New Tropic Trooper Attack Uses Custom Beacon Listener and VS Code Tunnels for Remote Access

**Executive Summary:** Tropic Trooper (aka Earth Centaur / Pirate Panda) ran a multi-stage cyberespionage campaign targeting Chinese-speaking users in Taiwan and victims in South Korea and Japan by distributing a trojanized SumatraPDF that displays a legitimate lure while installing an AdaptixC2 beacon; the beacon used GitHub Issues and file uploads (encrypted with RC4) as a covert C2 channel and the adversary later abused VS Code tunnels for interactive remote access. Zscaler ThreatLabz attributed the activity, identified additional tools on staging servers (Cobalt Strike Beacon with watermark “520”, EntryShell), and recommended blocking unexpected GitHub API traffic, application allowlisting, auditing VS Code tunnels, monitoring scheduled task creation, and hunting for ipinfo.io usage.