Loading story…
Kaspersky reported that the Chinese-speaking APT group Tropic Trooper—also tracked as KeyBoy and Pirate Panda—ran a persistent cyber-espionage operation against a Middle Eastern government entity after compromising a public Umbraco CMS server. The intrusion began in June 2023 and continued into 2024, with the attackers deploying a new .NET-based China Chopper web shell variant to gain foothold and support follow-on activity on the exposed system.
Investigators said the operators then used post-exploitation tooling and DLL search-order hijacking loaders to deliver Crowdoor malware and maintain persistence, adapting their approach after security controls blocked an initial loader by introducing previously unreported VERSION.dll-based variants. Kaspersky linked the campaign to Tropic Trooper with high confidence based on code overlap, shared RC4 keys, tooling, and similarities to earlier operations, while noting some tradecraft overlap with FamousSparrow; the case also marks an apparent expansion of Tropic Trooper targeting beyond Taiwan, the Philippines, and Hong Kong to a Middle Eastern system publishing human-rights studies related to the Israel-Hamas conflict.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
Kaspersky reported that a persistent cyber-espionage campaign by Tropic Trooper against a Middle Eastern government entity began in June 2023. The intrusion started with compromise of a public Umbraco CMS server using a new .NET-based China Chopper web shell variant.
Kaspersky attributed the campaign to Tropic Trooper with high confidence based on code overlap, shared RC4 keys, tooling, and similarities to prior operations. Researchers also noted overlap with tradecraft associated with FamousSparrow.
During the intrusion, the attackers used post-exploitation tools and DLL search-order hijacking loaders to deliver Crowdoor malware and maintain persistence on the compromised environment. After an initial loader was blocked by security controls, they deployed previously unreported VERSION.dll-based variants to evade defenses.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 27 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Tropic Trooper targeted Chinese-speaking individuals in Taiwan and additional victims in South Korea and Japan with military-themed lure documents delivered in ZIP archives. The campaign used a trojanized **SumatraPDF** executable and a loader identified as **TOSHIS** to display an AUKUS-themed decoy PDF while decrypting and launching an **AdaptixC2 Beacon** in memory, marking a shift from the group’s earlier use of **Cobalt Strike Beacon** and **Merlin Mythic**. Researchers said the lures referenced US-UK and US-Australia nuclear submarine cooperation and were designed to blend into geopolitical themes likely to interest the targets. The intrusion stood out for abusing trusted developer services for command and control and follow-on access. The customized AdaptixC2 implant used the GitHub repository `cvaS23uchsahs/rss`, relying on GitHub Issues and repository files for tasking, beaconing, and encrypted data exfiltration, while rapidly deleting issue artifacts to frustrate analysis. On selected victims, the operators then deployed **VS Code tunnels** for persistent interactive remote access. Infrastructure tied to the staging server also exposed **EntryShell** and a **Cobalt Strike Beacon** carrying watermark `520`, reinforcing attribution to Tropic Trooper.
Jun 29, 2026
Researchers assessing an espionage campaign targeting East Asian companies since May 2023 said the activity likely focused on semiconductor and rare-metal sectors and used the **Xiangoop Loader** to deliver fileless payloads including **Cobalt Strike Beacon**, **EntryShell**, and in some cases **CrowDoor** through **SparrowDoor Loader**. Malware analysis found strong overlap between EntryShell and the older **KeyBoy** family, including matching embedded and encrypted strings, leading investigators to assess EntryShell as an updated KeyBoy variant. The same research identified technical overlap between **CrowDoor** and **SparrowDoor**, including identical loader shellcode and shared structural and command features, strengthening the case that **Tropic Trooper** and **FamousSparrow** are either the same threat actor or closely aligned operators. Earlier reporting on FamousSparrow described a cyberespionage group active since at least 2019 that exploited internet-facing applications such as **Microsoft Exchange** via **ProxyLogon**, **Microsoft SharePoint**, and **Oracle Opera** to deploy **SparrowDoor**, a backdoor capable of persistence, host reconnaissance, file theft, process creation, shellcode injection, and interactive remote shell access.
Aug 15, 2026
Palo Alto Networks Unit 42 disclosed a long-running cyberespionage campaign, tracked as **CL-STA-1087**, that has targeted military organizations across Southeast Asia since at least 2020. The intrusions were aimed at collecting highly specific intelligence on military capabilities, organizational structures, **C4I** environments, joint military efforts, official meeting records, and cooperation with Western armed forces, rather than conducting broad data theft. Researchers said the activity was first uncovered after suspicious PowerShell behavior on an unmanaged endpoint exposed an already-established foothold, with the attackers using delayed execution, dormant periods lasting months, and reverse shells to preserve stealth and support long-term access. The operation used custom malware including the **AppleChris** backdoor, the in-memory **MemFun** backdoor, and **Getpass**, a modified Mimikatz-based credential theft tool. Investigators reported tradecraft including DLL hijacking, process hollowing, reflective DLL loading, timestomping, malicious Windows service creation, and lateral movement with WMI and native .NET tooling across domain controllers, web servers, IT workstations, and executive systems. Command-and-control traffic was hidden through dead-drop resolvers on legitimate services such as **Pastebin** and **Dropbox**, while infrastructure patterns, UTC+8 working hours, China-based cloud hosting, and Simplified Chinese artifacts led researchers to assess the campaign with moderate confidence as China-linked state-backed espionage.
Jun 29, 2026