File · APT23 · Unknown · assessed origin China · misp-galaxy + mitre-attack · refreshed 2026-10-06

APT23

PIRATE PANDA
KeyBoy
Tropic Trooper
BRONZE HOBART
G0081
Red Orthrus
Earth Centaur
Pirate Panda

MITRE G0081 ↗

attack rose · 40 techniques across 9 tactics

What changed

ledger · newest first

—todaynew CVE3 new CVEs: CVE-2012-0158, CVE-2017-11882, CVE-2018-0802

Analyst brief

misp-galaxy + mitre-attack

TrendMicro described Tropic Trooper in a 2015 report as: 'Taiwan and the Philippines have become the targets of an ongoing campaign called Operation TropicTrooper. Active since 2012, the attackers behind the campaign haveset their sights on the Taiwanese government as well as a number of companies in the heavy industry. The same campaign has also targeted key Philippine military agencies.'

Observed targets (as stated by the sources)

0 countries · 2 sectors

assessed origin · Chinaobserved targets · 0

sectors · 2

Military
Government, Administration

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

40 techniques · 9 of 15 tactics

Matters for

Initial access
1 technique
Execution
4 techniques
Persistence
4 techniques
Stealth
10 techniques
Discovery
11 techniques
Lateral movement
1 technique
Collection
1 technique
Command and control
6 techniques
Exfiltration
2 techniques

select a technique

Arsenal

5 malware · 1 tools

Malware
Malware · 5	ATT&CK	Shared by
USBferry	S0452 ↗
ShadowPad	S0596 ↗	5 actors
PoisonIvy	S0012 ↗	12 actors
YAHOYAH	S0388 ↗
KeyBoy	S0387 ↗

Tools
Tools · 1	ATT&CK	Shared by
BITSAdmin	S0190 ↗	9 actors

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs cited sources tie to APT23

none on KEV

CVE-2012-01582026-10-17
1. “The documents attached to spear-phishing e-mails used in both attacks contain code that exploits CVE-2012-0158 , which despite its age remains one of the most common Microsoft Word vulnerabilities being exploited by multiple threat actors. This matches with known Tactics, Techniques, and Procedures (TTPs) for Tropic Trooper”
  cited as used in a campaign · source: researchcenter.paloaltonetworks.com ↗ · 2026-10-17
2. “The documents attached to spear-phishing e-mails used in both attacks contain code that exploits CVE-2012-0158 , which despite its age remains one of the most common Microsoft Word vulnerabilities being exploited by multiple threat actors. This matches with known Tactics, Techniques, and Procedures (TTPs) for Tropic Trooper”
  cited as exploiting · source: researchcenter.paloaltonetworks.com ↗ · 2026-10-17
3. “Tropic Trooper has executed commands through Microsoft security vulnerabilities, including CVE-2017-11882, CVE-2018-0802, and CVE-2012-0158.”
  cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17
4. “The documents attached to spear-phishing e-mails used in both attacks contain code that exploits CVE-2012-0158 , which despite its age remains one of the most common Microsoft Word vulnerabilities being exploited by multiple threat actors. This matches with known Tactics, Techniques, and Procedures (TTPs) for Tropic Trooper”
  cited as exploiting · source: unit42.paloaltonetworks.com ↗ · 2026-10-17
CVE-2017-118822026-10-17
1. “Here’s a summary of the attack chain of Tropic Trooper’s recent campaigns: Execute a command through exploits for CVE-2017-11882 or CVE-2018-0802 , security flaws in Microsoft Office’s Equation Editor (EQNEDT32.EXE).”
  cited as exploiting · source: blog.trendmicro.com ↗ · 2026-10-17
2. “Tropic Trooper has executed commands through Microsoft security vulnerabilities, including CVE-2017-11882, CVE-2018-0802, and CVE-2012-0158.”
  cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17
CVE-2018-08022026-10-17
1. “Here’s a summary of the attack chain of Tropic Trooper’s recent campaigns: Execute a command through exploits for CVE-2017-11882 or CVE-2018-0802 , security flaws in Microsoft Office’s Equation Editor (EQNEDT32.EXE).”
  cited as exploiting · source: blog.trendmicro.com ↗ · 2026-10-17
2. “Tropic Trooper has executed commands through Microsoft security vulnerabilities, including CVE-2017-11882, CVE-2018-0802, and CVE-2012-0158.”
  cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Primary-source reports

via APTnotes · linked, never re-hosted

Take it with you

keyless · no signup

References

17 sources

Track APT23 on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on Telegram KEV RSS API

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.

What changed

Analyst brief

Observed targets (as stated by the sources)

Kill chain

Initial access

Execution

Persistence

Stealth

Discovery

Lateral movement

Collection

Command and control

Exfiltration