Tropic Trooper
Also known asPirate Panda · KeyBoy · BRONZE HOBART
Summary
Espionage group (MITRE G0081; CrowdStrike: Pirate Panda; also KeyBoy) active since 2011 against government, military, healthcare, transportation and high-tech targets in Taiwan, the Philippines and Hong Kong. MITRE lists it as unaffiliated and Kaspersky calls it Chinese-speaking; no public source attributes it to a state, so the country is held as Unknown. Trend Micro documented USBferry, which has bridged air-gapped Taiwanese and Philippine military and government networks since December 2014 by ferrying an installer over USB and exfiltrating data the same way (T1091, T1052.001). Other tradecraft: payloads hidden in JPG files (T1027.003) and DNS C2 (T1071.004). From June 2023 into 2024 Kaspersky saw it run a persistent intrusion at a Middle Eastern government body that published human-rights studies on the Israel–Hamas conflict, plus a related target in Malaysia. It planted a China Chopper web shell as an Umbraco CMS module (T1505.003) and Crowdoor loaders delivering Cobalt Strike. Kaspersky says Crowdoor's name echoes FamousSparrow's SparrowDoor and that it is reassessing the link between the two groups.
Attribution
Chinese-speaking per Kaspersky; MITRE: unaffiliated
Tracked by researchers; no state or organisation has been publicly attributed.
- MITRE ATT&CK (MITRE ATT&CK, 2026-07)
An unaffiliated threat group - Kaspersky GReAT (Research, 2024-09-05)
A Chinese-speaking threat actor (language, not state)
Campaigns 3
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| Persistent web-shell intrusion at a Middle Eastern government body publishing human-rights studies (Umbraco China Chopper, Crowdoor) | 2023-06 – 2024 | Middle East, Malaysia | Government, Human Rights | Kaspersky GReAT (2024-09-05) — high confidence |
| Taiwanese government and fossil-fuel provider targeted with Poison Ivy | 2016 | Taiwan | Government, Energy | Palo Alto Networks Unit 42 (2016-11) |
| USBferry attacks on air-gapped Taiwanese and Philippine military and government networks | 2014-12 – 2020 | Taiwan, Philippines | Military, Government | Trend Micro (2020-05) — "has been active since December 2014": ongoing at publication |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 5
| Persistence1 | T1505.003Web Shell |
|---|---|
| Stealth1 | T1027.003Steganography |
| Lateral Movement1 | T1091Replication Through Removable Media |
| Exfiltration1 | T1052.001Exfiltration over USB |
| Command and Control1 | T1071.004DNS |
Malware and tools 2
| Name | Description | Platform |
|---|---|---|
| USBferry | USB-borne information stealer (air-gap) | Windows |
| Crowdoor | Loader (DLL search-order hijacking; drops Cobalt Strike) | Windows |
Infrastructure patterns
- USB ferrying to reach air-gapped networks (USBferry) (Trend Micro, 2020)
- China Chopper web shell compiled as an Umbraco CMS module on a public web server (Kaspersky 2024)
Reporting and advisories 4
- MITRE ATT&CK
G0081 — Tropic Trooper - Kaspersky GReAT
Tropic Trooper spies on government entities in the Middle East (5 Sep 2024) - Trend Micro
Tropic Trooper's Back: USBferry Attack Targets Air-gapped Environments (May 2020) - Palo Alto Networks Unit 42
Tropic Trooper Targets Taiwanese Government and Fossil Fuel Provider With Poison Ivy (Nov 2016)