Tropic Trooper Deploys Custom Beacon and VS Code Tunnels in Fresh APT Assault
ID: 7b44c773-f86d-5bbc-98df-1c85a709d585
STIX ID: report--7b44c773-f86d-5bbc-98df-1c85a709d585
Feed Name: Cyber Press
Threat Score
Tropic Trooper conducted a targeted campaign beginning March 12, 2026, using a trojanized SumatraPDF delivered in ZIP archives to load a shellcode loader that ran an AdaptixC2 Beacon in memory; attackers used a custom GitHub-based C2 listener and VS Code tunnels to blend in with developer activity and maintain stealth while performing reconnaissance and remote access on hosts in Taiwan, South Korea, and Japan.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.