Tropic Trooper Cyber Espionage Hackers Targeting Transportation Sector

Transportation industry and government agencies related to the
sector are the victims of an ongoing campaign since July 2020 by a
sophisticated and well-equipped cyberespionage group in what
appears to be yet another uptick in malicious activities that are
“just the tip of the iceberg.”

“The group tried to access some internal documents (such as
flight schedules and documents for financial plans) and personal
information on the compromised hosts (such as search histories),”
Trend Micro researchers Nick Dai, Ted Lee, and Vickie Su said^[1]
in a report published last week.

Earth Centaur, also known by the monikers Pirate Panda^[2]
and Tropic Trooper, is a long-running threat group focused on
information theft and espionage that has led targeted campaigns
against government, healthcare, transportation, and high-tech
industries in Taiwan, the Philippines, and Hong Kong dating all the
way back to 2011.

The hostile agents, believed to be a Chinese-speaking actor, are
known for their use of spear-phishing emails with weaponized
attachments to exploit known vulnerabilities, while simultaneously
advancing their malicious tools with obfuscation, stealthiness, and
striking power.

“This threat group is proficient at red
teamwork^[3],” the researchers
elaborated. “The group knows how to bypass security settings and
keep its operation unobstructive. The usage of the open-source
frameworks also allows the group to develop new backdoor variants
efficiently.”

In May 2020, the operators were observed^[4]
fine-tuning their attack strategies with new behaviors by deploying
a USB trojan dubbed USBFerry^[5]
to strike physically isolated networks belonging to government
institutions and military entities in Taiwan and the Philippines in
a bid to siphon sensitive data through removable flash drives.

The latest multi-stage intrusion sequence detailed by Trend
Micro involves the group turning to exploit vulnerable Internet
Information Services (IIS^[6]) servers and Exchange server flaws^[7]
as entry points to install a web shell that’s then leveraged to
deliver a .NET-based Nerapack loader and a first-stage backdoor
known as Quasar^[8]
on the compromised system.

From there, the attackers follow it up by dropping an arsenal of
second-stage implants like ChiserClient, SmileSvr, ChiserClient,
HTShell, and bespoke versions of Lilith RAT and Gh0st RAT depending
on the victim to retrieve further instructions from a remote
server, download additional payloads, perform file operations,
execute arbitrary commands, and exfiltrate results back to the
server.

It doesn’t end there. After successful exploitation of the
system, Tropic Trooper also attempts to breach the intranet, dump
credentials, and wipe out event logs from the infected machines
using a specific set of tools. Also put to use is a command-line
program called Rclone that enables the actor to copy harvested data
to different cloud storage providers.

“Currently, we have not discovered substantial damage to these
victims as caused by the threat group,” Trend Micro’s analysts
explained. “However, we believe that it will continue collecting
internal information from the compromised victims and that it is
simply waiting for an opportunity to use this data.”

The findings are noteworthy because of the steps the advanced
persistent threat (APT) takes to avoid detection and the critical
nature of the targeted entities, not to mention the new
capabilities developed for their malicious software to linger on
infected hosts and avoid detection.

“The group can map their target’s network infrastructure and
bypass firewalls,” the researchers said. “It uses backdoors with
different protocols, which are deployed depending on the victim. It
also has the capability to develop customized tools to evade
security monitoring in different environments, and it exploits
vulnerable websites and uses them as [command-and-control] servers.”