Home / Threat actors / Tropic Trooper
Tropic Trooper G0081
Also known as: Pirate Panda, KeyBoy
Updated at source on Jul 31, 2026 · View on MITRE ATT&CK
3
associated CVEs
49
Techniques
6
Malware and tools
Tropic Trooper is an unaffiliated threat group that has led targeted campaigns against targets in Taiwan, the Philippines, and Hong Kong. Tropic Trooper focuses on targeting government, healthcare, transportation, and high-tech industries and has been active since 2011.
Exploited vulnerabilities
CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.
“Tropic Trooper has executed commands through Microsoft security vulnerabilities, including CVE-2017-11882, CVE-2018-0802, and CVE-2012-0158.”
“Tropic Trooper has executed commands through Microsoft security vulnerabilities, including CVE-2017-11882, CVE-2018-0802, and CVE-2012-0158.”
“Tropic Trooper has executed commands through Microsoft security vulnerabilities, including CVE-2017-11882, CVE-2018-0802, and CVE-2012-0158.”
Techniques by tactic
Initial Access
T1078.003 Local AccountsT1091 Replication Through Removable MediaT1566.001 Spearphishing Attachment Execution
T1059.003 Windows Command ShellT1106 Native APIT1203 Exploitation for Client ExecutionT1204.002 Malicious FileT1574.001 DLL Persistence
T1078.003 Local AccountsT1505.003 Web ShellT1543.003 Windows ServiceT1547.001 Registry Run Keys / Startup FolderT1547.004 Winlogon Helper DLL Privilege Escalation
T1055.001 Dynamic-link Library InjectionT1078.003 Local AccountsT1543.003 Windows ServiceT1547.001 Registry Run Keys / Startup FolderT1547.004 Winlogon Helper DLL Stealth
T1027.003 SteganographyT1027.013 Encrypted/Encoded FileT1036.005 Match Legitimate Resource Name or LocationT1055.001 Dynamic-link Library InjectionT1070.004 File DeletionT1078.003 Local AccountsT1140 Deobfuscate/Decode Files or InformationT1221 Template InjectionT1564.001 Hidden Files and DirectoriesT1574.001 DLL Discovery
T1016 System Network Configuration DiscoveryT1033 System Owner/User DiscoveryT1046 Network Service DiscoveryT1049 System Network Connections DiscoveryT1057 Process DiscoveryT1082 System Information DiscoveryT1083 File and Directory DiscoveryT1135 Network Share DiscoveryT1518 Software DiscoveryT1518.001 Security Software DiscoveryT1680 Local Storage Discovery Lateral Movement
T1091 Replication Through Removable Media Collection
T1119 Automated Collection Command and Control
T1071.001 Web ProtocolsT1071.004 DNST1105 Ingress Tool TransferT1132.001 Standard EncodingT1573 Encrypted ChannelT1573.002 Asymmetric Cryptography Exfiltration
T1020 Automated ExfiltrationT1052.001 Exfiltration over USB © The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.