Tropic Trooper AdaptixC2 and VS Code Tunnel Campaign

Tropic TrooperAPT23Earth CentaurAdaptixC2TOSHIS loaderVS Code tunnelsGitHub C2SumatraPDF trojanChinese targetingTaiwan espionagedefense contractor infiltration

A sophisticated cyber espionage campaign orchestrated by the Tropic Trooper APT group (APT23/Earth Centaur) targeting Chinese-speaking populations in Taiwan, South Korea, and Japan. The campaign utilizes trojanized SumatraPDF documents, TOSHIS loaders, AdaptixC2 beacons, and innovative persistence mechanisms, including Visual Studio Code tunnels, to maintain long-term access to government, military, and defense contractor networks.

Indicators of Compromise

Domains (1)

stg.lsmartv.com

Hashes (24)

2c65433696037f4ce0f8c9a1d78bdd6835c1b94d3c29c72a59133dd9eb23953211129fd8275a11b91a3b8dddb3c6e502b6b63edbbd618c9e1e10891fe666839650fa406833d70afdc2051635ccfdc0b48c260e7ceeee3f96bf026fea47c7ce0e3816647b23bb180725c7233e505f61c35e7776d47fd448009e88785719e3c4df728e3e657cb9496cd4aaf69648470b6367fcf5c21474d314aa0b27b0ce8befb23238d2f6b9ea9825eb61ae5e80e7365c89daa54fada8798c5f4e21738c8ea0b43936f522f187f8f67dda3dc88abfd170f6ba873af81fc31bbf1fdbcad1b2a7fbadb47733c224fc8c0f7edc61becb578e560435abb92a3a1cf5786b6e08643483387b77640cd44f84df1169dd00efde7af46b5714aeec65bac035789073b567753284b64ce0b95bbae62cf79e1479714238af0eb7401cc16d79d94c32da3f66df21d66ffd71603c146eaea92394e115cd6d5bab9ae1c6d088806229aae320e6c519c2d2210dbc94fe6c68dc2e33780e07596c3c06aa819ea460b3d12571fa755b6ba012e1713c9101c7329f8da4f2131eb497afe5f78d8d6e534df2b8d75c5b9b565c3ec17a323afe5355da26e2dc48ef24da000b8fc1354fa31ca9ae343be0f2077901ea5b5b9fb97d97892ac1a907e6+4 more

IPv4 (2)

47.76.236.58158.247.193.100

APT Groups

Pirate Panda

Notes

<div>CONCLUSIONTropic Trooper demonstrates advanced operational capabilities through their strategic deployment of trojanized legitimate software and innovative persistence mechanisms, showcasing the group's evolution toward more sophisticated evasion techniques targeting specific language and cultural demographics. The integration of development tools like VS Code tunnels for persistence represents a significant tactical advancement, exploiting the trust placed in legitimate development platforms to maintain long-term access. The campaign's impact extends across critical government and defense sectors in Taiwan, South Korea, and Japan, with particular emphasis on entities involved in cross-strait relations and regional security matters. The combination of social engineering, process hollowing, and legitimate service abuse creates substantial challenges for traditional security controls focused on signature-based detection. For comprehensive threat hunting, SOCRadar's IOC Radar capabilities should be leveraged to identify GitHub repositories and domain patterns associated with this campaign across enterprise environments. Dark Web Monitoring becomes essential for detecting exposed credentials that could facilitate initial access vectors beyond spearphishing. Continuous Cyber Threat Intelligence updates on Tropic Trooper TTPs will enhance detection accuracy for similar state-sponsored campaigns. Brand Protection services should monitor for domain registrations mimicking legitimate software distributors, while Attack Surface Management provides visibility into exposed development tools and remote access solutions that could be exploited for persistence.<div> </div></div>

Mitigation

<h1 style="text-align: left; line-height: 1.2; margin-top: 0pt; margin-bottom: 0pt;">MITRE ATT&CK Mitigation Table</h1> <div style="margin-left:0pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col><col><col><col><col></colgroup><tbody><tr style="height:0pt;"><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;background-color:#4f81bd;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Technique ID</td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;background-color:#4f81bd;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Technique Name</td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;background-color:#4f81bd;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Tactic</td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;background-color:#4f81bd;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Mitigation ID</td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;background-color:#4f81bd;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Description</td></tr><tr style="height:0pt;"><td style="border-left:solid #cccccc 0.5pt;border-right:solid #cccccc 0.5pt;border-bottom:solid #cccccc 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1566/001/">T1566.001</a></td><td style="border-left:solid #cccccc 0.5pt;border-right:solid #cccccc 0.5pt;border-bottom:solid #cccccc 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Spearphishing Attachment</td><td style="border-left:solid #cccccc 0.5pt;border-right:solid #cccccc 0.5pt;border-bottom:solid #cccccc 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Initial Access</td><td style="border-left:solid #cccccc 0.5pt;border-right:solid #cccccc 0.5pt;border-bottom:solid #cccccc 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1049/">M1049</a></td><td style="border-left:solid #cccccc 0.5pt;border-right:solid #cccccc 0.5pt;border-bottom:solid #cccccc 0.5pt;border-top:solid #000000 0.5pt;vertical-align:top;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Antivirus/Antimalware — Deploy advanced email security solutions with behavioral analysis to detect trojanized PDF files and embedded malicious payloads before delivery to end users.</td></tr><tr style="height:0pt;"><td style="border-left:solid #cccccc 0.5pt;border-right:solid #cccccc 0.5pt;border-bottom:solid #cccccc 0.5pt;border-top:solid #cccccc 0.5pt;vertical-align:top;background-color:#f2f2f2;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1566/001/">T1566.001</a></td><td style="border-left:solid #cccccc 0.5pt;border-right:solid #cccccc 0.5pt;border-bottom:solid #cccccc 0.5pt;border-top:solid #cccccc 0.5pt;vertical-align:top;background-color:#f2f2f2;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Spearphishing Attachment</td><td style="border-left:solid #cccccc 0.5pt;border-right:solid #cccccc 0.5pt;border-bottom:solid #cccccc 0.5pt;border-top:solid #cccccc 0.5pt;vertical-align:top;background-color:#f2f2f2;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Initial Access</td><td style="border-left:solid #cccccc 0.5pt;border-right:solid #cccccc 0.5pt;border-bottom:solid #cccccc 0.5pt;border-top:solid #cccccc 0.5pt;vertical-align:top;background-color:#f2f2f2;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1017/">M1017</a></td><td style="border-left:solid #cccccc 0.5pt;border-right:solid #cccccc 0.5pt;border-bottom:solid #cccccc 0.5pt;border-top:solid #cccccc 0.5pt;vertical-align:top;background-color:#f2f2f2;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">User Training — Conduct specialized awareness training on APT tactics, focusing on trojanized legitimate software and PDF-based attacks targeting Chinese-speaking users.</td></tr><tr style="height:0pt;"><td style="border-left:solid #cccccc 0.5pt;border-right:solid #cccccc 0.5pt;border-bottom:solid #cccccc 0.5pt;border-top:solid #cccccc 0.5pt;vertical-align:top;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1055/012/">T1055.012</a></td><td style="border-left:solid #cccccc 0.5pt;border-right:solid #cccccc 0.5pt;border-bottom:solid #cccccc 0.5pt;border-top:solid #cccccc 0.5pt;vertical-align:top;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Process Hollowing</td><td style="border-left:solid #cccccc 0.5pt;border-right:solid #cccccc 0.5pt;border-bottom:solid #cccccc 0.5pt;border-top:solid #cccccc 0.5pt;vertical-align:top;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Defense Evasion / Privilege Escalation</td><td style="border-left:solid #cccccc 0.5pt;border-right:solid #cccccc 0.5pt;border-bottom:solid #cccccc 0.5pt;border-top:solid #cccccc 0.5pt;vertical-align:top;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1040/">M1040</a></td><td style="border-left:solid #cccccc 0.5pt;border-right:solid #cccccc 0.5pt;border-bottom:solid #cccccc 0.5pt;border-top:solid #cccccc 0.5pt;vertical-align:top;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Behavior Prevention on Endpoint — Implement EDR solutions capable of detecting process hollowing techniques and abnormal memory injections into legitimate processes like PDF readers.</td></tr><tr style="height:0pt;"><td style="border-left:solid #cccccc 0.5pt;border-right:solid #cccccc 0.5pt;border-bottom:solid #cccccc 0.5pt;border-top:solid #cccccc 0.5pt;vertical-align:top;background-color:#f2f2f2;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1113/">T1113</a></td><td style="border-left:solid #cccccc 0.5pt;border-right:solid #cccccc 0.5pt;border-bottom:solid #cccccc 0.5pt;border-top:solid #cccccc 0.5pt;vertical-align:top;background-color:#f2f2f2;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Screen Capture</td><td style="border-left:solid #cccccc 0.5pt;border-right:solid #cccccc 0.5pt;border-bottom:solid #cccccc 0.5pt;border-top:solid #cccccc 0.5pt;vertical-align:top;background-color:#f2f2f2;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Collection</td><td style="border-left:solid #cccccc 0.5pt;border-right:solid #cccccc 0.5pt;border-bottom:solid #cccccc 0.5pt;border-top:solid #cccccc 0.5pt;vertical-align:top;background-color:#f2f2f2;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1057/">M1057</a></td><td style="border-left:solid #cccccc 0.5pt;border-right:solid #cccccc 0.5pt;border-bottom:solid #cccccc 0.5pt;border-top:solid #cccccc 0.5pt;vertical-align:top;background-color:#f2f2f2;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Data Loss Prevention — Deploy DLP solutions to monitor and prevent unauthorized screenshot capture and sensitive document exfiltration from government and defense systems.</td></tr><tr style="height:0pt;"><td style="border-left:solid #cccccc 0.5pt;border-right:solid #cccccc 0.5pt;border-bottom:solid #cccccc 0.5pt;border-top:solid #cccccc 0.5pt;vertical-align:top;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1102/001/">T1102.001</a></td><td style="border-left:solid #cccccc 0.5pt;border-right:solid #cccccc 0.5pt;border-bottom:solid #cccccc 0.5pt;border-top:solid #cccccc 0.5pt;vertical-align:top;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Web Service: Dead Drop Resolver</td><td style="border-left:solid #cccccc 0.5pt;border-right:solid #cccccc 0.5pt;border-bottom:solid #cccccc 0.5pt;border-top:solid #cccccc 0.5pt;vertical-align:top;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Command and Control</td><td style="border-left:solid #cccccc 0.5pt;border-right:solid #cccccc 0.5pt;border-bottom:solid #cccccc 0.5pt;border-top:solid #cccccc 0.5pt;vertical-align:top;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1031/">M1031</a></td><td style="border-left:solid #cccccc 0.5pt;border-right:solid #cccccc 0.5pt;border-bottom:solid #cccccc 0.5pt;border-top:solid #cccccc 0.5pt;vertical-align:top;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Network Intrusion Prevention — Block access to suspicious GitHub repositories and monitor for C2 communications over legitimate web services like GitHub and Microsoft platforms.</td></tr><tr style="height:0pt;"><td style="border-left:solid #cccccc 0.5pt;border-right:solid #cccccc 0.5pt;border-bottom:solid #cccccc 0.5pt;border-top:solid #cccccc 0.5pt;vertical-align:top;background-color:#f2f2f2;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1021/007/">T1021.007</a></td><td style="border-left:solid #cccccc 0.5pt;border-right:solid #cccccc 0.5pt;border-bottom:solid #cccccc 0.5pt;border-top:solid #cccccc 0.5pt;vertical-align:top;background-color:#f2f2f2;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Remote Services: Cloud Services</td><td style="border-left:solid #cccccc 0.5pt;border-right:solid #cccccc 0.5pt;border-bottom:solid #cccccc 0.5pt;border-top:solid #cccccc 0.5pt;vertical-align:top;background-color:#f2f2f2;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Lateral Movement</td><td style="border-left:solid #cccccc 0.5pt;border-right:solid #cccccc 0.5pt;border-bottom:solid #cccccc 0.5pt;border-top:solid #cccccc 0.5pt;vertical-align:top;background-color:#f2f2f2;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1032/">M1032</a></td><td style="border-left:solid #cccccc 0.5pt;border-right:solid #cccccc 0.5pt;border-bottom:solid #cccccc 0.5pt;border-top:solid #cccccc 0.5pt;vertical-align:top;background-color:#f2f2f2;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Multi-factor Authentication — Enforce MFA on all cloud services and implement conditional access policies to prevent unauthorized VS Code tunnel access from compromised accounts.</td></tr><tr style="height:0pt;"><td style="border-left:solid #cccccc 0.5pt;border-right:solid #cccccc 0.5pt;border-bottom:solid #cccccc 0.5pt;border-top:solid #cccccc 0.5pt;vertical-align:top;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1090/003/">T1090.003</a></td><td style="border-left:solid #cccccc 0.5pt;border-right:solid #cccccc 0.5pt;border-bottom:solid #cccccc 0.5pt;border-top:solid #cccccc 0.5pt;vertical-align:top;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Proxy: Multi-hop Proxy</td><td style="border-left:solid #cccccc 0.5pt;border-right:solid #cccccc 0.5pt;border-bottom:solid #cccccc 0.5pt;border-top:solid #cccccc 0.5pt;vertical-align:top;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Command and Control</td><td style="border-left:solid #cccccc 0.5pt;border-right:solid #cccccc 0.5pt;border-bottom:solid #cccccc 0.5pt;border-top:solid #cccccc 0.5pt;vertical-align:top;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1037/">M1037</a></td><td style="border-left:solid #cccccc 0.5pt;border-right:solid #cccccc 0.5pt;border-bottom:solid #cccccc 0.5pt;border-top:solid #cccccc 0.5pt;vertical-align:top;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Filter Network Traffic — Monitor and restrict outbound connections to development tools and code repositories from non-development networks to detect tunnel abuse.</td></tr></tbody></table></div>