Loading story…
A spearphishing campaign attributed with high confidence to Tropic Trooper targeted employees at Chinese companies with a housing fund-themed lure that delivered a ZIP archive containing a disguised .lnk shortcut, a decoy Excel file, a hidden &Recycle.Bin folder, a legitimate McAfee-signed executable, a malicious DLL, and an encrypted payload. When the shortcut was opened, the malware chain launched the signed executable through DLL side-loading, displayed the decoy document, copied files into C:\Users\Public\Downloads, renamed NTUSER.EXE to AVIRA.EXE, and decrypted setting.dat to reflectively load a Cobalt Strike Beacon into memory.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
ITOCHU Cyber & Intelligence analyzed a spearphishing campaign targeting employees at Chinese companies using a housing provident fund-themed lure and attributed the activity with high confidence to Tropic Trooper (also known as Pirate Panda and KeyBoy). The campaign used a ZIP attachment containing a disguised .lnk shortcut, hidden files, a legitimate McAfee-signed executable, a malicious DLL, and an encrypted payload blob.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 13 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
learn.microsoft.com
Open sourceblog.itochuci.co.jp
Open sourcevirusbulletin.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Tropic Trooper targeted Chinese-speaking individuals in Taiwan and additional victims in South Korea and Japan with military-themed lure documents delivered in ZIP archives. The campaign used a trojanized **SumatraPDF** executable and a loader identified as **TOSHIS** to display an AUKUS-themed decoy PDF while decrypting and launching an **AdaptixC2 Beacon** in memory, marking a shift from the group’s earlier use of **Cobalt Strike Beacon** and **Merlin Mythic**. Researchers said the lures referenced US-UK and US-Australia nuclear submarine cooperation and were designed to blend into geopolitical themes likely to interest the targets. The intrusion stood out for abusing trusted developer services for command and control and follow-on access. The customized AdaptixC2 implant used the GitHub repository `cvaS23uchsahs/rss`, relying on GitHub Issues and repository files for tasking, beaconing, and encrypted data exfiltration, while rapidly deleting issue artifacts to frustrate analysis. On selected victims, the operators then deployed **VS Code tunnels** for persistent interactive remote access. Infrastructure tied to the staging server also exposed **EntryShell** and a **Cobalt Strike Beacon** carrying watermark `520`, reinforcing attribution to Tropic Trooper.
Jun 29, 2026
Researchers documented targeted intrusion campaigns that used military and geopolitical decoy documents to compromise victims in South Asia and deploy **Cobalt Strike**. Cisco Talos reported that attackers distributed malicious Microsoft Office files posing as Indian Air Force and other government or military documents, with macros dropping a custom loader called **IndigoDrop** into the Windows Startup folder for persistence. IndigoDrop performed anti-infection checks, fetched Metasploit shellcode, and ultimately loaded an XOR-encoded Cobalt Strike beacon hidden in trojanized jQuery files, while related Python modules conducted reconnaissance and stole browser and Wi-Fi credentials. A separate campaign analyzed by Zscaler used a Word document themed around the India-China border dispute to trigger a macro-delivered PowerShell chain that staged shellcode behind a fake GIF header and installed a Cobalt Strike beacon over HTTPS. The operators used fileless techniques, spoofed HTTP `Host` headers such as `update.windows.microsoft.com`, and in some variants injected an RSA-encrypted payload into `notepad.exe`; researchers also identified infrastructure including `47.240.73.77`, `114.67.110.37`, and `360doc.com`-based command-and-control domains. Across both campaigns, the attackers relied on topical military lures, multi-stage loaders, and legitimate-looking web traffic to conceal remote access activity against likely government and defense-related targets.
Aug 15, 2026
Targeted intrusion campaigns used tampered **Microsoft-signed DLLs** to evade trust checks and launch malware through **DLL side-loading** and service hijacking. LAC researchers documented the **SigLoader** malware family modifying data in a file's certificate or overlay area while preserving Windows signature validation, allowing the DLL to still appear legitimately signed. The loader then decrypted and executed additional stages in memory using layered routines including **XOR**, custom **DES**, **AES**, and later **RC4**, with observed payloads including **DelfsCake**, **GreetCake**, and shellcode associated with **Metasploit Framework** or **Cobalt Strike**. In one case, the intrusion began with exploitation of an **SSL-VPN vulnerability** before the loader was deployed on a compromised endpoint. A related campaign assessed as likely tied to **APT41** used the same signed-DLL abuse technique to deliver **Cobalt Strike Beacon**, including a tampered `KBDTAM131.DLL` derived from `UXLibRes.dll` and malicious loading via the Windows **IKEEXT** service and `wlbsctrl.dll`. Researchers said the loader stored encrypted configuration data, API strings, offsets, and payload content with **ChaCha20**, then decrypted a Beacon linked to a leaked or cracked **Cobalt Strike 4.x** build using watermark `0x12345678` and C2 over **HTTPS**, with other samples using **HTTP** or **DNS**. The activity was also tied to a malicious shortcut file masquerading as a PDF, campaign infrastructure including `119.45.238[.]189` and `192.109.98[.]187`, and detection guidance using **Sigcheck**, **Autoruns**, Windows event logs, YARA rules, and stricter Authenticode verification.
Aug 15, 2026