Skip to navigation

Threat reportMalwareTL-2026-2427

Tropic Trooper Spear-Phishing Campaign Uses LNK Loader, DLL Side-Loading via Signed McAfee Binary, and Cobalt Strike Against Chinese Housing-Fund-Themed Targets

highACTIVE

ITOCHU Cyber & Intelligence researchers documented a spear-phishing campaign impersonating a Chinese company housing-fund benefit notice that delivers a ZIP archive containing a disguised .lnk shortcut, a hidden payload folder, and a legitimate signed McAfee executable (NTUSER.EXE) abused for DLL side-loading of a malicious loader (McVsoCfg.dll) that decrypts and launches an embedded Cobalt Strike Beacon (setting.dat) calling back to 38.54.40.178:2433.

Key facts for Tropic Trooper McAfee DLL side-load

IdentifiersTL-2026-2427
SeverityHIGH
Exploitation statusExploited in the wild
Affected productsMicrosoft Windows (Explorer/LNK handling on user endpoints); McAfee NTUSER.EXE (legitimate signed component abused as a DLL side-loading host; not itself vulnerable)
AttributionTropic Trooper - G0081 (high confidence)
MalwareCobalt Strike, Cobalt Strike Beacon, CrowDoor, EntryShell, KeyBoy, Xiangoop Loader
ToolsCobalt Strike
MITRE ATT&CK techniquesT1027.009 Embedded Payloads, T1036.005 Match Legitimate Resource Name or Location, T1036.008 Masquerade File Type, T1071 Application Layer Protocol, T1140 Deobfuscate/Decode Files or Information, T1204.002 Malicious File, T1564.001 Hidden Files and Directories, T1566.001 Spearphishing Attachment, T1571 Non-Standard Port, T1574.001 DLL, T1574.002 Hijack Execution Flow, T1620 Reflective Code Loading
MotivationESPIONAGE
Target sectorscorporate hr-themed targets, semi-conductors, manufacturing, high tech
Target regionschina, East Asia
Detection rules9 (1 shown free)
Sources8 cited sources

Detection coverage for Tropic Trooper McAfee DLL side-load

As of 2026-10-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2427 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: LNK Disguised as XLSX Launches NTUSER.EXE from Hidden &Recycle.Bin Folder

Detects execution of the Tropic Trooper housing-fund lure chain: a '.lnk' shortcut masquerading as a '.xlsx' workbook (double-extension trick, Windows suppresses '.lnk') spawns a process from a hidden '&Recycle.Bin'-named folder inside the delivered ZIP, invoking the legitimate signed McAfee NTUSER.EXE binary as the entry point for DLL side-loading.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1566.001, T1204.002, T1036.008, T1036.005
  • Data sources: sysmon, windows_security, microsoft_defender_for_endpoint
  • Severity: high
  • Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval cmdline_lower=lower(CommandLine), image_lower=lower(Image), parent_lower=lower(ParentImage)
| where match(parent_lower, "explorer\.exe$")
| where match(image_lower, "\\\\&recycle\.bin\\\\") OR match(cmdline_lower, "\\\\&recycle\.bin\\\\")
| where match(image_lower, "ntuser\.exe$") OR match(cmdline_lower, "ntuser\.exe")
| eval file_sha256=lower(coalesce(Hashes,""))
| eval known_bad=if(match(file_sha256, "95a3850ef6f727ce84aff3295e8f05c8e47856390d8b0091f60fc705b675b719|563d732c54221fcdd5625bfceaefbe10937c6c62823b4a6ceca5f7ed6c81d890"), "confirmed_ioc", "behavioral_match")
| table _time, ComputerName, User, ParentImage, Image, CommandLine, file_sha256, known_bad
| sort -_time

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "explorer.exe"
| where FolderPath has @"\&Recycle.Bin\" or ProcessCommandLine has @"\&Recycle.Bin\"
| where FileName =~ "NTUSER.EXE" or ProcessCommandLine has "NTUSER.EXE"
| extend KnownBad = iff(SHA256 in ("95a3850ef6f727ce84aff3295e8f05c8e47856390d8b0091f60fc705b675b719","563d732c54221fcdd5625bfceaefbe10937c6c62823b4a6ceca5f7ed6c81d890"), "confirmed_ioc", "behavioral_match")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FolderPath, FileName, ProcessCommandLine, SHA256, KnownBad
| order by Timestamp desc

