TLDR Tech / InfoSec
Tropic Trooper APT Takes Aim at Home Routers, Japanese Targets
China-linked APT Tropic Trooper (aka Pirate Panda, KeyBoy, APT23) compromised a victim's home router to overwrite DNS settings and redirect a legitimate youdaodict.exe dictionary update to an attacker-controlled server in an “evil twin” supply chain attack, delivering a Cobalt Strike beacon bearing the group's signature watermark 520 via a trojanized .xml payload. Itochu and Zscaler ThreatLabz researchers decrypted five .dat payloads exposing fresh tooling, including DaveShell, Donut loader, Mythic-framework Merlin and Apollo Go RATs, and a custom Go backdoor dubbed C6DOOR, alongside an exposed S3 bucket hosting 48 files with Signal-impersonating phishing pages targeting Chinese-speaking individuals in Japan, Taiwan, and South Korea; a parallel Zscaler campaign observed a trojanized SumatraPDF binary deploying AdaptixC2 and VS Code. Defenders should audit SOHO router firmware and DNS configurations for unauthorized changes, ingest the Zscaler ThreatLabz IOC list, and hunt endpoint telemetry for Cobalt Strike beacons carrying watermark 520.
Read the full story