Research Details Tropic Trooper’s Router DNS Hijacking and Expanded Targeting
Summary
Researchers report Tropic Trooper campaigns used compromised home routers to hijack DNS and deliver trojanized updates, while targeting individuals in Japan, Taiwan, and South Korea with new malware, phishing decoys, and other lures.
Key points
- Itochu researchers traced a repeat infection to a victim’s compromised home router, where altered DNS settings redirected a software update to an attacker-controlled server.
- The investigated infection chain involved a trojanized dictionary-app update and delivered a Cobalt Strike beacon with watermark 520.
- Researchers found an exposed Amazon S3 bucket containing 48 files, including encrypted payloads and phishing pages mimicking Signal and other apps.
- Payload analysis identified DaveShell and Donut loaders, Merlin and Apollo Go-based RATs, and the custom Go backdoor C6DOOR.
- The group was also reported to use EntryShell, Xiangoop loader variants, and watermarked Cobalt Strike, with researchers noting a shift toward open-source tools.
- Zscaler researchers reported a separate campaign using military-themed lures and a trojanized SumatraPDF binary to deploy an AdaptixC2 beacon and ultimately VS Code.
Article Details
- Attack Vectors
- A compromised target home router had its DNS settings overwritten to redirect a software update request to an attacker server.
- A trojanized update for a dictionary application delivered a Cobalt Strike beacon through a small XML file in the update.
- A malicious ZIP archive containing military-themed document lures was used in activity targeting Chinese-speaking individuals in Japan and South Korea.
- A trojanized SumatraPDF binary was used to deploy an AdaptixC2 Beacon and then VS Code.
- An exposed Amazon S3 bucket contained phishing pages mimicking authentication pages for Signal and other apps, along with decoy files.
MITRE ATT&CK
People
Threat Actors
Earth CentaurThe article identifies Earth Centaur as an alternate name for Tropic Trooper, which it attributes with the reported intrusion activity.Pirate PandaThe article identifies Pirate Panda as an alternate name for Tropic Trooper, which it attributes with the reported intrusion activity.Tropic TrooperThe article attributes the reported router-based DNS hijacking, trojanized software updates, and malware activity to this China-linked APT.
Malware
Apollo AgentNew observed tooling includes DaveShell, Donut loader, Merlin Agent, Apollo Agent, C6DOOR, and a watermarked Cobalt Strike beacon.C6DOORCobalt Strike beacon, loaders such as DaveShell and Donut, Go-based RATs Merlin and Apollo, and the C6DOOR backdoor—alongside exposed Amazon S3 data and tailored phishing decoys.DaveShelland custom tools in its arsenal—including a watermarked Cobalt Strike beacon, loaders such as DaveShell and Donut, Go-based RATs Merlin and Apollo, and the C6DOOR backdoor—alongside exposed Amazon S3 data andDonutcustom tools in its arsenal—including a watermarked Cobalt Strike beacon, loaders such as DaveShell and Donut, Go-based RATs Merlin and Apollo, and the C6DOOR backdoor—alongside exposed Amazon S3 data and tailoredEntryShellIn addition, Tropic Trooper is still using its older, known tools, including the EntryShell backdoor, heavily obfuscated Xiangoop loader variants [PDF] (a distinctive, custom malware family), and the aforementionedMerlin AgentNew observed tooling includes DaveShell, Donut loader, Merlin Agent, Apollo Agent, C6DOOR, and a watermarked Cobalt Strike beacon.XiangoopTrooper is still using its older, known tools, including the EntryShell backdoor, heavily obfuscated Xiangoop loader variants [PDF] (a distinctive, custom malware family), and the aforementioned watermarked Cobalt
Products
Amazon S3such as DaveShell and Donut, Go-based RATs Merlin and Apollo, and the C6DOOR backdoor—alongside exposed Amazon S3 data and tailored phishing decoys.SignalResearchers discovered an exposed Amazon S3 bucket containing phishing pages and decoy files mimicking apps like Signal.SumatraPDFThe campaign that ThreatLabz researchers observed used a trojanized SumatraPDF binary to deploy an AdaptixC2 Beacon and ultimately VS Code on targeted machines.VS CodeThe campaign that ThreatLabz researchers observed used a trojanized SumatraPDF binary to deploy an AdaptixC2 Beacon and ultimately VS Code on targeted machines.
Tools
AdaptixC2The campaign that ThreatLabz researchers observed used a trojanized SumatraPDF binary to deploy an AdaptixC2 Beacon and ultimately VS Code on targeted machines.Cobalt StrikeResearchers uncovered new open-source and custom tools in its arsenal—including a watermarked Cobalt Strike beacon, loaders such as DaveShell and Donut, Go-based RATs Merlin and Apollo, and the C6DOOR backdoor—alongside
Countries
ChinaTropic Trooper, a China-linked APT, is changing its TTPs and expanding targets to individuals in Japan, Taiwan, and South Korea by using unconventional vectors like home WiâFi DNS hijacks and trojanized softwareHong Kongmilitary, healthcare, transportation, and highâtech organizations in Taiwan, the Philippines, and Hong Kong, with researchers recently also finding one singular campaign in the Mideast.JapanTropic Trooper, a China-linked APT, is changing its TTPs and expanding targets to individuals in Japan, Taiwan, and South Korea by using unconventional vectors like home WiâFi DNS hijacks and trojanized softwarePhilippineson government, military, healthcare, transportation, and highâtech organizations in Taiwan, the Philippines, and Hong Kong, with researchers recently also finding one singular campaign in the Mideast.South Koreaa China-linked APT, is changing its TTPs and expanding targets to individuals in Japan, Taiwan, and South Korea by using unconventional vectors like home WiâFi DNS hijacks and trojanized software updates.TaiwanTropic Trooper, a China-linked APT, is changing its TTPs and expanding targets to individuals in Japan, Taiwan, and South Korea by using unconventional vectors like home WiâFi DNS hijacks and trojanized software
Industries
GovernmentThe group historically spies on government, military, healthcare, transportation, and highâtech organizations in Taiwan, the Philippines, and Hong Kong, with researchers recently also finding one singular campaign inHealthcareThe group historically spies on government, military, healthcare, transportation, and highâtech organizations in Taiwan, the Philippines, and Hong Kong, with researchers recently also finding one singular campaign inMilitaryThe group historically spies on government, military, healthcare, transportation, and highâtech organizations in Taiwan, the Philippines, and Hong Kong, with researchers recently also finding one singular campaign inTransportationThe group historically spies on government, military, healthcare, transportation, and highâtech organizations in Taiwan, the Philippines, and Hong Kong, with researchers recently also finding one singular campaign in