Tropic Trooper
- ID
- G0081
- Associated names
- Pirate Panda, KeyBoy
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
Tropic Trooper is an unaffiliated threat group that has led targeted campaigns against targets in Taiwan, the Philippines, and Hong Kong. Tropic Trooper focuses on targeting government, healthcare, transportation, and high-tech industries and has been active since 2011.[1][2][3]
Techniques used (40)
- T1016 System Network Configuration Discovery
- T1020 Automated Exfiltration
- T1027.003 Steganography
- T1027.013 Encrypted/Encoded File
- T1033 System Owner/User Discovery
- T1036.005 Match Legitimate Resource Name or Location
- T1046 Network Service Discovery
- T1049 System Network Connections Discovery
- T1052.001 Exfiltration over USB
- T1055.001 Dynamic-link Library Injection
- T1057 Process Discovery
- T1059.003 Windows Command Shell
- T1070.004 File Deletion
- T1071.001 Web Protocols
- T1071.004 DNS
- T1078.003 Local Accounts
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1091 Replication Through Removable Media
- T1105 Ingress Tool Transfer
- T1106 Native API
- T1119 Automated Collection
- T1132.001 Standard Encoding
- T1135 Network Share Discovery
- T1140 Deobfuscate/Decode Files or Information
- T1203 Exploitation for Client Execution
- T1204.002 Malicious File
- T1221 Template Injection
- T1505.003 Web Shell
- T1518 Software Discovery
- T1518.001 Security Software Discovery
- T1543.003 Windows Service
- T1547.001 Registry Run Keys / Startup Folder
- T1547.004 Winlogon Helper DLL
- T1564.001 Hidden Files and Directories
- T1566.001 Spearphishing Attachment
- T1573 Encrypted Channel
- T1573.002 Asymmetric Cryptography
- T1574.001 DLL
- T1680 Local Storage Discovery