A multinational technology company has been the target of several cyberattacks over the past few months. The attackers have successfully stolen sensitive intellectual property and disrupted the company’s operations. A threat advisory report about similar attacks has been shared, and as a analyst, I have to identify the tactics, techniques, and procedures (TTPs) being used by the threat group and gather as much information as possible about their identity and motive.

Once in the application, we looked up the APT X report. While the interface is heavily packed, it’s intuitive and provides a great overview of multiples things.

c

Basics informations

So we starting the knowledge graph view of the target we can see multiple entries here:

  • APT X is targeting several sectors like defense, high-tech, research, banking institutions, government, etc. They are pretty active across these main fields and focus heavily on two primary countries, Taiwan and the Philippines.

  • Focusing on techniques, we see that the main way they achieve initial access is through spearphishing with attachments, meaning they target specific individuals rather than launching random, hazardous campaigns.

c

A malware is sent attached to an email. Cf. MITRE ATT&CK T1566.001

We can now focus on the type of malware being used. Once again, the graph view gives us the answer directly with USBferry, an information-stealing malware famously used by the Tropic Trooper threat group in targeted attacks against air-gapped environments, specifically in Taiwan and the Philippines.

This malware is specifically designed to bypass network isolation by leveraging removable USB drives to exfiltrate sensitive data from secure systems.

Cf. USBFerry

We also note the STIX ID which serves as a unique identifier for every object (such as a threat actor, malware, or indicator of compromise) within the STIX threat-sharing standard. It allows security tools to precisely link, track, and reference a threat without ambiguity.

c

Identification

c

With everything we found until now, we can assume APT X is in reality Tropic Trooper (also known as KeyBoy). They are a cyberespionage threat group (operating out of East Asia) known for targeting government, military, healthcare, and high-tech industries, with a heavy emphasis on Taiwan and the Philippines. They frequently target air-gapped environments and use custom tools like USBferry to steal data. This is the same data we found in openCTI.

We have some kind of pivot and can learn multiple new things from here. In the knowledge base of Tropic Trooper, we identify 40 attack patterns associated with them.

c

We can also highlight specific vulnerabilities they use, such as the Microsoft Exchange remote code execution vulnerability CVE-2021-34473, which allows them to execute code remotely on target servers. This is very interesting knowing which CVE, tools, etc APTs use, to protect against them.

They also have a command tool associated with them, which is BITSAdmin. BITSAdmin is a command-line tool used to create and manage BITS jobs. Windows Background Intelligent Transfer Service (BITS) is accessible via PowerShell, and is typically used by updates, messengers, and background apps to download or upload files.

c

PoisonIvy is a popular remote access tool (RAT) that has been used by many threat groups. It’s also a tool used by tropic trooper PoisonIvy

c

By filtering on associated attack patterns, we can identify some interesting things, like the registry key used by Tropic Trooper to establish persistence on target systems: HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell. We also notice the file format they use to mask their backdoor activities, which is JPG.

c

Conclusion

Updating our timeline with recent intelligence, security analysis from providers like Broadcom and Zscaler shows that Tropic Trooper (also tracked as Earth Centaur or KeyBoy) has continued to evolve. Recent campaigns highlight a shift toward modern tooling, such as leveraging deceptive ZIP archives disguised as official military documents. These packages often utilize trojanized binaries (like a modified SumatraPDF reader) running a loader variant to drop and execute an AdaptixC2 Beacon, utilizing platforms like GitHub for command-and-control communication instead of relying solely on older legacy utilities.

It’s important to follow the path that APTs use, their new names and the new IOCs they provide to ensure a good protection, I that way, I plan to dig further CTI field.