Tropic Trooper Uses AdaptixC2 and GitHub C2 to Establish VS Code Tunnel Access
Summary
ThreatLabz attributes a campaign targeting Chinese-speaking people in Taiwan, South Korea, and Japan to Tropic Trooper. A trojanized SumatraPDF delivered AdaptixC2 through a custom GitHub listener, with VS Code tunnels used for remote access.
Key points
- A malicious ZIP used military-themed document lures, including a trojanized SumatraPDF executable.
- The TOSHIS loader displayed a decoy PDF while downloading and executing an AdaptixC2 Beacon in memory.
- The custom AdaptixC2 listener used GitHub issues and repository files for command-and-control; beacons were rapidly deleted, likely to hinder analysis.
- The actor used the initial foothold for reconnaissance and deployed VS Code tunnels for remote access to selected machines.
- ThreatLabz linked the activity to Tropic Trooper with high confidence based on the TOSHIS loader and overlapping tactics.
- The staging server also hosted EntryShell and Cobalt Strike Beacon, which the article associates with Tropic Trooper.
Article Details
- Attack Vectors
- A malicious ZIP archive used military-themed document lures; a trojanized SumatraPDF executable downloaded and displayed a decoy PDF while downloading and executing an AdaptixC2 Beacon agent in memory.
- The TOSHIS loader retrieved payloads from a staging server, decrypted shellcode with AES-128 CBC, and executed it in memory.
- The AdaptixC2 agent used a custom GitHub-based listener for command and control, retrieving tasks and uploading responses through repository issues and files.
- After reconnaissance, the actor deployed VS Code tunnels for remote access. Reported activity also included scheduled-task creation and downloads from bashupload[.]app.
- Defensive Notes
- Monitor for trojanized SumatraPDF binaries and TOSHIS loader behavior, including downloads of decoy PDFs and in-memory shellcode execution.
- Monitor GitHub repository issue and contents API activity consistent with beacon tasking and file uploads, including rapid deletion of beacon artifacts.
- Monitor unauthorized VS Code tunnel logins and unexpected scheduled tasks, including tasks running from public documents directories.
- ThreatLabz reports Zscaler detections for TOSHIS, AdaptixC2, EntryShell, and Cobalt Strike.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 158[.]247[.]193[.]100 | Staging server reported to host the EntryShell backdoor and Cobalt Strike Beacon. |
| IPV4 | 58[.]247[.]193[.]100 | Staging server used by TOSHIS loader to deliver the decoy PDF and second-stage shellcode. |
| MD5 | 2d7cc3646c287d6355def362916c6d26 | Hash listed for an encrypted Cobalt Strike Beacon loader. |
| MD5 | 3238d2f6b9ea9825eb61ae5e80e7365c | Hash listed for the malicious ZIP archive containing lures and trojanized SumatraPDF. |
| MD5 | 67fcf5c21474d314aa0b27b0ce8befb2 | Hash listed for the trojanized SumatraPDF executable. |
| MD5 | 709e28b6b57fbc1ed7308f7bc8d6cca6 | Hash listed for the decrypted AdaptixC2 Beacon agent DLL. |
| MD5 | 71fa755b6ba012e1713c9101c7329f8d | Hash listed for an encrypted Cobalt Strike Beacon loader. |
| MD5 | 89daa54fada8798c5f4e21738c8ea0b4 | Hash listed for encrypted reflective loader shellcode and the AdaptixC2 Beacon agent. |
| MD5 | 9a69b717ec4e8a35ae595aa6762d3c27 | Hash listed for a decrypted Cobalt Strike Beacon loader. |
| MD5 | c620b4671a5715eec0e9f3b93e6532ba | Hash listed for a decrypted Cobalt Strike Beacon loader. |
| SHA1 | 19e3c4df728e3e657cb9496cd4aaf69648470b63 | Hash listed for the trojanized SumatraPDF executable. |
| SHA1 | 2c65433696037f4ce0f8c9a1d78bdd6835c1b94d | Hash listed for the malicious ZIP archive containing lures and trojanized SumatraPDF. |
| SHA1 | 343be0f2077901ea5b5b9fb97d97892ac1a907e6 | Hash listed for a decrypted Cobalt Strike Beacon loader. |
| SHA1 | 401cc16d79d94c32da3f66df21d66ffd71603c14 | Hash listed for a decrypted Cobalt Strike Beacon loader. |