Sigma

title: LNK Disguised as XLSX Launches NTUSER.EXE from Hidden Recycle.Bin Folder
id: 5e2a8f0e-1c3a-4a7d-9e5b-2f6c1a9b7d31
status: experimental
description: Detects the Tropic Trooper housing-fund lure chain where a double-extension '.xlsx.lnk' shortcut spawns a process from a hidden '&Recycle.Bin'-named folder, launching the legitimate signed McAfee NTUSER.EXE binary as a DLL side-loading entry point.
references:
    - https://blog-en.itochuci.co.jp/entry/2023/09/28/171001
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-10
tags:
    - attack.initial-access
    - attack.t1566.001
    - attack.execution
    - attack.t1204.002
    - attack.defense-evasion
    - attack.t1036.008
    - attack.t1036.005
    - attack.g0081
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\explorer.exe'
    selection_hidden_folder:
        Image|contains: '\&Recycle.Bin\'
    selection_ntuser:
        Image|endswith: '\NTUSER.EXE'
    condition: selection_parent and selection_hidden_folder and selection_ntuser
falsepositives:
    - Legitimate McAfee installations that stage files through a similarly-named directory (rare; McAfee does not normally use a '&Recycle.Bin'-prefixed staging path)
level: high

Known false positives:

  • Legitimate McAfee agent repair/reinstall tooling staging through an unusually-named directory (rare)
  • Security researchers detonating the known sample in a sandbox

Tuning notes: Tune the hidden-folder match against your environment's normal user-profile paths; extend the hash allowlist as new campaign samples are recovered; correlate with the delivering ZIP hash (md5 477064c3182a8eec3c048fb76d939ca4 / sha256 89a71c796b86aec5f12e48524e044d427629438b4e573e4c9d7353b08eb0d7de) via email-gateway logs before paging on-call.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Housing-Fund Themed ZIP Attachment Delivering Double-Extension LNK Lure · unlock with TL Creds
  • [indicator] XOR-Encrypted Cobalt Strike Payload Staged in Public Downloads · unlock with TL Creds
  • Beaconing Pattern to Non-Standard High Port Consistent with Cobalt Strike Sleep/Jitter Profile · unlock with TL Creds
  • Explorer-Spawned Process from Double-Extension .xlsx.lnk Shortcut · unlock with TL Creds
  • Security-Vendor-Named Binary Loads Unsigned DLL from User-Writable Path · unlock with TL Creds
  • Application-Layer Traffic over Non-Standard TCP Port 2433 (Cobalt Strike Beacon Indicator) · unlock with TL Creds
  • DLL Side-Loading of [indicator] via Renamed McAfee [indicator] ([indicator]) · unlock with TL Creds
  • Cobalt Strike Beacon Callback to Confirmed and Community-Corroborated C2 on Non-Standard Ports · unlock with TL Creds

Indicators of compromise for Tropic Trooper McAfee DLL side-load

As of 2026-10-30, Threadlinqs Intelligence tracks 30 indicators of compromise for TL-2026-2427.

Sample indicators (3 of 30)

  • IP address: 38.54.40[.]178
  • File hash: 477064c3182a8eec3c048fb76d939ca4
  • File hash: 89a71c796b86aec5f12e48524e044d427629438b4e573e4c9d7353b08eb0d7de

Defanged, TLP:CLEAR. Full set of 30 indicators: unlock with TL Creds.

30 indicators of compromise · unlock with TL Creds. Compare plans

How Tropic Trooper McAfee DLL side-load works

Researchers assess with high confidence the activity is attributable to Tropic Trooper (aka Pirate Panda, KeyBoy) based on the EntryShell payload's KeyBoy-lineage code artifacts documented in a companion campaign wave.

In September 2023, ITOCHU Cyber & Intelligence Inc. researchers published analysis of a targeted spear-phishing campaign against a Chinese company, disguised as a notice about the mandatory monthly housing provident fund (住房公积金) contribution rate. The lure email delivered a ZIP archive containing a shortcut file named to resemble an Excel workbook ('...xlsx.lnk') and a hidden folder named '&Recycle.Bin' to mimic the Windows Recycle Bin. Because Windows suppresses the '.lnk' extension even when 'show file extensions' is enabled, the victim sees only the fake '.xlsx' name. Opening the shortcut launches the legitimate, digitally signed McAfee binary NTUSER.EXE from the hidden folder while displaying a decoy spreadsheet (gongjijin.xlsx) to the user.

