Threat actor · MITRE ATT&CK G0081
Tropic Trooper
China · also tracked as APT23, BRONZE HOBART, Earth Centaur
- Articles, all time
- 3
- Articles, last 30 days
- 1
- CVEs exploited, attributed · all time
- 0
- Research reports, all time
- 1
Tracked by CyberSIXT since 24 Apr · RSS
Activity
Three articles so far, 24 Apr to 10 Nov.
- Tue 10 Nov. Check Point. CopperDragon's Sparrow Framework Drives Global Campaigns.
- Fri 24 Apr. The Hacker News. Tropic Trooper hijacks SumatraPDF to drop AdaptixC2 via GitHub.
- Fri 24 Apr. Dark Reading. Tropic Trooper uses dictionary app to hijack home routers in Japan.
- Thu 24 Oct. Research report by hitcon.org. Pirates_of_The_Nang_Hai_Follow_the_Artifacts_of_Tropic_Trooper,_No_One_Knows.pdf.
- Article naming Tropic Trooper
- Square: research report
- Articles a day, all coverage
- Quiet time, folded
Drawn: all 3 articles and the only research report.
Show as tableHide table
| Date | Type | Source | Title |
|---|---|---|---|
| 10 Nov | Article | Check Point | CopperDragon's Sparrow Framework Drives Global Campaigns |
| 24 Apr | Article | The Hacker News | Tropic Trooper hijacks SumatraPDF to drop AdaptixC2 via GitHub |
| 24 Apr | Article | Dark Reading | Tropic Trooper uses dictionary app to hijack home routers in Japan |
| 24 Oct | Report | hitcon.org | Pirates_of_The_Nang_Hai_Follow_the_Artifacts_of_Tropic_Trooper,_No_One_Knows.pdf |
Connections
7 tools. What the record links this actor to; hover or use the arrow keys.
Show as a listHide the list
- Malware and tools
- PoisonIvy, BITSAdmin, KeyBoy, YAHOYAH, USBferry, ShadowPad
CVEs exploited
No CVE is attributed to Tropic Trooper in CyberSIXT coverage.
MITRE ATT&CK techniques40 techniques · 10 tactics
Distinct techniques recorded per ATT&CK tactic. The shape shows what the record covers, not activity or risk.
Compare withAverage of 48 actors
Show as tableHide table
| Tactic | Tropic Trooper | Average of 48 actors |
|---|---|---|
| Reconnaissance | 0 | 2.2 |
| Resource Development | 0 | 4.9 |
| Initial Access | 3 | 3.3 |
| Execution | 5 | 5.7 |
| Persistence | 5 | 4.4 |
| Privilege Escalation | 5 | 3.7 |
| Stealth | 10 | 7.9 |
| Defense Impairment | 0 | 1.5 |
| Credential Access | 0 | 3.1 |
| Discovery | 11 | 5.9 |
| Lateral Movement | 1 | 1.5 |
| Collection | 1 | 3.1 |
| Command and Control | 6 | 4 |
| Exfiltration | 2 | 0.9 |
| Impact | 0 | 1.1 |
Most recorded: Discovery 11 · Stealth 10 · Command and Control 6
Show the technique matrixTechnique matrix49 techniques
Initial Access3
Execution5
Persistence5
Privilege Escalation5
Stealth10
- T1027.003Steganography
- T1027.013Encrypted/Encoded File
- T1036.005Match Legitimate Resource Name or Location
- T1055.001Dynamic-link Library Injection
- T1070.004File Deletion
- T1078.003Local Accounts
- T1140Deobfuscate/Decode Files or Information
- T1221Template Injection
- T1564.001Hidden Files and Directories
- T1574.001DLL
Discovery11
- T1016System Network Configuration Discovery
- T1033System Owner/User Discovery
- T1046Network Service Discovery
- T1049System Network Connections Discovery
- T1057Process Discovery
- T1082System Information Discovery
- T1083File and Directory Discovery
- T1135Network Share Discovery
- T1518Software Discovery
- T1518.001Security Software Discovery
- T1680Local Storage Discovery
Lateral Movement1
Collection1
Command and Control6
Exfiltration2
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. All techniques on MITRE ATT&CK
Malware and tools7
MITRE ATT&CK® · G0081 and Malpedia · apt23
Articles3
Drawn: all 3 articles and the only research report.