Tropic Trooper
KeyBoy is an alias of Tropic Trooper, also referred to as Pirate Panda. The content describes Tropic Trooper as a threat actor that has used spearphishing emails with malicious Microsoft Office and fake installer attachments to lure victims into executing malware. Observed tradecraft includes use of Windows command scripts, deletion of dropper files on infected systems using command scripts, creation of shortcuts in the Startup folder for persistence, use of HTTP and SSL for command-and-control communications, base64 encoding to hide command strings delivered from C2, encrypted configuration files, hiding payloads in Flash directories and fake installer files, detection of the target system’s OS version, enumeration of running processes using pslist, and use of pr together with an openly available tool to scan for open ports on target systems.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
53 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
22 malware families attributed to this actor across reporting.
17 additional families tracked in Mallory.
Associated vulnerabilities
4 CVEs this actor has used in observed campaigns. 4 of them exploited in the wild.
...has exploited client software vulnerabilities for execution, such as Microsoft Word CVE-2012-0158...
...has exploited Office vulnerabilities such as CVE-2017-11882...
...has exploited Microsoft Office vulnerabilities... CVE-2018-0802.
This detection identifies instances where Windows Explorer.exe spawns PowerShell or cmd.exe processes, particularly focusing on executions initiated by LNK files. This behavior is associated with the ZDI-CAN-25373 Windows shortcut zero-day vulnerability, where specially crafted LNK files are used to trigger malicious code execution through cmd.exe or powershell.exe. This technique has been actively exploited by multiple APT groups in targeted attacks through both HTTP and SMB delivery methods.
Observables
49 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Conducting a sophisticated campaign targeting Chinese-speaking individuals using a trojanized SumatraPDF reader, deploying AdaptixC2 Beacon, abusing GitHub for command-and-control, and leveraging Microsoft Visual Studio Code tunnels for remote access.
Referenced by name in the title, suggesting discussion of Tropic Trooper activity, likely related to a supply chain intrusion or investigation.
Conducting a campaign targeting Chinese-speaking individuals using a trojanized SumatraPDF reader to deploy AdaptixC2 Beacon and abuse VS Code tunnels for remote access.
Cyberespionage activity targeting specific individuals and organizations, with expanding operations in Japan, Taiwan, and South Korea, including compromise of home routers, DNS hijacking, supply-chain style malware delivery, and use of both custom and open-source tooling.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.