Threat Actor Profile
High APT
Description

Tropic Trooper is an unaffiliated threat group that has led targeted campaigns against targets in Taiwan, the Philippines, and Hong Kong. Tropic Trooper focuses on targeting government, healthcare, transportation, and high-tech industries and has been active since 2011.(Citation: TrendMicro Tropic Trooper Mar 2018)(Citation: Unit 42 Tropic Trooper Nov 2016)(Citation: TrendMicro Tropic Trooper May 2020)

Confidence Score
90%
Known Aliases
Tropic Trooper Pirate Panda KeyBoy
Tags
mitre-attack stix-2.1 intrusion-set
First Seen

Unknown

Last Updated

Unknown

Active Status
Active
Created

April 29, 2026

MITRE ATT&CK Techniques (40)
T1119 - Automated Collection
Collection
T1071.001 - Web Protocols
Command and Control
T1071.004 - DNS
Command and Control
T1105 - Ingress Tool Transfer
Command and Control
T1132.001 - Standard Encoding
Command and Control
T1573 - Encrypted Channel
Command and Control
T1573.002 - Asymmetric Cryptography
Command and Control
T1027.003 - Steganography
Defense Evasion
T1027.013 - Encrypted/Encoded File
Defense Evasion
T1036.005 - Match Legitimate Resource Name or Locat…
Defense Evasion
T1055.001 - Dynamic-link Library Injection
Defense Evasion
T1070.004 - File Deletion
Defense Evasion
T1078.003 - Local Accounts
Defense Evasion
T1140 - Deobfuscate/Decode Files or Information
Defense Evasion
T1221 - Template Injection
Defense Evasion
T1564.001 - Hidden Files and Directories
Defense Evasion
T1016 - System Network Configuration Discovery
Discovery
T1033 - System Owner/User Discovery
Discovery
T1046 - Network Service Discovery
Discovery
T1049 - System Network Connections Discovery
Discovery
T1057 - Process Discovery
Discovery
T1082 - System Information Discovery
Discovery
T1083 - File and Directory Discovery
Discovery
T1135 - Network Share Discovery
Discovery
T1518 - Software Discovery
Discovery
T1518.001 - Security Software Discovery
Discovery
T1680 - Local Storage Discovery
Discovery
T1059.003 - Windows Command Shell
Execution
T1106 - Native API
Execution
T1203 - Exploitation for Client Execution
Execution
T1204.002 - Malicious File
Execution
T1020 - Automated Exfiltration
Exfiltration
T1052.001 - Exfiltration over USB
Exfiltration
T1566.001 - Spearphishing Attachment
Initial Access
T1091 - Replication Through Removable Media
Lateral Movement
T1505.003 - Web Shell
Persistence
T1543.003 - Windows Service
Persistence
T1547.001 - Registry Run Keys / Startup Folder
Persistence
T1547.004 - Winlogon Helper DLL
Persistence
T1574.001 - DLL
Persistence
Indicators of Compromise

Loading IOCs…

IOC KQL for Sentinel
STIX Data 
{'aliases': ['Tropic Trooper', 'Pirate Panda', 'KeyBoy'],
 'created': '2019-01-29T20:17:48.717Z',
 'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'description': '[Tropic Trooper](https://attack.mitre.org/groups/G0081) is an '
                'unaffiliated threat group that has led targeted campaigns '
                'against targets in Taiwan, the Philippines, and Hong Kong. '
                '[Tropic Trooper](https://attack.mitre.org/groups/G0081) '
                'focuses on targeting government, healthcare, transportation, '
                'and high-tech industries and has been active since '
                '2011.(Citation: TrendMicro Tropic Trooper Mar 2018)(Citation: '
                'Unit 42 Tropic Trooper Nov 2016)(Citation: TrendMicro Tropic '
                'Trooper May 2020)',
 'external_references': [{'external_id': 'G0081',
                          'source_name': 'mitre-attack',
                          'url': 'https://attack.mitre.org/groups/G0081'},
                         {'description': '(Citation: Crowdstrike Pirate Panda '
                                         'April 2020)',
                          'source_name': 'Pirate Panda'},
                         {'description': '(Citation: TrendMicro Tropic Trooper '
                                         'Mar 2018)(Citation: Unit 42 Tropic '
                                         'Trooper Nov 2016)',
                          'source_name': 'Tropic Trooper'},
                         {'description': '(Citation: Unit 42 Tropic Trooper '
                                         'Nov 2016)(Citation: TrendMicro '
                                         'Tropic Trooper Mar 2018)',
                          'source_name': 'KeyBoy'},
                         {'description': 'Busselen, M. (2020, April 7). '
                                         'On-demand Webcast: CrowdStrike '
                                         'Experts on COVID-19 Cybersecurity '
                                         'Challenges and Recommendations. '
                                         'Retrieved May 20, 2020.',
                          'source_name': 'Crowdstrike Pirate Panda April 2020',
                          'url': 'https://www.crowdstrike.com/blog/on-demand-webcast-crowdstrike-experts-on-covid-19-cybersecurity-challenges-and-recommendations/'},
                         {'description': 'Chen, J.. (2020, May 12). Tropic '
                                         'Trooper’s Back: USBferry Attack '
                                         'Targets Air gapped Environments. '
                                         'Retrieved May 20, 2020.',
                          'source_name': 'TrendMicro Tropic Trooper May 2020',
                          'url': 'https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf'},
                         {'description': 'Horejsi, J., et al. (2018, March '
                                         '14). Tropic Trooper’s New Strategy. '
                                         'Retrieved November 9, 2018.',
                          'source_name': 'TrendMicro Tropic Trooper Mar 2018',
                          'url': 'https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/'},
                         {'description': 'Ray, V. (2016, November 22). Tropic '
                                         'Trooper Targets Taiwanese Government '
                                         'and Fossil Fuel Provider With Poison '
                                         'Ivy. Retrieved November 9, 2018.',
                          'source_name': 'Unit 42 Tropic Trooper Nov 2016',
                          'url': 'https://researchcenter.paloaltonetworks.com/2016/11/unit42-tropic-trooper-targets-taiwanese-government-and-fossil-fuel-provider-with-poison-ivy/'}],
 'id': 'intrusion-set--56319646-eb6e-41fc-ae53-aadfa7adb924',
 'modified': '2025-10-21T23:19:38.101Z',
 'name': 'Tropic Trooper',
 'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
 'revoked': False,
 'spec_version': '2.1',
 'type': 'intrusion-set',
 'x_mitre_attack_spec_version': '3.3.0',
 'x_mitre_contributors': ['Edward Millington'],
 'x_mitre_deprecated': False,
 'x_mitre_domains': ['enterprise-attack'],
 'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'x_mitre_version': '1.6'}
Quick Actions
Related TTPs (40)
Automated Collection
Collection
Web Protocols
Command and Control
DNS
Command and Control
Ingress Tool Transfer
Command and Control
Standard Encoding
Command and Control
View All 40 TTPs
Back to Threat Actors
Dashboard Home