G0081 · 40 ATT&CK techniques · 0 correlated reports

Tropic Trooper

Aliases: Pirate Panda, KeyBoy

Tropic Trooper is an unaffiliated threat group that has led targeted campaigns against targets in Taiwan, the Philippines, and Hong Kong. Tropic Trooper focuses on targeting government, healthcare, transportation, and high-tech industries and has been active since 2011.

Open interactive actor investigation

ATT&CK techniques

T1543.003
Windows Service T1070.004
File Deletion T1566.001
Spearphishing Attachment T1105
Ingress Tool Transfer T1057
Process Discovery T1204.002
Malicious File T1573
Encrypted Channel T1071.001
Web Protocols T1564.001
Hidden Files and Directories T1221
Template Injection T1033
System Owner/User Discovery T1046
Network Service Discovery T1016
System Network Configuration Discovery T1052.001
Exfiltration over USB T1547.001
Registry Run Keys / Startup Folder T1505.003
Web Shell T1573.002
Asymmetric Cryptography T1059.003
Windows Command Shell T1106
Native API T1574.002
DLL Side-Loading T1083
File and Directory Discovery T1027.013
Encrypted/Encoded File T1036.005
Match Legitimate Name or Location T1132.001
Standard Encoding T1078.003
Local Accounts T1547.004
Winlogon Helper DLL T1203
Exploitation for Client Execution T1071.004
DNS T1119
Automated Collection T1055.001
Dynamic-link Library Injection T1020
Automated Exfiltration T1135
Network Share Discovery T1082
System Information Discovery T1518.001
Security Software Discovery T1140
Deobfuscate/Decode Files or Information T1049
System Network Connections Discovery T1027.003
Steganography T1518
Software Discovery T1091
Replication Through Removable Media T1197
BITS Jobs

Correlated CTI and IR reports

Continue the investigation

Interactive ThreatMapper ThreatMapper documentation CTI Analyst Field Manual Israel Threat Actors CTI Anomaly Detection Atlas ITDR Handbook 1200km Medium research