Cервис управления информационной безопасностью
Cервис управления информационной безопасностью
Поиск
Вход Регистрация
MITRE ATT&CK - Преступная группа Tropic Trooper
Риски
Каталоги
MITRE ATT&CK
Преступная группа
Tropic Trooper
Куда я попал?
SECURITM это SGRC система, ? автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.
Подробнее
Наш канал

Tropic Trooper

Tropic Trooper is an unaffiliated threat group that has led targeted campaigns against targets in Taiwan, the Philippines, and Hong Kong. Tropic Trooper focuses on targeting government, healthcare, transportation, and high-tech industries and has been active since 2011.(Citation: TrendMicro Tropic Trooper Mar 2018)(Citation: Unit 42 Tropic Trooper Nov 2016)(Citation: TrendMicro Tropic Trooper May 2020)
ID: G0081
Associated Groups: Pirate Panda, KeyBoy
Version: 1.5
Created: 29 Jan 2019
Last Modified: 18 Apr 2024

Associated Group Descriptions
Name Description
Pirate Panda (Citation: Crowdstrike Pirate Panda April 2020)
KeyBoy (Citation: Unit 42 Tropic Trooper Nov 2016)(Citation: TrendMicro Tropic Trooper Mar 2018)

Techniques Used
Domain ID Name Use
Enterprise T1071 .001 Application Layer Protocol: Web Protocols

Tropic Trooper has used HTTP in communication with the C2.(Citation: Anomali Pirate Panda April 2020)(Citation: TrendMicro Tropic Trooper May 2020)
.004 Application Layer Protocol: DNS

Tropic Trooper's backdoor has communicated to the C2 over the DNS protocol.(Citation: TrendMicro Tropic Trooper May 2020)

Enterprise T1547 .001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Tropic Trooper has created shortcuts in the Startup folder to establish persistence.(Citation: Anomali Pirate Panda April 2020)(Citation: TrendMicro Tropic Trooper May 2020)
.004 Boot or Logon Autostart Execution: Winlogon Helper DLL

Tropic Trooper has created the Registry key HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell and sets the value to establish persistence.(Citation: Unit 42 Tropic Trooper Nov 2016)(Citation: TrendMicro Tropic Trooper May 2020)

Enterprise T1059 .003 Command and Scripting Interpreter: Windows Command Shell

Tropic Trooper has used Windows command scripts.(Citation: TrendMicro Tropic Trooper May 2020)

Enterprise T1543 .003 Create or Modify System Process: Windows Service

Tropic Trooper has installed a service pointing to a malicious DLL dropped to disk.(Citation: PWC KeyBoys Feb 2017)
Enterprise T1132 .001 Data Encoding: Standard Encoding

Tropic Trooper has used base64 encoding to hide command strings delivered from the C2.(Citation: TrendMicro Tropic Trooper May 2020)
Enterprise T1573 .002 Encrypted Channel: Asymmetric Cryptography

Tropic Trooper has used SSL to connect to C2 servers.(Citation: TrendMicro Tropic Trooper Mar 2018)(Citation: TrendMicro Tropic Trooper May 2020)
Enterprise T1052 .001 Exfiltration Over Physical Medium: Exfiltration over USB

Tropic Trooper has exfiltrated data using USB storage devices.(Citation: TrendMicro Tropic Trooper May 2020)

Enterprise T1564 .001 Hide Artifacts: Hidden Files and Directories

Tropic Trooper has created a hidden directory under C:\ProgramData\Apple\Updates\ and C:\Users\Public\Documents\Flash\.(Citation: TrendMicro Tropic Trooper Mar 2018)(Citation: TrendMicro Tropic Trooper May 2020)
Enterprise T1574 .001 Hijack Execution Flow: DLL

Tropic Trooper has been known to side-load DLLs using a valid version of a Windows Address Book and Windows Defender executable with one of their tools.(Citation: CitizenLab KeyBoy Nov 2016)(Citation: Anomali Pirate Panda April 2020)
Enterprise T1070 .004 Indicator Removal: File Deletion

Tropic Trooper has deleted dropper files on an infected system using command scripts.(Citation: TrendMicro Tropic Trooper May 2020)

Enterprise T1036 .005 Masquerading: Match Legitimate Resource Name or Location

Tropic Trooper has hidden payloads in Flash directories and fake installer files.(Citation: TrendMicro Tropic Trooper May 2020)
Enterprise T1027 .003 Obfuscated Files or Information: Steganography

Tropic Trooper has used JPG files with encrypted payloads to mask their backdoor routines and evade detection.(Citation: TrendMicro Tropic Trooper May 2020)
.013 Obfuscated Files or Information: Encrypted/Encoded File

Tropic Trooper has encrypted configuration files.(Citation: TrendMicro Tropic Trooper Mar 2018)(Citation: TrendMicro Tropic Trooper May 2020)

Enterprise T1566 .001 Phishing: Spearphishing Attachment

Tropic Trooper sent spearphishing emails that contained malicious Microsoft Office and fake installer file attachments.(Citation: Unit 42 Tropic Trooper Nov 2016)(Citation: TrendMicro TropicTrooper 2015)(Citation: CitizenLab Tropic Trooper Aug 2018)(Citation: Anomali Pirate Panda April 2020)(Citation: TrendMicro Tropic Trooper May 2020)
Enterprise T1055 .001 Process Injection: Dynamic-link Library Injection

Tropic Trooper has injected a DLL backdoor into dllhost.exe and svchost.exe.(Citation: TrendMicro Tropic Trooper Mar 2018)(Citation: TrendMicro Tropic Trooper May 2020)
Enterprise T1505 .003 Server Software Component: Web Shell