| SHA1 | 77e1e4ff1f8ec0462389bc3faaed723cd38399e7 | Hash listed for the decrypted AdaptixC2 Beacon agent DLL. |
| SHA1 | adb47733c224fc8c0f7edc61becb578e560435ab | Hash listed for an encrypted Cobalt Strike Beacon loader. |
| SHA1 | bd618c9e1e10891fe666839650fa406833d70afd | Hash listed for encrypted reflective loader shellcode and the AdaptixC2 Beacon agent. |
| SHA1 | c2051635ccfdc0b48c260e7ceeee3f96bf026fea | Hash listed for an encrypted Cobalt Strike Beacon loader. |
| SHA256 | 3936f522f187f8f67dda3dc88abfd170f6ba873af81fc31bbf1fdbcad1b2a7fb | Hash listed for an encrypted Cobalt Strike Beacon loader. |
| SHA256 | 3c29c72a59133dd9eb23953211129fd8275a11b91a3b8dddb3c6e502b6b63edb | Hash listed for a decrypted Cobalt Strike Beacon loader. |
| SHA256 | 47c7ce0e3816647b23bb180725c7233e505f61c35e7776d47fd448009e887857 | Hash listed for the trojanized SumatraPDF executable. |
| SHA256 | 6eaea92394e115cd6d5bab9ae1c6d088806229aae320e6c519c2d2210dbc94fe | Hash listed for an encrypted Cobalt Strike Beacon loader. |
| SHA256 | 9795091eaa322d07c2e86ed856f1c81e784f89baeccaa521067e7ab6325b745d | Hash listed for the decrypted AdaptixC2 Beacon agent DLL. |
| SHA256 | a4f2131eb497afe5f78d8d6e534df2b8d75c5b9b565c3ec17a323afe5355da26 | Hash listed for the malicious ZIP archive containing lures and trojanized SumatraPDF. |
| SHA256 | aeec65bac035789073b567753284b64ce0b95bbae62cf79e1479714238af0eb7 | Hash listed for encrypted reflective loader shellcode and the AdaptixC2 Beacon agent. |
| SHA256 | b92a3a1cf5786b6e08643483387b77640cd44f84df1169dd00efde7af46b5714 | Hash listed for a decrypted Cobalt Strike Beacon loader. |
| URL | hxxp[:]//bashupload[.]app/6e1lhc | URL observed in commands issued by the threat actor to download a file. |
| URL | hxxp[:]//bashupload[.]app/zgel2a[.]bin | URL observed in commands issued by the threat actor to download a file. |
| URL | hxxps[:]//47[.]76[.]236[.]58:4430/Divide/developement/GIZWQVCLF | Threat-research network indicator URL associated with the campaign. |
| URL | hxxps[:]//47[.]76[.]236[.]58:4430/Originate/contacts/CX4YJ5JI7RZ | Threat-research network indicator URL associated with the campaign. |
| URL | hxxps[:]//api[.]github[.]com/repos/cvaS23uchsahs/rss/issues | Specific GitHub repository issues URL used by the AdaptixC2 agent for command-and-control tasking. |
| URL | hxxps[:]//stg[.]lsmartv[.]com:8443/Divide/developement/GIZWQVCLF | Threat-research network indicator URL associated with the campaign. |
| URL | hxxps[:]//stg[.]lsmartv[.]com:8443/Originate/contacts/CX4YJ5JI7RZ | Threat-research network indicator URL associated with the campaign. |
MITRE ATT&CK
T1016 · System Network Configuration DiscoveryThe agent queries ipinfo.io and ip.me to obtain external IP information; observed reconnaissance also includes arp /a.T1021.006 · Windows Remote ManagementThe actor used VS Code tunnels for remote access to selected victim machines.T1041 · Exfiltration Over C2 ChannelThe agent exfiltrates files by uploading response data to the GitHub repository.T1053.005 · Scheduled TaskThe actor created recurring scheduled tasks using schtasks.T1059.003 · Windows Command ShellObserved commands use Windows command-shell syntax, including curl, schtasks, and tasklist.T1071.001 · Web ProtocolsThe AdaptixC2 agent communicates with its listener using HTTP requests to GitHub API endpoints.T1102.002 · Bidirectional CommunicationThe custom listener uses GitHub issues and repository contents as a command-and-control channel.T1105 · Ingress Tool TransferThe loader downloads a decoy PDF and second-stage shellcode from the staging server.T1204.002 · Malicious FileThe victim is induced to execute a trojanized SumatraPDF executable presented as a document lure.T1574.002 · DLL Side-LoadingThe trojanized SumatraPDF binary redirects _security_init_cookie to execute malicious loader code.T1620 · Reflective Code LoadingThe decrypted AdaptixC2 shellcode is executed directly in memory.
