THREAT_ACTOR · G0081
Tropic Trooper
Also known as: Tropic Trooper, Pirate Panda, KeyBoy
Profile
Tropic Trooper is an unaffiliated threat group that has led targeted campaigns against targets in Taiwan, the Philippines, and Hong Kong. Tropic Trooper focuses on targeting government, healthcare, transportation, and high-tech industries and has been active since 2011.
MITRE ATT&CK ↗Techniques
40 ATT&CK techniques attributed to this actor.
T1016 System Network Configuration DiscoveryT1020 Automated ExfiltrationT1027.003 SteganographyT1027.013 Encrypted/Encoded FileT1033 System Owner/User DiscoveryT1036.005 Match Legitimate Resource Name or LocationT1046 Network Service DiscoveryT1049 System Network Connections DiscoveryT1052.001 Exfiltration over USBT1055.001 Dynamic-link Library InjectionT1057 Process DiscoveryT1059.003 Windows Command ShellT1070.004 File DeletionT1071.001 Web ProtocolsT1071.004 DNST1078.003 Local AccountsT1082 System Information DiscoveryT1083 File and Directory DiscoveryT1091 Replication Through Removable MediaT1105 Ingress Tool TransferT1106 Native APIT1119 Automated CollectionT1132.001 Standard EncodingT1135 Network Share DiscoveryT1140 Deobfuscate/Decode Files or InformationT1203 Exploitation for Client ExecutionT1204.002 Malicious FileT1221 Template InjectionT1505.003 Web ShellT1518 Software DiscoveryT1518.001 Security Software DiscoveryT1543.003 Windows ServiceT1547.001 Registry Run Keys / Startup FolderT1547.004 Winlogon Helper DLLT1564.001 Hidden Files and DirectoriesT1566.001 Spearphishing AttachmentT1573 Encrypted ChannelT1573.002 Asymmetric CryptographyT1574.001 DLLT1680 Local Storage Discovery
Software
6 malware/tools attributed to this actor.
PoisonIvyBITSAdminKeyBoyYAHOYAHUSBferryShadowPad
Related corpus activity
10,361 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to Tropic Trooper.
| Indicator | Type | Family | Sev | Src |
|---|---|---|---|---|
| cve-2026-3102 | cve | — | 85 | 3 |
| cve-2026-1969 | cve | — | 85 | 1 |
| cve-2025-11837 | cve | — | 85 | 2 |
| cve-2014-2321 | cve | — | 85 | 1 |
| cve-2025-2492 | cve | — | 85 | 2 |
| cve-2021-29441 | cve | — | 85 | 1 |
| cve-2026-22584 | cve | — | 85 | 2 |
| cve-2013-3307 | cve | — | 85 | 2 |
| cve-2016-15047 | cve | — | 85 | 4 |
| cve-2018-8007 | cve | — | 85 | 1 |
| cve-2021-4045 | cve | — | 85 | 1 |
| cve-2020-22658 | cve | — | 85 | 2 |
| cve-2017-18377 | cve | — | 85 | 1 |
| cve-2021-25646 | cve | — | 85 | 1 |
| cve-2025-66478 | cve | — | 85 | 2 |
| cve-2025-0921 | cve | — | 85 | 2 |
| cve-2016-5681 | cve | — | 85 | 2 |
| cve-2021-27076 | cve | — | 85 | 1 |
| cve-2025-68670 | cve | — | 85 | 2 |
| cve-2022-47945 | cve | — | 85 | 1 |
| cve-2025-34054 | cve | — | 85 | 4 |
| cve-2024-1781 | cve | — | 85 | 1 |
| cve-2025-23304 | cve | — | 85 | 2 |
| cve-2023-44976 | cve | ransomware | 85 | 2 |
| cve-2020-17456 | cve | — | 85 | 1 |
| cve-2020-22653 | cve | — | 85 | 2 |
| cve-2025-34117 | cve | — | 85 | 1 |
| cve-2026-4368 | cve | ransomware | 85 | 1 |
| cve-2013-7471 | cve | — | 85 | 1 |
| cve-2026-0740 | cve | — | 85 | 1 |
Showing the top 30 by severity of 10,361.