{
  "name": "Tropic Trooper spies on government entities in the Middle East",
  "slug": "tropic-trooper-spies-on-government-entities-in-the-middle-east",
  "description": "Tropic Trooper, a Chinese-speaking APT group active since 2011, has expanded its operations to target government entities in the Middle East. The group deployed a new variant of the China Chopper web shell on a compromised Umbraco CMS server, along with other post-exploitation tools and backdoor implants. The attackers used DLL search-order hijacking to load malicious payloads, including a loader called Crowdoor. The campaign focused on cyber espionage, targeting systems related to human rights studies in the region. This marks a strategic shift for Tropic Trooper, previously known for targeting Southeast Asian countries.",
  "published": "2024-09-05T13:54:13+00:00",
  "created_at": "2024-09-05T13:54:13+00:00",
  "modified_at": "2024-09-05T14:17:35+00:00",
  "created_at_opencti": "2024-09-05T13:54:13+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2024-09-05",
    "bypassgodzilla",
    "china chopper",
    "crowdoor",
    "fscan",
    "neo-regeorg",
    "swor",
    "umbraco cms",
    "web shell"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "51.195.37.155"
      },
      {
        "id": "",
        "name": "162.19.135.182"
      },
      {
        "id": "",
        "name": "blog.techmersion.com"
      },
      {
        "id": "",
        "name": "techmersion.com"
      },
      {
        "id": "",
        "name": "9ba6c63e29b26174e52a519c1afe7a4401e65485fd6ce6a2d574d910dd1d8d22"
      },
      {
        "id": "",
        "name": "23dea3a74e3ff6a367754d02466db4c86ffda47efe09529d3aad52b0d5694b30"
      },
      {
        "id": "",
        "name": "8df9fa495892fc3d183917162746ef8fd9e438ff0d639264236db553b09629dc"
      }
    ],
    "malware": [
      {
        "id": "d98e2f14-8d09-4ad6-b23e-2174e4d616a8",
        "name": "China Chopper",
        "slug": "china-chopper"
      },
      {
        "id": "78c7f41e-bc94-4565-9ad0-d00095e0e6ee",
        "name": "ByPassGodzilla",
        "slug": "bypassgodzilla"
      },
      {
        "id": "8364927c-d815-4321-ad5a-40e07d917978",
        "name": "Neo-reGeorg",
        "slug": "neo-regeorg"
      },
      {
        "id": "74b8ed86-421a-48ba-8637-4882bddff16b",
        "name": "Swor",
        "slug": "swor"
      },
      {
        "id": "55b95ab2-967f-4ad6-92b1-d862f9238c27",
        "name": "Crowdoor",
        "slug": "crowdoor"
      }
    ],
    "intrusion_sets": [
      {
        "id": "467c2774-6fda-4f74-835b-faeae8100eee",
        "name": "Tropic Trooper",
        "slug": "tropic-trooper"
      }
    ],
    "attack_patterns": [
      {
        "id": "beaa4978-0309-438b-a45e-ec566b643811",
        "name": "T1505.003"
      },
      {
        "id": "2969e5a7-1049-4df8-b1ba-8a0675de6b94",
        "name": "T1589"
      },
      {
        "id": "b15c00da-c412-4429-900c-659de612baf5",
        "name": "T1543.003"
      },
      {
        "id": "6a146066-5a78-493c-a26a-133b62c1149e",
        "name": "T1588.002"
      },
      {
        "id": "6b2e0999-c7e8-4662-94ac-19aa8520ee46",
        "name": "T1059.003"
      },
      {
        "id": "32b33067-6566-4b8d-be80-e96f765d84de",
        "name": "T1059.001"
      },
      {
        "id": "5999052b-e9ae-49e8-9235-d9bf975c22af",
        "name": "T1547.001"
      },
      {
        "id": "2fca0274-42fc-483e-a1e3-d9c4ba687d2d",
        "name": "T1574.001"
      },
      {
        "id": "fc699aef-8931-4a79-8f79-9651be9abd50",
        "name": "T1021"
      },
      {
        "id": "dc17cbbd-40d8-43cf-b3cf-50d1276db2c7",
        "name": "T1016"
      },
      {
        "id": "70616b2f-4019-4963-b758-5d9f6f20e201",
        "name": "T1082"
      },
      {
        "id": "c473a756-355a-42ad-a0df-cd3a8fa006d1",
        "name": "T1057"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "45082a8e-9c79-470e-ad1b-decac7188e8f",
        "name": "T1083"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "7d7ac733-6442-416f-8669-c302dd0843b9",
        "name": "T1036"
      },
      {
        "id": "5b7c66d1-0466-4ba7-af6f-eb82c2f9d05b",
        "name": "T1033"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "d9b45b3b-d093-4016-89e9-48f31ff4d05d",
        "name": "T1566"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Malaysia"
      },
      {
        "id": "",
        "name": "Government"
      }
    ]
  },
  "external_refs": [
    "https://securelist.com/new-tropic-trooper-web-shell-infection/113737/",
    "https://otx.alienvault.com/pulse/66d9d425653bc60992e5539b"
  ]
}