Source: James Thew via Alamy Stock Photo

An investigation into a China-linked advanced persistent threat (APT) group known as Tropic Trooper has revealed an espionage campaign targeting government entities in the Middle East.

The effort has been ongoing since June 2023, but the group itself has been active since 2011 and has a history of targeting government, healthcare, transportation, and high-tech sectors in Taiwan, the Philippines, and Hong Kong.

Now, however, Tropic Trooper has switched up its focus, targeting government entities that specifically publish human rights studies in the Middle East related to the Israel-Hamas war. Researchers at Kaspersky discovered the onslaught in June, after finding a new China Chopper Web shell variant on a public Web server hosting Umbraco, an open source content management system. 

After further investigation, the researchers discovered multiple malware sets on the public server, including post-exploitation tools, Web shells, and DLL search-order hijacking implants. The attack chain was designed to ultimately deliver a malware implant known as Crowdoor, the researchers concluded.