Tropic Trooper

Techniques (MITRE ATT&CK)40

SourceMITRE ATT&CK

Attribution confidence: 50%

Also known as:BRONZE HOBARTEarth CentaurG0081KeyBoyPIRATE PANDAPirate PandaRed Orthrus

About the group

Tropic Trooper is an unaffiliated threat group that has led targeted campaigns against targets in Taiwan, the Philippines, and Hong Kong. Tropic Trooper focuses on targeting government, healthcare, transportation, and high-tech industries and has been active since 2011.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity65

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 40

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Initial access

Spearphishing Attachment

Execution

Windows Command Shell Native API Exploitation for Client Execution Malicious File

Persistence

Web Shell Windows Service Registry Run Keys / Startup Folder Winlogon Helper DLL

Discovery

System Network Configuration Discovery System Owner/User Discovery Network Service Discovery System Network Connections Discovery Process Discovery System Information Discovery File and Directory Discovery Network Share Discovery Software Discovery Security Software Discovery Local Storage Discovery

Lateral movement

Replication Through Removable Media

Collection

Automated Collection

Command and control

Web Protocols DNS Ingress Tool Transfer Standard Encoding Encrypted Channel Asymmetric Cryptography

Exfiltration

Automated Exfiltration Exfiltration over USB

stealth

Steganography Encrypted/Encoded File Match Legitimate Resource Name or Location Dynamic-link Library Injection File Deletion Local Accounts Deobfuscate/Decode Files or Information Template Injection Hidden Files and Directories DLL

Exploited vulnerabilities 3

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2012-0158HIGHEPSS 100%KEV MITRE ATT&CK

CVE-2017-11882HIGHEPSS 100%KEV MITRE ATT&CK

CVE-2018-0802HIGHEPSS 93%KEV MITRE ATT&CK

Known infrastructure 10

Real indicators (C2, domains, URLs and hashes) associated with the malware this group uses. Source: abuse.ch (ThreatFox, URLhaus, MalwareBazaar).

ip:port43.139.9.82:12340ShadowPadthreatfox

ip:port166.88.7.116:443ShadowPadthreatfox

ip:port122.114.8.224:12340ShadowPadthreatfox

ip:port119.91.36.172:12340ShadowPadthreatfox

ip:port122.114.252.72:12340ShadowPadthreatfox

ip:port117.50.118.106:12340ShadowPadthreatfox

ip:port112.95.159.90:50012ShadowPadthreatfox

ip:port111.230.253.13:12340ShadowPadthreatfox

ip:port122.114.12.82:12340ShadowPadthreatfox

ip:port122.114.166.126:12340ShadowPadthreatfox

References

Tropic Trooper uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →