APT23

Also known as PIRATE PANDA, KeyBoy, Tropic Trooper, BRONZE HOBART, G0081, Red Orthrus, Earth Centaur

0mentions, 7 days

0mentions, 30 days

nonelast mentioned

TrendMicro described Tropic Trooper in a 2015 report as: 'Taiwan and the Philippines have become the targets of an ongoing campaign called Operation TropicTrooper. Active since 2012, the attackers behind the campaign haveset their sights on the Taiwanese government as well as a number of companies in the heavy industry. The same campaign has also targeted key Philippine military agencies.'

CVEs in recent coverage

No CVEs named alongside this actor in the last 90 days.

Recent victims

No leak-site posts on record for this group.

ATT&CK techniques

T1016 System Network Configuration Discovery T1020 Automated Exfiltration T1027.003 Steganography T1027.013 Encrypted/Encoded File T1033 System Owner/User Discovery T1036.005 Match Legitimate Resource Name or Location T1046 Network Service Discovery T1049 System Network Connections Discovery T1052.001 Exfiltration over USB T1055.001 Dynamic-link Library Injection T1057 Process Discovery T1059.003 Windows Command Shell T1070.004 File Deletion T1071.001 Web Protocols T1071.004 DNS T1078.003 Local Accounts T1082 System Information Discovery T1083 File and Directory Discovery T1091 Replication Through Removable Media T1105 Ingress Tool Transfer T1106 Native API T1119 Automated Collection T1132.001 Standard Encoding T1135 Network Share Discovery T1140 Deobfuscate/Decode Files or Information T1203 Exploitation for Client Execution T1204.002 Malicious File T1221 Template Injection T1505.003 Web Shell T1518 Software Discovery T1518.001 Security Software Discovery T1543.003 Windows Service T1547.001 Registry Run Keys / Startup Folder T1547.004 Winlogon Helper DLL T1564.001 Hidden Files and Directories T1566.001 Spearphishing Attachment T1573 Encrypted Channel T1573.002 Asymmetric Cryptography T1574.001 DLL T1680 Local Storage Discovery

Recent activity

No posts or advisories have named this actor recently.

References

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.