NTUSER.EXE is abused for DLL side-loading: it loads a co-located malicious DLL, McVsoCfg.dll, whose exported McVsoCfgGetObject function contains the malicious loader logic. The installer stage copies all three files (renamed NTUSER.EXE, the DLL, and the encrypted payload) to C:\Users\Public\Downloads\, renaming NTUSER.EXE to Avira.exe to masquerade as antivirus software. The loader then reads and XOR-decrypts (single-byte key 0x2E) the payload file setting.dat, producing a PE image with shellcode embedded in its MZ header to complicate static and dynamic analysis. The decrypted payload is a Cobalt Strike Beacon that calls back to 38.54.40.178 on TCP port 2433 -- a non-standard port for that address. The researchers found no persistence mechanism in the sample; the chain does not survive a reboot, which they assess as either an operational oversight or an indication the operators plan re-deployment via other means.

A companion attribution post by the same researchers (published one week later) ties this activity to Tropic Trooper by way of a parallel malware family, EntryShell, documented in the same May-October 2023 campaign wave against semiconductor and rare-metal-industry targets in East Asia. EntryShell is assessed as an evolved, fileless variant of the KeyBoy backdoor: it shares distinctive error-message strings matched by a 2016 KeyBoy YARA rule, and encrypts identifiable strings with AES-ECB under the hardcoded key 'afkngaikfaf' specifically to evade security products. Because KeyBoy has no reported use by any actor other than Tropic Trooper, the researchers treat EntryShell/KeyBoy lineage as an actor-specific fingerprint and extend that attribution to the housing-fund campaign on shared loader (Xiangoop Loader family), payload staging, and methodology. The same investigation also recovered a third-stage RAT, CrowDoor -- a variant of the SparrowDoor backdoor associated with the China-aligned group FamousSparrow -- leading the researchers to assess that Tropic Trooper and FamousSparrow are either the same group or operate in close coordination.

A separate, independently published cluster of reporting (EclecticIQ, and picked up by GBHackers) documented an overlapping but distinct campaign in the same Sept-Oct 2023 window: a TSMC-themed lure against semiconductor-industry targets in Taiwan, Hong Kong, and Singapore, using the identical DLL side-loading tradecraft (a signed McAfee binary, mcods.exe, side-loading a Cobalt Strike loader named mcvsocfg.dll) staged from a compromised Cobra DocGuard server, but with different C2 infrastructure (38.54.119.239:443, 45.77.37.145:8443) and an unnamed PRC-nexus attribution (noted overlaps with Carderbee/APT27-linked infrastructure). This indicates the McAfee-binary DLL side-loading technique for staging Cobalt Strike is shared tradecraft reused by multiple China-nexus clusters in this period, not unique to the housing-fund incident's infrastructure -- a nuance relevant to confidence in infrastructure-based attribution, though the ITOCHU researchers' code-lineage-based attribution (KeyBoy string/crypto fingerprints) is independent of this shared-loader observation.

MITRE ATT&CK Group G0081 (Tropic Trooper, aka Pirate Panda, KeyBoy) has been tracked since at least 2011, historically targeting government, healthcare, transportation, and high-tech organizations in Taiwan, the Philippines, and Hong Kong; this campaign's targeting of a mainland Chinese company via a China-specific HR benefit lure, and the sequel article's semiconductor/rare-metal sector focus, reflect the actor's continued expansion into Chinese-language, high-tech-adjacent targets.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027.009 Embedded Payloads; T1036.005 Match Legitimate Resource Name or Location; T1036.008 Masquerade File Type; T1140 Deobfuscate/Decode Files or Information; T1564.001 Hidden Files and Directories; T1574.001 DLL; T1574.002 Hijack Execution Flow; T1620 Reflective Code Loading

Command and Control

T1071 Application Layer Protocol; T1571 Non-Standard Port

Execution

T1204.002 Malicious File

Initial Access

T1566.001 Spearphishing Attachment

Remediation for Tropic Trooper McAfee DLL side-load

Immediate actions

  • Block/monitor network egress to 38.54.40.178:2433 at perimeter firewalls, proxies, and DNS/network sensors.
  • Hunt endpoints for NTUSER.EXE, McVsoCfg.dll, and setting.dat located outside legitimate McAfee installation paths, especially under C:\Users\Public\Downloads\ or renamed to Avira.exe.
  • Search mail gateways and attachment sandboxes for ZIP archives containing .lnk files disguised as .xlsx documents, particularly those referencing housing-fund/公积金 benefit themes or containing a hidden '&Recycle.Bin'-named folder.
  • Block/alert on the confirmed file hashes (ZIP, LNK, decoy XLSX, McVsoCfg.dll, NTUSER.EXE, setting.dat) across EDR and email security gateways.

