In May 2015, Trend Micro published a report on “Operation Tropic Trooper”, an ongoing campaign against government, military and industrial organisations in Taiwan and the Philippines. The company said the activity went back to 2012 and relied on old techniques: two heavily exploited Windows vulnerabilities, social engineering and basic steganography.
Between March and May 2015, Trend Micro said, 62 per cent of the malware infections it tracked hit Taiwanese organisations and 38 per cent hit Philippine ones. In Taiwan the targets included government ministries and heavy industry. In the Philippines they were in the military, according to SecurityWeek’s report on the findings.
Who was exposed and why
Trend Micro’s researchers said the attackers knew their targets’ environments and chose lures to match. Spear-phishing emails carried documents that hinted at subjects such as planned bombings, résumés or government budgets. The attachments exploited CVE-2010-3333 and CVE-2012-0158 to run a Trojan.
Trend Micro threats analyst Kervin Alintanahin wrote that use of these two flaws suggested the victims were running unpatched, vulnerable software. Tenable made a similar point, noting that one flaw was five years old and the other three. It argued the intrusions were entirely preventable.
Trend Micro also pointed to ageing systems. It put Windows XP at nearly 17 per cent of systems in Taiwan and 13 per cent in the Philippines in the first half of 2015. Larger agencies take longer to upgrade, so it judged that many targets probably still ran the legacy operating system.
How the infection worked
The Trojan, TROJ_YAHOYAH, downloaded and decrypted an image that looked like a default Windows XP wallpaper. Hidden in the image by simple steganography was BKDR_YAHAMAM, a backdoor. Trend Micro said it could steal data, kill processes and services, delete files and directories, and put systems to sleep.
Trend Micro did not name the actors. It did locate command-and-control servers in four places: Taiwan (43 per cent), the United States (36 per cent), Hong Kong (14 per cent) and the United Arab Emirates (7 per cent), as SecurityWeek reported.
What defenders were told
Trend Micro described the routines as less sophisticated than other targeted attacks, yet effective against networks holding sensitive data. Its advice was to patch vulnerabilities, train staff against social engineering, and use antimalware detection. It also urged organisations to use threat intelligence and build a defence strategy tailored to their own networks.
How the group developed
The group did not disappear. In 2016, Palo Alto Networks researchers reported Yahoyah malware used against the secretary general of Taiwan’s Executive Yuan and a fossil fuel provider, again through CVE-2012-0158, according to Security Affairs.
Trend Micro later reported that the group, which it said had been active since 2011, was targeting the physically isolated networks of the Taiwanese and Philippine militaries with a USB-based malware it called USBferry. It said USBferry attacks had been active since 2014. Targets included military and navy agencies, government institutions, military hospitals and a national bank.
Trend Micro also described the group as primarily motivated by information theft and espionage. It said the group had adapted its tools and moved into mobile surveillanceware. Other trackers use the names KeyBoy, APT23 and Pirate Panda for the same or overlapping activity, according to the Malpedia catalogue.
The Citizen Lab linked a 2018 campaign against Tibetan groups to Tropic Trooper through shared TSSL tooling. That showed the group’s reach extended beyond Taiwan and the Philippines. In December 2021, Trend Micro published further research on the group’s targeting of transportation and government organisations.