Threat Actors
Earth CentaurThe article identifies Earth Centaur as an alternate name for Tropic Trooper, to which ThreatLabz attributes the campaign with high confidence.Pirate PandaThe article identifies Pirate Panda as an alternate name for Tropic Trooper, to which ThreatLabz attributes the campaign with high confidence.Tropic TrooperThreatLabz attributes the campaign to Tropic Trooper with high confidence; the article also identifies Earth Centaur and Pirate Panda as alternate names.
Malware
AdaptixC2 Beacona campaign leveraging a multi-stage attack chain where a trojanized SumatraPDF reader deploys an AdaptixC2 Beacon agent, ultimately leading to the download and abuse of Visual Studio (VS) Code tunnels for remoteCobalt Strike BeaconBeacon agent. This marks a departure from earlier TOSHIS versions, which delivered either a Cobalt Strike Beacon or a Merlin Mythic agentEntryShellThe staging server involved in this attack also hosted CobaltStrike Beacon and an EntryShell backdoor. Both malware types and configurations are known to have been used by Tropic Trooper.Merlin Mythic agentmarks a departure from earlier TOSHIS versions, which delivered either a Cobalt Strike Beacon or a Merlin Mythic agentTOSHISThe shellcode loader used in this attack closely resembles the TOSHIS loader, which has been associated with Tropic Trooper and was previously reported in the TAOTH campaign.
Vendors
Products
SumatraPDFanalysis of this sample uncovered a campaign leveraging a multi-stage attack chain where a trojanized SumatraPDF reader deploys an AdaptixC2 Beacon agent, ultimately leading to the download and abuse of Visual StudioVS CodeThe campaign used a trojanized SumatraPDF binary to deploy an AdaptixC2 Beacon and ultimately VS Code on targeted machines.
Tools
AdaptixC2a campaign leveraging a multi-stage attack chain where a trojanized SumatraPDF reader deploys an AdaptixC2 Beacon agent, ultimately leading to the download and abuse of Visual Studio (VS) Code tunnels for remoteShellExecuteWSubsequently, TOSHIS loader downloads the PDF decoy from 58.247.193[.]100 and opens it using ShellExecuteW. TOSHIS loader then retrieves a second-stage shellcode from the same IP address, decrypts it usingWinCryptthen retrieves a second-stage shellcode from the same IP address, decrypts it using AES-128 CBC with WinCrypt cryptographic functions, and executes the shellcode directly in-memory. This shellcode is an AdaptixC2
Countries
Japanthreat actor likely targeted Chinese-speaking individuals in Taiwan, and individuals in South Korea and Japan. Based on the tactics, techniques, and procedures (TTPs) observed in this attack, ThreatLabz attributesSouth Koreathat the threat actor likely targeted Chinese-speaking individuals in Taiwan, and individuals in South Korea and Japan. Based on the tactics, techniques, and procedures (TTPs) observed in this attack, ThreatLabzTaiwanDuring our analysis, we observed that the threat actor likely targeted Chinese-speaking individuals in Taiwan, and individuals in South Korea and Japan. Based on the tactics, techniques, and procedures (TTPs)