<h1>Tropic Trooper Targets Middle Eastern Human Rights Studies Using Advanced Web Shells</h1>
<p>Tropic Trooper, a Chinese-speaking advanced persistent threat (APT) group active since 2011, has launched a sophisticated cyber campaign targeting government entities in the Middle East and Malaysia starting in June 2023. This latest operation represents the group’s strategic shift towards entities focused on human rights studies, particularly those analyzing the Israel-Hamas conflict.</p>
<h2>New Variant of China Chopper Web Shell</h2>
<p>The group employed a new version of the China Chopper web shell to exploit vulnerabilities in web applications, most notably the Umbraco Content Management System (CMS). This powerful and versatile tool allowed them to maintain persistent access to compromised servers and deploy additional malware such as Crowdoor. China’s Chopper web shell is known for its small size and capability to evade detection, making it a favored tool among cyber attackers.</p>
<h2>Deployment Techniques</h2>
<p>The attackers used DLL search-order hijacking to load malicious loaders and various post-exploitation tools. This tactic involves taking advantage of the way Windows searches for DLL files, loading the malicious versions instead of legitimate ones. DLL hijacking is a common technique used by threat actors to escalate privileges and execute arbitrary code.</p>
<h2>Persistent and Evolving Threat</h2>
<p>Tropic Trooper’s activities in 2024 highlight a persistent and evolving threat adept at adapting new tools and techniques to avoid detection. The group’s historical focus was primarily on sectors in East and Southeast Asia, but their recent shift towards Middle Eastern targets underscores their diverse strategic interests and sophisticated capabilities.</p>
<h2>Conclusion</h2>
<p>The recent cyber campaign by Tropic Trooper is a clear indication of the growing threats aimed at human rights-focused organizations in the Middle East. The usage of advanced web shells and sophisticated deployment techniques by this APT group illustrates a significant risk to governmental and non-governmental entities working on sensitive human rights issues.</p>
<p>Researchers and cybersecurity professionals must remain vigilant and enhance their security postures to detect and mitigate the evolving techniques employed by Tropic Trooper and similar threat actors.</p>


Collections

Tropic Trooper, an APT group active since 2011, has launched a cyber campaign targeting Middle Eastern government entities focused on human rights, particularly the Israel-Hamas conflict. They employed a new variant of the China Chopper web shell to exploit vulnerabilities in web applications like Umbraco CMS and used DLL search-order hijacking for persistence. This campaign highlights the evolving threat posed by Tropic Trooper and the sophistication of their techniques.