Threat group.View on attack.mitre.org
Tropic Trooper is an unaffiliated threat group that has led targeted campaigns against targets in Taiwan, the Philippines, and Hong Kong. Tropic Trooper focuses on targeting government, healthcare, transportation, and high-tech industries and has been active since 2011.
| Technique | Procedure example |
|---|---|
| T1016 System Network Configuration Discovery |
Tropic Trooper has used scripts to collect the host's network topology. |
| T1020 Automated Exfiltration |
Tropic Trooper has used a copy function to automatically exfiltrate sensitive data from air-gapped systems using USB storage. |
| T1027.003 Steganography |
Tropic Trooper has used JPG files with encrypted payloads to mask their backdoor routines and evade detection. |
| T1027.013 Encrypted/Encoded File |
Tropic Trooper has encrypted configuration files. |
| T1033 System Owner/User Discovery |
Tropic Trooper used |
| T1036.005 Match Legitimate Resource Name or Location |
Tropic Trooper has hidden payloads in Flash directories and fake installer files. |
| T1046 Network Service Discovery |
Tropic Trooper used |
| T1049 System Network Connections Discovery |
Tropic Trooper has tested if the localhost network is available and other connection capability on an infected system using command scripts. |
| T1052.001 Exfiltration over USB |
Tropic Trooper has exfiltrated data using USB storage devices. |
| T1055.001 Dynamic-link Library Injection |
Tropic Trooper has injected a DLL backdoor into dllhost.exe and svchost.exe. |
| T1057 Process Discovery |
Tropic Trooper is capable of enumerating the running processes on the system using |
| T1059.003 Windows Command Shell |
Tropic Trooper has used Windows command scripts. |
| T1070.004 File Deletion |
Tropic Trooper has deleted dropper files on an infected system using command scripts. |
| T1071.001 Web Protocols |
Tropic Trooper has used HTTP in communication with the C2. |
| T1071.004 DNS |
Tropic Trooper's backdoor has communicated to the C2 over the DNS protocol. |
None recorded.
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
