Threat actor · all actors
Tropic TrooperG0081 state
🇨🇳 CN
aka Tropic Trooper, Pirate Panda, KeyBoy, APT23, BRONZE HOBART, G0081, Red Orthrus, Earth Centaur
Last updated: 2026-08-22
About this actor
[Tropic Trooper](https://attack.mitre.org/groups/G0081) is an unaffiliated threat group that has led targeted campaigns against targets in Taiwan, the Philippines, and Hong Kong. [Tropic Trooper](https://attack.mitre.org/groups/G0081) focuses on targeting government, healthcare, transportation, and high-tech industries and has been active since 2011.(Citation: TrendMicro Tropic Trooper Mar 2018)(Citation: Unit 42 Tropic Trooper Nov 2016)(Citation: TrendMicro Tropic Trooper May 2020)
Source: MITRE ATT&CK
Names & naming systems
Each vendor coins its own name for the same actor. Where a name follows a known scheme we attribute it; the rest are listed honestly as unclassified.
MITRE ATT&CKG-number catalogue id
CrowdStrikenation-animal names
Mandiant / genericAPT numbering
Secureworkscolour-metal names
Unclassifiedno scheme matched
How we know this
- Data origin
- MITRE ATT&CK Imported from the MITRE ATT&CK STIX bundle as an intrusion-set object.
- Techniques
- MITRE ATT&CK STIX mappings — 56 ATT&CK techniques on file.
- Named victims
- None on file.
See how actor data is built for the full pipeline.
Activity timeline
- 2026 — 1 CVE published
Profile
| CVE | Risk | CVSS | EPSS | Published | Products |
|---|---|---|---|---|---|
CVE-2026-20929 | 5.9 | 7.5 | 0.0116 | 2026-01-13 | see CVE |
T1016System Network Configuration Discovery ↗T1020Automated Exfiltration ↗T1027Obfuscated Files or Information ↗T1027.003Steganography ↗T1027.013Encrypted/Encoded File ↗T1033System Owner/User Discovery ↗T1036Masquerading ↗T1036.005Match Legitimate Resource Name or Location ↗T1046Network Service Discovery ↗T1049System Network Connections Discovery ↗T1052Exfiltration Over Physical Medium ↗T1052.001Exfiltration over USB ↗T1055Process Injection ↗T1055.001Dynamic-link Library Injection ↗T1057Process Discovery ↗T1059Command and Scripting Interpreter ↗T1059.003Windows Command Shell ↗T1070Indicator Removal ↗T1070.004File Deletion ↗T1071Application Layer Protocol ↗T1071.001Web Protocols ↗T1071.004DNS ↗T1078Valid Accounts ↗T1078.003Local Accounts ↗T1082System Information Discovery ↗T1083File and Directory Discovery ↗T1091Replication Through Removable Media ↗T1105Ingress Tool Transfer ↗T1106Native API ↗T1119Automated Collection ↗T1132Data Encoding ↗T1132.001Standard Encoding ↗T1135Network Share Discovery ↗T1140Deobfuscate/Decode Files or Information ↗T1203Exploitation for Client Execution ↗T1204User Execution ↗T1204.002Malicious File ↗T1221Template Injection ↗T1505Server Software Component ↗T1505.003Web Shell ↗T1518Software Discovery ↗T1518.001Security Software Discovery ↗T1543Create or Modify System Process ↗T1543.003Windows Service ↗T1547Boot or Logon Autostart Execution ↗T1547.001Registry Run Keys / Startup Folder ↗T1547.004Winlogon Helper DLL ↗T1564Hide Artifacts ↗T1564.001Hidden Files and Directories ↗T1566Phishing ↗T1566.001Spearphishing Attachment ↗T1573Encrypted Channel ↗T1573.002Asymmetric Cryptography ↗T1574Hijack Execution Flow ↗T1574.001DLL ↗T1680Local Storage Discovery ↗
Mitigating controls (NIST 800-53)
| Control | Techniques covered | Coverage |
|---|---|---|
SI-4 | 37 / 56 | 66% |
CM-6 | 34 / 56 | 61% |
CM-2 | 31 / 56 | 55% |
SI-3 | 31 / 56 | 55% |
CA-7 | 25 / 56 | 45% |
CM-7 | 23 / 56 | 41% |
AC-6 | 20 / 56 | 36% |
AC-3 | 19 / 56 | 34% |
SC-7 | 18 / 56 | 32% |
AC-2 | 16 / 56 | 29% |
SI-7 | 16 / 56 | 29% |
AC-4 | 15 / 56 | 27% |
RA-5 | 13 / 56 | 23% |
SI-2 | 12 / 56 | 21% |
AC-5 | 11 / 56 | 20% |
Co-occurring actors
- Ajax Security Team 1 shared CVEs
- APT29 1 shared CVEs
- APT38 1 shared CVEs
- Sandworm Team 1 shared CVEs
- Tonto Team 1 shared CVEs
- GOLD SOUTHFIELD 1 shared CVEs
- Scattered Spider 1 shared CVEs
- OilRig 1 shared CVEs
- Indrik Spider 1 shared CVEs
- Mustang Panda 1 shared CVEs
Similar actors
Similar TTPs
- Sidewinder 0.36
- Darkhotel 0.34
- APT19 0.33
- Higaisa 0.33
- Frankenstein 0.32
Active in same years
- Operation Dream Job 1.00
- SolarWinds Compromise 1.00
- C0027 1.00
- SharePoint ToolShell Exploitation 1.00
- Ke3chang 1.00
Same nation-state
- Night Dragon 1.00
- FunnyDream 1.00
- Operation Wocao 1.00
- C0017 1.00
- Cutting Edge 1.00
Same category
- Night Dragon 1.00
- FunnyDream 1.00
- C0011 1.00
- Operation Wocao 1.00
- Operation Dream Job 1.00