Tropic Trooper - G0081

Created: 2019-01-29T20:17:48.717Z

Modified: 2021-04-26T14:15:15.610Z

Contributors: Edward Millington,Bart Parys

Aliases

Tropic Trooper,Pirate Panda,KeyBoy

Description

Tropic Trooper is an unaffiliated threat group that has led targeted campaigns against targets in Taiwan, the Philippines, and Hong Kong. Tropic Trooper focuses on targeting government, healthcare, transportation, and high-tech industries and has been active since 2011.(Citation: TrendMicro Tropic Trooper Mar 2018)(Citation: Unit 42 Tropic Trooper Nov 2016)(Citation: TrendMicro Tropic Trooper May 2020)

Techniques Used

Tropic Trooper has deleted dropper files on an infected system using command scripts.(Citation: TrendMicro Tropic Trooper May 2020)    |
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1049|System Network Connections Discovery|

Tropic Trooper has tested if the localhost network is available and other connection capability on an infected system using command scripts.(Citation: TrendMicro Tropic Trooper May 2020) |
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

Tropic Trooper has used Windows command scripts.(Citation: TrendMicro Tropic Trooper May 2020) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1016|System Network Configuration Discovery|

Tropic Trooper has used scripts to collect the host's network topology.(Citation: TrendMicro Tropic Trooper May 2020) |
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|

Tropic Trooper has detected a target system’s OS version and system volume information.(Citation: TrendMicro TropicTrooper 2015)(Citation: TrendMicro Tropic Trooper May 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,IaaS,SaaS|T1119|Automated Collection|