Tropic Trooper Pivots to AdaptixC2 and Custom Beacon Listener
ID: 638846d3-5836-53f0-b837-8ce831dc9c1f
STIX ID: report--638846d3-5836-53f0-b837-8ce831dc9c1f
Feed Name: Security Boulevard
Threat Score
On 2026-03-12 Zscaler ThreatLabz analyzed a targeted Tropic Trooper campaign that delivered a trojanized SumatraPDF (TOSHIS loader) to fetch and execute an AdaptixC2 Beacon (decrypted in-memory) which used a custom GitHub-based listener for C2 and facilitated follow-on access via VS Code tunnels; the report includes a full attack-chain breakdown, extracted configuration and IOCs (hashes, IPs, URLs, GitHub repo), MITRE mappings, and rationale for attribution to Tropic Trooper.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.