APT23Threat actor
- bronze hobart
- earth centaur
- g0081
- keyboy
- pirate panda
- red orthrus
- Tropic Trooper
TrendMicro described Tropic Trooper in a 2015 report as: 'Taiwan and the Philippines have become the targets of an ongoing campaign called Operation TropicTrooper. Active since 2012, the attackers behind the campaign haveset their sights on the Taiwanese government as well as a number of companies in the heavy industry. The same campaign has also targeted key Philippine military agencies.'From MISP Galaxy
Last reported 3 months ago, by Group-IB3 reports
ATT&CK techniques
6 of 38 · each with the sentence it comes from- T1027Obfuscated Files or Information
“… SumatraPDF loader downloaded a second-stage shellcode from the C2 IP 58.247.193.100 which reflectively loads the AdaptixC2 Beacon agent.T1027.007Defense Evasion: Obfuscated Files or Information: Dynamic API ResolutionThe initial loader identified Windows APIs by comparing Adler-…”
- T1036Masquerading
“…uled TaskThe threat actor created a scheduled task using schtasks /create to execute the AdaptixC2 agent every two hours for persistence.T1036.001Defense Evasion: Masquerading: Invalid Code SignatureThe threat actor used a trojanized SumatraPDF executable that includes the origin…”
- T1053.005Scheduled Task
“…tasklist) and to use cURL for downloading VS Code.T1053.005Persistence: Scheduled Task/Job: Scheduled TaskThe threat actor created a scheduled task using schtasks /create to execute the AdaptixC2 agent every two hours for persistence.T1036.001Defense Evasion: Masquerading: Invali…”
- T1001Data Obfuscation
“…ommand and Control: Encrypted Channel: Asymmetric CryptographyThe threat actor used the GitHub API for C2, which communicates over HTTPS.T1001.003Exfiltration: Exfiltration Over Web Service: Exfiltration to Code RepositoryThe threat actor used the GitHub API to exfiltrate files t…”
- T1014Rootkit
“For persistence, combinations of rootkits, backdoors, and loaders are used.”
- T1027.013Encrypted/Encoded File
“T1027.013”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
JadeProx: Tracing a China-nexus Operation Through an OPSEC Mistake“Recently, Tropic Trooper weaponized AdaptixC2 with a customer beacon listener.”
-
Tropic Trooper Pivots to AdaptixC2 and Custom Beacon Listener“Tropic Trooper Pivots to AdaptixC2 and Custom Beacon Listener”
-
JSAC2026 -Day 1-“…akahiro Yamamoto discussed a case involving a compromised update process of a legitimate application attributed to the threat actor “Tropic Trooper.” The investigative process leading to identification of the root cause was outlined, along with key lessons learned.”
Indicators in its reports
named in the reports above- ip[.]mein 1 report
- 43.106.71[.]28in 1 report
- hxxps://github[.]com/serjs/socks5-serverin 1 report
- hxxps://github[.]com/xmrig/xmrig-proxyin 1 report
- photo.pokok.edu[.]hkin 1 report
Copy these 5 indicators · defanged
Thanks — we review every report.