Tag: Tropic Trooper

Tropic Trooper – Campaign

Tropic Trooper employs a multi-stage attack flow:

  1. Initial Access: Exploiting vulnerabilities in public-facing applications (like Microsoft Exchange Server) or through spearphishing emails with malicious attachments.
  2. Persistence: Establishing persistent access using web shells (like “ByPassGodzilla”) and malware (like “Yahoyah” and “ChinaChopper”).
  3. Privilege Escalation: Utilizing DLL side-loading and exploiting system services to gain higher privileges.
  4. Lateral Movement: Moving laterally within the network using SMB shares and remote services.
  5. Data Exfiltration: Exfiltrating data to cloud storage or using other automated methods.
Read more...

Tropic Trooper – Spear Phishing Attachment

Tropic Trooper crafts spearphishing emails with malicious attachments, often disguised as legitimate documents or files, to target individuals within their desired organizations. These attachments typically contain malware, such as the “Yahoyah” downloader, which enables them to establish persistence on compromised systems.

Read more...

Tropic Trooper – Exploit Web Facing App

Tropic Trooper exploits vulnerabilities in public-facing web servers, such as Microsoft Exchange Server, to gain initial access to target networks. They leverage known vulnerabilities (like CVE-2023-26360) to establish a foothold and deploy web shells like “ByPassGodzilla” for further malicious activities.

Read more...