Workarounds

  • Configure mail gateways to strip or sandbox-detonate LNK files inside ZIP/archive attachments before delivery.
  • Enable Windows Explorer/GPO settings that always display full file extensions and flag double-extension filenames (e.g., '.xlsx.lnk').

Longer-term hardening

  • Deploy DLL side-loading detection (unsigned/mismatched-origin DLLs loaded by signed third-party AV/security binaries) in EDR.
  • Enforce attack surface reduction (ASR) rules blocking execution of executable content extracted from archives/email attachments, and restrict LNK execution from user-writable download directories.
  • Apply application allowlisting to prevent execution of vendor security-product binaries (e.g., McAfee NTUSER.EXE) from non-standard, user-writable install locations.
  • Monitor outbound beaconing to non-standard high-numbered TCP ports as a Cobalt Strike Beacon indicator, independent of destination reputation.

Affected and fixed versions

  • Microsoft — Windows (Explorer/LNK handling on user endpoints)
    Vulnerable versions: All Windows versions that suppress the .lnk extension by default in Explorer
  • McAfee — NTUSER.EXE (legitimate signed component abused as a DLL side-loading host; not itself vulnerable)

Timeline of Tropic Trooper McAfee DLL side-load

Last updated · revalidated 1× · latest source

  • locked-ioc-19 (MITRE ATT&CK Group G0081, aka Pirate Panda, KeyBoy) assessed by MITRE as active since at least 2011, historically targeting government, healthcare, transportation, and high-tech organizations in Taiwan, the Philippines, and Hong Kong.
  • A YARA rule capturing distinctive KeyBoy backdoor error-message strings is published; ITOCHU researchers later match these same strings in the locked-ioc-26 payload documented alongside this campaign, anchoring the KeyBoy/locked-ioc-19 attribution.
  • Per the VB2023 research timeline, the earliest locked-ioc-18 variant (variant A) appears (month-level date).
  • Per the VB2023 research timeline, locked-ioc-18 variant AJ appears (month-level date).
  • ITOCHU researchers assess related locked-ioc-19 activity begins, targeting semiconductor and rare-metal-industry organizations with the locked-ioc-18 family delivering locked-ioc-26 and locked-ioc-17 payloads -- the same loader/staging methodology used in the housing-fund campaign.
  • ITOCHU Cyber & Intelligence Inc. publishes the original Japanese-language analysis of the housing-fund-themed spear-phishing campaign.
  • English translation published, publicly documenting the ZIP/LNK delivery chain, locked-ioc-27/locked-ioc-24 DLL side-loading, and the locked-ioc-17 callback to locked-ioc-22:2433.
  • Virus Bulletin VB2023 conference (London) hosts the presentation 'Unveiling activities of locked-ioc-19 2023: deep analysis of locked-ioc-18 and locked-ioc-26 payload,' covering the broader campaign wave including locked-ioc-29.
  • EclecticIQ publishes a separate report on an overlapping but distinct PRC-nexus campaign reusing the same signed-McAfee-binary DLL side-loading technique (mcods.exe/locked-ioc-24) to stage locked-ioc-21 against semiconductor-industry targets in Taiwan, Hong Kong, and Singapore, with different C2 infrastructure.
  • ITOCHU publishes a follow-up attribution analysis tying the campaign to locked-ioc-19 via KeyBoy/locked-ioc-26 code lineage, and assessing operational overlap between locked-ioc-19 and the China-aligned FamousSparrow group via the shared locked-ioc-29/SparrowDoor malware family.
  • GBHackers reports on the parallel PRC-backed locked-ioc-21 campaign against semiconductor industries using the same signed McAfee binary DLL side-loading tradecraft, corroborating technique reuse across China-nexus clusters in this period.

Update history

Sources cited for Tropic Trooper McAfee DLL side-load

Drafted by the Threadlinqs research pipeline from 8 sources; published ; last updated .

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats