APT23 — APT Profile

Malpedia files APT23 as one label for the long-running espionage cluster better known as Tropic Trooper, grouping it with the vendor names Earth Centaur, BRONZE HOBART, Red Orthrus, Pirate Panda and KeyBoy. MITRE ATT&CK, which catalogues the group as G0081, dates its operations to 2011 and places its victims in Taiwan, Hong Kong and the Philippines across government, healthcare, transportation and high-technology organizations. Trend Micro, reporting in 2015 on the activity it called Operation Tropic Trooper, said intrusions had been running since 2012 against Taiwanese government bodies and heavy-industry companies as well as military agencies in the Philippines. MITRE's profile records the group's own KeyBoy and YAHOYAH implants alongside PoisonIvy and BITSAdmin, the USBferry utility Trend Micro tied to collection from air-gapped networks, and a ShadowPad link credited to Recorded Future. Its tradecraft leans on spearphishing with weaponized Office documents, DLL side-loading and concealing data inside image files. MITRE still classes the group as unaffiliated, but the naming schemes behind CrowdStrike's Pirate Panda and Secureworks' BRONZE HOBART both encode a China nexus.

Tools & malware

win.shadowpad Backdoor

Vendor research

Tropic Trooper's USBferry Targets Air-Gapped Networks Trend Micro
Tropic Trooper Targets Taiwanese Government and Fossil Fuel Provider With Poison Ivy Unit 42 (Palo Alto Networks)
Tropic Trooper spies on government entities in the Middle East Kaspersky (GReAT)
Collecting In the Dark: Tropic Trooper Targets Transportation and Government Trend Micro
Operation Tropic Trooper: Relying on Tried-and-Tested Flaws to Infiltrate Secret Keepers Trend Micro

Read the full analysis on IntelFusions