Tropic Trooper

Tropic Trooper, also known as KeyBoy and Pirate Panda, is a threat actor group that has been active since 2011. This group has been linked to various cyber attacks, primarily targeting industries in Asia such as manufacturing, semiconductors, materials and composites, technology, chemical, and medical research related to Covid-19. The group employs sophisticated techniques to execute its malicious activities, including the use of the MQTT protocol for network communication with its C2, which is notably used in Internet of Things (IoT) devices. Notably, Tropic Trooper's malware was found to use the same algorithm for encoding their configuration files as observed in the 2013 versions of KeyBoy. The cybersecurity community has detected significant overlaps between the infrastructure used by Tropic Trooper and other threat actors like TA413. Furthermore, the discovery of the China Chopper web shell led to an investigation into Tropic Trooper's activities. During this investigation, more samples written by Tropic Trooper were found, along with third-party tools used in the post-exploitation phase. A loader previously attributed to Tropic Trooper was also identified, indicating the group's continued activity and evolution of techniques. Based on the evidence gathered, there is an ongoing reassessment of the relationship between Tropic Trooper and the FamousSparrow group, which was reported by ESET in 2021. Some industry reports link the two groups together, suggesting potential collaborations or shared resources. As the threat landscape continues to evolve, understanding the connections between different threat actors will be crucial for developing effective defensive strategies.