“Tropic Trooper” Is Finding Ways to Hack Into Air-Gapped Military Systems

guest · May 14, 2020

“Tropic Trooper” Is Finding Ways to Hack Into Air-Gapped Military Systems
The hackers are engaging in cyber-espionage by dropping their malware payload on USB drives
May 14, 2020
https://www.technadu.com/tropic-trooper-finding-ways-hack-air-gapped-military-systems/101690/

Finding your way inside military networks and systems that are shielded from the outside world isn’t easy. That doesn’t stop threat actors from trying, though, and for the most sophisticated ones, trying equals succeeding.

According to a recent report from Trend Micro, the threat group known as “Tropic Trooper” is currently infiltrating the physically isolated networks of the Philippine and Taiwanese armies, as well as many government institutions, military hospitals, and national banks in these countries.
“Tropic Trooper” has been active since 2011, engaging in information theft and cyber-espionage, and they are continuously improving their methods and arsenal.

The main method of infiltration is through a USB malware called “USBferry,” of which the Trend Micro team sampled three different versions for analysis. This is another indication that the actors are actively working on the improvement of the malware. USBferry needs a USB pen drive to be connected on the target machine, as this is where it drops the payload to.
Click to expand...

The hackers are also using several backdoors that are hiding their routings through steganography to avoid detection from AV solutions. Other tools that are used by Tropic Trooper include a Command-line remote control listener/port relay utility, various backdoor execution loaders, port scanning tools, self-deletion tools, and more.

Finally, the researchers have noticed the use of invisible web shells that would make the realization of the infiltration very hard, if not impossible, while also hiding the C&C server location.
Click to expand...

Trend Micro: Tropic Trooper’s Back: USBferry Attack Targets Air-gapped Environments

The overview provided above highlights how putting critical information in physically isolated networks is not a bulletproof solution for defending against cyberespionage. Steganography isn’t just used to deliver encrypted payloads; it can also be used to transfer information to a C&C server.
Click to expand...

Log in or Sign up

“Tropic Trooper” Is Finding Ways to Hack Into Air-Gapped Military Systems

guest Guest

Log in or Sign up

“Tropic Trooper” Is Finding Ways to Hack Into Air-Gapped Military Systems

guest Guest

Useful Searches