Skip to content

Tropic Trooper

IntrusionSet · ATTACK:enterprise:G0081

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:G0081",
  "title": "Tropic Trooper",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G0081",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--56319646-eb6e-41fc-ae53-aadfa7adb924",
  "external_id": "G0081",
  "domain": "enterprise",
  "created": "2019-01-29T20:17:48.717Z",
  "modified": "2026-07-31T18:47:56.506Z",
  "version": "1.6",
  "aliases": [
    "Tropic Trooper",
    "Pirate Panda",
    "KeyBoy"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Pirate Panda"
    },
    {
      "source_name": "Tropic Trooper"
    },
    {
      "source_name": "KeyBoy"
    },
    {
      "source_name": "Crowdstrike Pirate Panda April 2020",
      "url": "https://www.crowdstrike.com/blog/on-demand-webcast-crowdstrike-experts-on-covid-19-cybersecurity-challenges-and-recommendations/"
    },
    {
      "source_name": "TrendMicro Tropic Trooper May 2020",
      "url": "https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"
    },
    {
      "source_name": "TrendMicro Tropic Trooper Mar 2018",
      "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/"
    },
    {
      "source_name": "Unit 42 Tropic Trooper Nov 2016",
      "url": "https://researchcenter.paloaltonetworks.com/2016/11/unit42-tropic-trooper-targets-taiwanese-government-and-fossil-fuel-provider-with-poison-ivy/"
    }
  ]
}

Explicit source assertions (46)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--03fcc016-f9a2-491d-8d9f-92aa4b4c4d4a

PWC KeyBoys Feb 2017

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--098a760a-66ce-46e0-938e-86518e450a27

TrendMicro Tropic Trooper May 2020

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0be962d8-6281-4554-ad1f-4cba04c547de

CitizenLab Tropic Trooper Aug 2018 · TrendMicro TropicTrooper 2015 · TrendMicro Tropic Trooper May 2020 · Anomali Pirate Panda April 2020 · Unit 42 Tropic Trooper Nov 2016

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f47a6e7-af7e-4e23-a401-4dec08da4e64

TrendMicro Tropic Trooper May 2020

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--17cafa26-57f1-4efb-9d23-1399cd2de4cd

Unit 42 Tropic Trooper Nov 2016 · TrendMicro Tropic Trooper May 2020

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:S0452

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1b5dbd72-abeb-4d61-9a7f-917a17f272d1

TrendMicro Tropic Trooper May 2020

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--283ba7b1-cd3b-44e9-bfae-70023c53d446

Anomali Pirate Panda April 2020

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1573

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3089fe6b-36d6-4890-b70b-1a76f55c84ff

TrendMicro Tropic Trooper May 2020

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--32bebd4b-6bbe-4a4e-86a1-0c49fda51259

Anomali Pirate Panda April 2020 · TrendMicro Tropic Trooper May 2020

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4269342d-fd7b-4fc6-882f-5099da627c85

TrendMicro Tropic Trooper Mar 2018 · TrendMicro Tropic Trooper May 2020

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1221

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--56a866fd-1a37-4750-89e6-2e26ed69cb27

Unit 42 Tropic Trooper Nov 2016

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--58a7f0d9-7c20-4808-b8be-bd6240267030

TrendMicro TropicTrooper 2015

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5929ef3e-3945-4ede-b3cd-94f47850a6bd

TrendMicro TropicTrooper 2015 · TrendMicro Tropic Trooper May 2020

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6512ebc3-cc9f-48e1-9a57-a5deb062f123

TrendMicro Tropic Trooper May 2020

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:S0596

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--696abb07-b706-469e-83c2-1e29984c9532

Recorded Future RedEcho Feb 2021

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1052.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6971d7f3-8161-4399-b587-acab5d8820f1

TrendMicro Tropic Trooper May 2020

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--69cc4413-80b4-45ed-a993-db34fe32fabe

Anomali Pirate Panda April 2020 · TrendMicro Tropic Trooper May 2020

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6a063d3a-cad2-4649-93a4-d1931ae6aaaf

