Loading story…
Tropic Trooper targeted Chinese-speaking individuals in Taiwan and additional victims in South Korea and Japan with military-themed lure documents delivered in ZIP archives. The campaign used a trojanized SumatraPDF executable and a loader identified as TOSHIS to display an AUKUS-themed decoy PDF while decrypting and launching an AdaptixC2 Beacon in memory, marking a shift from the group’s earlier use of Cobalt Strike Beacon and Merlin Mythic. Researchers said the lures referenced US-UK and US-Australia nuclear submarine cooperation and were designed to blend into geopolitical themes likely to interest the targets.
The intrusion stood out for abusing trusted developer services for command and control and follow-on access. The customized AdaptixC2 implant used the GitHub repository cvaS23uchsahs/rss, relying on GitHub Issues and repository files for tasking, beaconing, and encrypted data exfiltration, while rapidly deleting issue artifacts to frustrate analysis. On selected victims, the operators then deployed VS Code tunnels for persistent interactive remote access. Infrastructure tied to the staging server also exposed EntryShell and a Cobalt Strike Beacon carrying watermark 520, reinforcing attribution to Tropic Trooper.
TTPs, infrastructure, and targeting history in one profile.
7 events from the most recent confirmed update back to the earliest known activity.
Itochu Cyber & Intelligence disclosed a Tropic Trooper intrusion in which the group compromised a target's home router, hijacked DNS settings, and delivered malware through what appeared to be a legitimate software update. The case showed the actor expanding beyond institutional targets to personal devices and individuals in Japan and the wider region.
Zscaler ThreatLabz published research detailing the campaign's lure documents, AdaptixC2 GitHub listener, VS Code tunnel usage, and attribution to Tropic Trooper. The disclosure highlighted the actor's pivot to open-source tooling and trusted platforms for command and control.
ThreatLabz linked the staging server and tooling to Tropic Trooper through infrastructure hosting EntryShell and a Cobalt Strike Beacon with watermark 520, alongside similarities to the TOSHIS loader. Based on these findings, researchers attributed the campaign to Tropic Trooper with high confidence.
After initial reconnaissance with the AdaptixC2 implant, the attackers deployed Visual Studio Code tunnels on selected victims to maintain interactive remote access. This reflected the group's use of trusted developer infrastructure as part of the intrusion chain.
The deployed AdaptixC2 implant used a customized GitHub-based listener tied to the repository cvaS23uchsahs/rss, abusing GitHub Issues and repository files for tasking, beaconing, and data exfiltration. Operators rapidly deleted beacon issues, likely to hinder analysis and forensic recovery.
The campaign used a trojanized SumatraPDF executable and a loader identified as TOSHIS to display an AUKUS-themed decoy PDF while decrypting and executing an AdaptixC2 Beacon in memory. Researchers noted this as a shift from earlier TOSHIS activity that used Cobalt Strike Beacon or Merlin Mythic.
ThreatLabz observed a Tropic Trooper campaign targeting Chinese-speaking individuals in Taiwan as well as victims in South Korea and Japan. The intrusion began with a ZIP archive containing Chinese-language, military-themed lure files.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
6 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcethehackernews.com
Open sourcedarkreading.com
Open sourcecybersecuritynews.com
Open sourcezscaler.com
Open sourcehitcon.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A spearphishing campaign attributed with high confidence to **Tropic Trooper** targeted employees at Chinese companies with a housing fund-themed lure that delivered a ZIP archive containing a disguised `.lnk` shortcut, a decoy Excel file, a hidden `&Recycle.Bin` folder, a legitimate McAfee-signed executable, a malicious DLL, and an encrypted payload. When the shortcut was opened, the malware chain launched the signed executable through **DLL side-loading**, displayed the decoy document, copied files into `C:\Users\Public\Downloads`, renamed `NTUSER.EXE` to `AVIRA.EXE`, and decrypted `setting.dat` to reflectively load a **Cobalt Strike Beacon** into memory.
Aug 15, 2026
Kaspersky reported that the Chinese-speaking APT group **Tropic Trooper**—also tracked as **KeyBoy** and **Pirate Panda**—ran a persistent cyber-espionage operation against a Middle Eastern government entity after compromising a public **Umbraco CMS** server. The intrusion began in June 2023 and continued into 2024, with the attackers deploying a new **.NET-based China Chopper** web shell variant to gain foothold and support follow-on activity on the exposed system. Investigators said the operators then used post-exploitation tooling and **DLL search-order hijacking** loaders to deliver **Crowdoor** malware and maintain persistence, adapting their approach after security controls blocked an initial loader by introducing previously unreported `VERSION.dll`-based variants. Kaspersky linked the campaign to Tropic Trooper with high confidence based on code overlap, shared **RC4** keys, tooling, and similarities to earlier operations, while noting some tradecraft overlap with **FamousSparrow**; the case also marks an apparent expansion of Tropic Trooper targeting beyond Taiwan, the Philippines, and Hong Kong to a Middle Eastern system publishing human-rights studies related to the Israel-Hamas conflict.
Jun 29, 2026
TA428 conducted **Operation LagTime IT**, a cyber-espionage campaign targeting government organizations in East Asia and defense- and aviation-related entities in Russia and Mongolia. The intrusions used Royal Road-generated malicious RTF documents exploiting **`CVE-2018-0798`** in Microsoft Word, including lures themed around **Qasem Soleimani** and **COVID-19**, to deliver **Poison Ivy**, **Cotx RAT**, and the malware later identified as **nccTrojan** or **MsmRAT**. Researchers said the activity was observed from at least March 2019 through 2020 and showed overlap with Chinese intrusion clusters including **Tick**, **Tonto**, and possibly **DragonOK/Danti**. After initial compromise, the operators stole credentials from Outlook and **`lsass.exe`**, scanned victim networks, and moved laterally using **`MS17-010`** tooling including EternalBlue-related exploitation. TA428 also used **NBTScan**, DLL side-loading with legitimate Intel and PotPlayer binaries, malicious **`.wll`** files for persistence, and follow-on malware such as **Tmanger**, **Poison Ivy-B**, and multiple **nccTrojan** variants. Researchers found that **nccTrojan** had at least two major branches: an initial-access version with standard RAT functions and XOR-obfuscated traffic, and a later-stage version installed as a Windows service that used a custom TCP protocol with **AES-encrypted** payloads and an activation code for command handling.
Aug 15, 2026