Tropic Trooper has started a web service in the target host and wait for the adversary to connect, acting as a web shell.(Citation: TrendMicro Tropic Trooper May 2020)

Enterprise T1518 .001 Software Discovery: Security Software Discovery

Tropic Trooper can search for anti-virus software running on the system.(Citation: Unit 42 Tropic Trooper Nov 2016)
Enterprise T1204 .002 User Execution: Malicious File

Tropic Trooper has lured victims into executing malware via malicious e-mail attachments.(Citation: Anomali Pirate Panda April 2020)
Enterprise T1078 .003 Valid Accounts: Local Accounts

Tropic Trooper has used known administrator account credentials to execute the backdoor directly.(Citation: TrendMicro Tropic Trooper May 2020)

Software
ID Name References Techniques
S0387 KeyBoy (Citation: CitizenLab KeyBoy Nov 2016) (Citation: CitizenLab Tropic Trooper Aug 2018) (Citation: PWC KeyBoys Feb 2017) (Citation: Rapid7 KeyBoy Jun 2013) (Citation: Unit 42 Tropic Trooper Nov 2016) Screen Capture, Keylogging, Encrypted/Encoded File, Dynamic Data Exchange, Windows Service, System Information Discovery, Timestomp, Credentials from Web Browsers, Winlogon Helper DLL, System Network Configuration Discovery, File and Directory Discovery, PowerShell, Protocol or Service Impersonation, Hidden Window, Python, Windows Command Shell, Visual Basic, Ingress Tool Transfer, Commonly Used Port
S0190 BITSAdmin (Citation: Microsoft BITSAdmin) (Citation: TrendMicro Tropic Trooper Mar 2018) Lateral Tool Transfer, BITS Jobs, Ingress Tool Transfer, Exfiltration Over Unencrypted Non-C2 Protocol
S0452 USBferry (Citation: TrendMicro Tropic Trooper May 2020) Rundll32, Local Account, Peripheral Device Discovery, Replication Through Removable Media, Data from Local System, System Network Configuration Discovery, File and Directory Discovery, System Network Connections Discovery, Process Discovery, Windows Command Shell, Remote System Discovery
S0012 PoisonIvy (Citation: Breut) (Citation: Darkmoon) (Citation: FireEye Poison Ivy) (Citation: Novetta-Axiom) (Citation: Poison Ivy) (Citation: Symantec Darkmoon Aug 2005) (Citation: Symantec Darkmoon Sept 2014) (Citation: Symantec Elderwood Sept 2012) (Citation: Unit 42 Tropic Trooper Nov 2016) Keylogging, Rootkit, Local Data Staging, Active Setup, Symmetric Cryptography, Windows Service, Data from Local System, Mutual Exclusion, Application Window Discovery, Modify Registry, Registry Run Keys / Startup Folder, Obfuscated Files or Information, Uncommonly Used Port, Windows Command Shell, Ingress Tool Transfer, Dynamic-link Library Injection
S0388 YAHOYAH (Citation: TrendMicro TropicTrooper 2015) Encrypted/Encoded File, System Information Discovery, Deobfuscate/Decode Files or Information, Security Software Discovery, Web Protocols, Ingress Tool Transfer
S0596 ShadowPad (Citation: FireEye APT41 Aug 2019) (Citation: Kaspersky ShadowPad Aug 2017) (Citation: POISONPLUG.SHADOW) (Citation: Recorded Future RedEcho Feb 2021) (Citation: Securelist ShadowPad Aug 2017) Fileless Storage, System Owner/User Discovery, Domain Generation Algorithms, DNS, System Information Discovery, Deobfuscate/Decode Files or Information, Process Injection, Scheduled Transfer, Modify Registry, System Network Configuration Discovery, Indicator Removal, Process Discovery, File Transfer Protocols, Obfuscated Files or Information, Non-Application Layer Protocol, Non-Standard Encoding, Web Protocols, Ingress Tool Transfer, System Time Discovery, Dynamic-link Library Injection

References

  1. Horejsi, J., et al. (2018, March 14). Tropic Trooper’s New Strategy. Retrieved November 9, 2018.
  2. Chen, J.. (2020, May 12). Tropic Trooper’s Back: USBferry Attack Targets Air gapped Environments. Retrieved May 20, 2020.
  3. Alintanahin, K. (2015). Operation Tropic Trooper: Relying on Tried-and-Tested Flaws to Infiltrate Secret Keepers. Retrieved June 14, 2019.
  4. Busselen, M. (2020, April 7). On-demand Webcast: CrowdStrike Experts on COVID-19 Cybersecurity Challenges and Recommendations. Retrieved May 20, 2020.
  5. Ray, V. (2016, November 22). Tropic Trooper Targets Taiwanese Government and Fossil Fuel Provider With Poison Ivy. Retrieved November 9, 2018.
  6. Moore, S. et al. (2020, April 30). Anomali Suspects that China-Backed APT Pirate Panda May Be Seeking Access to Vietnam Government Data Center. Retrieved May 19, 2020.
  7. Hulcoop, A., et al. (2016, November 17). It’s Parliamentary KeyBoy and the targeting of the Tibetan Community. Retrieved June 13, 2019.
  8. Parys, B. (2017, February 11). The KeyBoys are back in town. Retrieved June 13, 2019.
  9. Alexander, G., et al. (2018, August 8). Familiar Feeling: A Malware Campaign Targeting the Tibetan Diaspora Resurfaces. Retrieved June 17, 2019.
Навигация

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.