TrendMicro Tropic Trooper May 2020

USBferry can collect information from an air-gapped host machine.

USBferry can detect the infected machine's network topology using ipconfig and arp.

Tropic Trooper has used scripts to collect the host's network topology.

USBferry can use net view to gather information about remote systems.

Tropic Trooper has used a copy function to automatically exfiltrate sensitive data from air-gapped systems using USB storage.

Tropic Trooper has used JPG files with encrypted payloads to mask their backdoor routines and evade detection.

Tropic Trooper has encrypted configuration files.

Tropic Trooper has hidden payloads in Flash directories and fake installer files.

Tropic Trooper used pr and an openly available tool to scan for open ports on target systems.

Tropic Trooper has tested if the localhost network is available and other connection capability on an infected system using command scripts.

USBferry can use netstat and nbtstat to detect active network connections.

Tropic Trooper has exfiltrated data using USB storage devices.

Tropic Trooper has injected a DLL backdoor into dllhost.exe and svchost.exe.

USBferry can use tasklist to gather information about the process running on the infected system.

Tropic Trooper is capable of enumerating the running processes on the system using pslist.

Tropic Trooper has used Windows command scripts.

USBferry can execute various Windows commands.

Tropic Trooper has deleted dropper files on an infected system using command scripts.

Tropic Trooper has used HTTP in communication with the C2.

Tropic Trooper's backdoor has communicated to the C2 over the DNS protocol.

Tropic Trooper has used known administrator account credentials to execute the backdoor directly.

Tropic Trooper has detected a target system’s OS version.

USBferry can detect the victim's file or folder list.

Tropic Trooper has monitored files' modified time.

USBferry can use net user to gather information about local accounts.

Tropic Trooper has attempted to transfer USBferry from an infected USB device by copying an Autorun function to the target machine.

USBferry can copy its installer to attached USB storage devices.

Tropic Trooper has used a delivered trojan to download additional files.

Tropic Trooper has used multiple Windows APIs including HttpInitialize, HttpCreateHttpHandle, and HttpAddUrl.

Tropic Trooper has collected information automatically using the adversary's USBferry attack.

USBferry can check for connected USB devices.

Tropic Trooper has used base64 encoding to hide command strings delivered from the C2.

Tropic Trooper used shellcode with an XOR algorithm to decrypt a payload. Tropic Trooper also decrypted image files which contained a payload.

USBferry can execute rundll32.exe in memory to avoid detection.

Tropic Trooper has started a web service in the target host and wait for the adversary to connect, acting as a web shell.

Tropic Trooper's backdoor could list the infected system's installed software.

Tropic Trooper has created shortcuts in the Startup folder to establish persistence.

Tropic Trooper has created the Registry key HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell and sets the value to establish persistence.

Tropic Trooper has created a hidden directory under C:\ProgramData\Apple\Updates\ and C:\Users\Public\Documents\Flash\.

Tropic Trooper sent spearphishing emails that contained malicious Microsoft Office and fake installer file attachments.

Tropic Trooper has encrypted traffic with the C2 to prevent network detection.

Tropic Trooper has used SSL to connect to C2 servers.

Tropic Trooper has detected a target system’s system volume information.