AdversaryGraph public intelligence page
This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.
Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.
Main AdversaryGraph project Documentation Malware Analysis GitHub
Tropic Trooper
Aliases: KeyBoy, Pirate Panda, Tropic Trooper
[Tropic Trooper](https://attack.mitre.org/groups/G0081) is an unaffiliated threat group that has led targeted campaigns against targets in Taiwan, the Philippines, and Hong Kong. [Tropic Trooper](https://attack.mitre.org/groups/G0081) focuses on targeting government, healthcare, transportation, and high-tech industries and has been active since 2011.(Citation: TrendMicro Tropic Trooper Mar 2018)(Citation: Unit 42 Tropic Trooper Nov 2016)(Citation: TrendMicro Tropic Trooper May 2020)
Open interactive actor investigation
ATT&CK techniques
Correlated CTI and IR reports
Continue the investigation
Attack tools, simulations and detection rules
Follow explicit source relationships into the reference modules. Linked procedures and detectors are not claims of live validation or actor attribution.
- BITSAdmin tool reference — Explicit actor uses software relationship in pinned ATT&CK
- T1016 System Network Configuration Discovery simulation — Exact active technique ID
- T1016 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1020 Automated Exfiltration simulation — Exact active technique ID
- T1020 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1027.003 Steganography simulation — Exact active technique ID
- T1027.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1027.013 Encrypted/Encoded File simulation — Exact active technique ID
- T1027.013 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1033 System Owner/User Discovery simulation — Exact active technique ID
- T1033 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1036.005 Match Legitimate Resource Name or Location simulation — Exact active technique ID
- T1036.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1046 Network Service Discovery simulation — Exact active technique ID
- T1046 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1049 System Network Connections Discovery simulation — Exact active technique ID
- T1049 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1052.001 Exfiltration over USB simulation — Exact active technique ID
- T1052.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1055.001 Dynamic-link Library Injection simulation — Exact active technique ID
- T1055.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1057 Process Discovery simulation — Exact active technique ID
- T1057 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.003 Windows Command Shell simulation — Exact active technique ID
- T1059.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1070.004 File Deletion simulation — Exact active technique ID
- T1070.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1071.001 Web Protocols simulation — Exact active technique ID
- T1071.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1071.004 DNS simulation — Exact active technique ID
- T1071.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1078.003 Local Accounts simulation — Exact active technique ID
- T1078.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1082 System Information Discovery simulation — Exact active technique ID
- T1082 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1083 File and Directory Discovery simulation — Exact active technique ID
- T1083 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1091 Replication Through Removable Media simulation — Exact active technique ID
- T1091 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1105 Ingress Tool Transfer simulation — Exact active technique ID
- T1105 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1106 Native API simulation — Exact active technique ID
- T1106 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1119 Automated Collection simulation — Exact active technique ID
- T1119 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1132.001 Standard Encoding simulation — Exact active technique ID
- T1132.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1135 Network Share Discovery simulation — Exact active technique ID
- T1135 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1140 Deobfuscate/Decode Files or Information simulation — Exact active technique ID
- T1140 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1203 Exploitation for Client Execution simulation — Exact active technique ID
- T1203 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1204.002 Malicious File simulation — Exact active technique ID
- T1204.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1221 Template Injection simulation — Exact active technique ID
- T1221 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1505.003 Web Shell simulation — Exact active technique ID
- T1505.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1518 Software Discovery simulation — Exact active technique ID
- T1518 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1518.001 Security Software Discovery simulation — Exact active technique ID
- T1518.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1543.003 Windows Service simulation — Exact active technique ID
- T1543.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1547.001 Registry Run Keys / Startup Folder simulation — Exact active technique ID
- T1547.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1547.004 Winlogon Helper DLL simulation — Exact active technique ID
- T1547.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1564.001 Hidden Files and Directories simulation — Exact active technique ID
- T1564.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1566.001 Spearphishing Attachment simulation — Exact active technique ID
- T1566.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1573 Encrypted Channel simulation — Exact active technique ID
- T1573 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1573.002 Asymmetric Cryptography simulation — Exact active technique ID
- T1573.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1574.001 DLL simulation — Exact active technique ID
- T1574.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1680 Local Storage Discovery simulation — Exact active technique ID
- T1680 detection rules — Exact active technique ID; not actor-specific detector coverage
Cyber Knowledge routes
These contextual routes explain behaviors associated with this ATT&CK group record. They support learning and investigation planning; they do not add attribution evidence.
Exploitability validation and laboratory exploit engineering
Vulnerability Research & Exploit Development · explicit-idModule 4 — Collection Sources
Cyber Threat Intelligence (CTI) · explicit-nameModule 10 — Cloud, containers, Kubernetes, and SaaS defense
Blue Team & Defensive Security · topic-matchModule 1 — Mission, authorization, and methodology
Red Team & Offensive Security · topic-matchModule 6 — Alert triage, investigation, and escalation
Blue Team & Defensive Security · topic-matchPublic code, packages, cloud artifacts, documents, and exposed secrets
OSINT & Reconnaissance · topic-matchAI-assisted analysis, RAG/MCP controls, and defensive handoff
Malware Analysis & Reverse Engineering · topic-matchPrompt injection, instruction hierarchy, and secure output handling
AI Security · topic-matchModule 3 — Vulnerability discovery and validation
Red Team & Offensive Security · topic-matchMobile and Android vulnerability research
Vulnerability Research & Exploit Development · topic-matchHuman, workload, pipeline, and emergency identity
Cloud Security · topic-matchSecure AI development lifecycle and production release gate
AI Security · topic-match
Vulnerability Research & Exploit Development · explicit-idModule 4 — Collection Sources
Cyber Threat Intelligence (CTI) · explicit-nameModule 10 — Cloud, containers, Kubernetes, and SaaS defense
Blue Team & Defensive Security · topic-matchModule 1 — Mission, authorization, and methodology
Red Team & Offensive Security · topic-matchModule 6 — Alert triage, investigation, and escalation
Blue Team & Defensive Security · topic-matchPublic code, packages, cloud artifacts, documents, and exposed secrets
OSINT & Reconnaissance · topic-matchAI-assisted analysis, RAG/MCP controls, and defensive handoff
Malware Analysis & Reverse Engineering · topic-matchPrompt injection, instruction hierarchy, and secure output handling
AI Security · topic-matchModule 3 — Vulnerability discovery and validation
Red Team & Offensive Security · topic-matchMobile and Android vulnerability research
Vulnerability Research & Exploit Development · topic-matchHuman, workload, pipeline, and emergency identity
Cloud Security · topic-matchSecure AI development lifecycle and production release gate
AI Security · topic-match