TrendMicro Tropic Trooper May 2020

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6a8356c2-5a79-40b7-bb8e-b7d9dffbe523

TrendMicro Tropic Trooper Mar 2018 · TrendMicro Tropic Trooper May 2020

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--702b125c-993e-468f-8ea9-6862048be772

TrendMicro Tropic Trooper May 2020

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1106

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--73499911-3b9f-443e-b522-f0d1434f2eb6

TrendMicro Tropic Trooper May 2020

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1574.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--77dbc1ae-556e-43cd-b776-c7670ab5c915

CitizenLab KeyBoy Nov 2016 · Anomali Pirate Panda April 2020

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--78731c00-1f22-4dab-a3cd-d19fac57e82f

TrendMicro Tropic Trooper May 2020

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:S0012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--831143c2-3477-49e4-8806-c1e07be0fa79

Unit 42 Tropic Trooper Nov 2016

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--86333028-9eb1-44a3-9a5a-51fffe66f0e1

TrendMicro Tropic Trooper May 2020 · TrendMicro Tropic Trooper Mar 2018

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8a2a70a5-044d-4869-9d11-10499c8848bc

TrendMicro Tropic Trooper May 2020

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--91180074-16cd-448f-8955-628d06965e22

TrendMicro Tropic Trooper May 2020

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1078.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--95122d43-9de8-4eef-bc46-6fdc5cc276a9

TrendMicro Tropic Trooper May 2020

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a1cb6aec-0f1c-491e-9648-b668014e3aee

TrendMicro TropicTrooper 2015 · TrendMicro Tropic Trooper May 2020

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1547.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ad3bca07-c2d2-411f-9bd8-bf4e1142d9ae

Unit 42 Tropic Trooper Nov 2016 · TrendMicro Tropic Trooper May 2020

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ad934b01-9c8c-42cd-8195-dc272c363208

TrendMicro Tropic Trooper Mar 2018 · Unit 42 Tropic Trooper Nov 2016

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1071.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--af9e92df-d4d0-437a-9114-823b6a2a14a6

TrendMicro Tropic Trooper May 2020

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b3dd4e4e-0bb8-4487-8336-b5d9024045eb

TrendMicro Tropic Trooper May 2020

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:S0190

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b5344ae6-8083-4a09-98f3-01c1491356dc

TrendMicro Tropic Trooper Mar 2018

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c31643e8-86a3-49e4-bd69-572d7e64c7c0

TrendMicro Tropic Trooper Mar 2018 · TrendMicro Tropic Trooper May 2020

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1020

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c4f1371c-8f23-49b7-9572-d226ee2dbade

TrendMicro Tropic Trooper May 2020

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c4f4fe39-af57-47d3-8428-fe5bce63bdbb

TrendMicro TropicTrooper 2015

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cd5799f3-8be5-4272-88db-626940136130

TrendMicro TropicTrooper 2015 · TrendMicro Tropic Trooper May 2020

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1518.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cdefab78-5d90-4e89-8664-5bbd30ab1517

Unit 42 Tropic Trooper Nov 2016

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d68120b8-9ef8-4a40-ae4c-d2b597336140

Unit 42 Tropic Trooper Nov 2016 · TrendMicro Tropic Trooper May 2020

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1049

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--df7e5314-665b-44a3-8040-f6cb8fd28cbf

TrendMicro Tropic Trooper May 2020

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1027.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e35f5636-2ae8-4ab7-9851-73410e6a58d0

TrendMicro Tropic Trooper May 2020

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:S0388

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e4ccb68f-5c52-4805-88d0-14d87268e562

TrendMicro TropicTrooper 2015

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:S0387

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ef2cc3f0-b44f-4f56-ba46-45e736ce0e90

Unit 42 Tropic Trooper Nov 2016 · CitizenLab Tropic Trooper Aug 2018

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f79c163a-25c0-4694-b1ca-50ab1eda8651

TrendMicro Tropic Trooper May 2020

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1091

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fded4f08-6cb0-4259-a6a9-f0d62537164f

TrendMicro Tropic Trooper May 2020

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.