisible web shell for remote control and network security evasion.

T1543.003Windows ServiceEvidence1

It runs the process as a service... The executable version will install and name it as a Windows service

Privilege Escalation

2 techniques

T1055Process InjectionEvidence1

After the encrypted payload is loaded, the loader injects a malicious DLL into rundll32.exe.

T1543.003Windows ServiceEvidence1

It runs the process as a service... The executable version will install and name it as a Windows service

Stealth

2 techniques

T1055Process InjectionEvidence1

After the encrypted payload is loaded, the loader injects a malicious DLL into rundll32.exe.

T1564.003Hidden WindowEvidence1

which uses an invisible web shell for remote control and network security evasion

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

change registry to disable error display, and launch the service

Command and Control

1 technique

T1572Protocol TunnelingEvidence1

hides backdoor communication in normal traffic, and uses customized TCP protocol

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

trend micro blog historicNews

May 12, 2020

Tropic Trooper’s USBferry Targets Air-Gapped Networks | Trend Micro (US)

A later Tropic Trooper backdoor that uses an invisible web shell for remote control, runs as a service, hides communications in normal traffic, and uses a customized TCP protocol.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping6

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

BKDR_TEBSHELL.ZTGK

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Tropic Trooper

via trend micro blog historicblog.trendmicro.com

MITRE ATT&CK

Techniques & procedures

6 distinct techniques documented for this family, organized by ATT&CK tactic.

Persistence

3 techniques

T1112Modify RegistryEvidence1

change registry to disable error display, and launch the service

T1505.003Web ShellEvidence1

This is the latest version of the backdoor, available in 32-bit and 64-bit versions, which uses an invisible web shell for remote control and network security evasion.

T1543.003Windows ServiceEvidence1

It runs the process as a service... The executable version will install and name it as a Windows service

Privilege Escalation

2 techniques

T1055Process InjectionEvidence1

After the encrypted payload is loaded, the loader injects a malicious DLL into rundll32.exe.

T1543.003Windows ServiceEvidence1

It runs the process as a service... The executable version will install and name it as a Windows service

Stealth

2 techniques

T1055Process InjectionEvidence1

After the encrypted payload is loaded, the loader injects a malicious DLL into rundll32.exe.

T1564.003Hidden WindowEvidence1

which uses an invisible web shell for remote control and network security evasion

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

change registry to disable error display, and launch the service

Command and Control

1 technique

T1572Protocol TunnelingEvidence1

hides backdoor communication in normal traffic, and uses customized TCP protocol

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

trend micro blog historicNews

May 12, 2020

Tropic Trooper’s USBferry Targets Air-Gapped Networks | Trend Micro (US)

A later Tropic Trooper backdoor that uses an invisible web shell for remote control, runs as a service, hides communications in normal traffic, and uses a customized TCP protocol.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping6

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.