Unnamed government entities in the Middle East and Malaysia have become the focus of a persistent cyber campaign orchestrated by a threat actor known as Tropic Trooper since June 2023. This group, also referred to as APT23, Earth Centaur, KeyBoy, and Pirate Panda, has been active since 2011, primarily targeting government, healthcare, and high-tech industries across Taiwan, Hong Kong, and the Philippines.
According to Sherif Magdy, a Kaspersky security researcher, "Sighting this group's [Tactics, Techniques, and Procedures] in critical governmental entities in the Middle East, particularly those related to human rights studies, marks a new strategic move for them."
Discovery and New Tactics
Kaspersky first detected this activity in June 2024, discovering a new version of the China Chopper web shell on a public web server hosting the Umbraco content management system (CMS). The China Chopper web shell is a tool widely shared among Chinese-speaking threat actors for remotely accessing compromised servers.
The cyber attack chain utilized by Tropic Trooper is designed to deliver a malware implant named Crowdoor, a variant of the SparrowDoor backdoor, which was first documented by ESET in September 2021. Fortunately, the attack was ultimately unsuccessful.
Advanced Exploitation Techniques
What makes the latest intrusion significant is the use of the China Chopper web shell as a .NET module of Umbraco CMS, which enabled the hackers to exploit the system further. After establishing access, the attackers deployed tools for network scanning, lateral movement, and defense evasion before finally launching Crowdoor using DLL side-loading techniques.
It's suspected that the web shells were delivered by exploiting known vulnerabilities in public-facing web applications such as:
- Adobe ColdFusion (CVE-2023-26360)
- Microsoft Exchange Server (CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207)
Crowdoor also serves as a loader to drop Cobalt Strike and maintain persistence on the infected host. Its capabilities include harvesting sensitive information, launching reverse shells, erasing malware traces, and self-termination.
Human Rights and Middle East Focus
The campaign appears to focus on governmental entities involved in human rights studies, particularly around the Israel-Hamas conflict. "The entire system seemed to be the sole target during this attack, indicating a deliberate focus on this specific content," noted Magdy.
When the threat actor realized that their backdoors had been detected, they quickly uploaded newer malware samples in an attempt to evade detection. This raises concerns that updated versions of their malware may surface in the near future.
