Tropic Trooper Spear-Phishing Campaign Uses LNK Loader, DLL Side-Loading via Signed McAfee Binary, and Cobalt Strike Against Chinese Housing-Fund-Themed Targets
Tropic Trooper Spear-Phishing Campaign Uses LNK Loader, DLL (TL-2026-2427) is a high-severity malware campaign, first published 2026-09-10. It is attributed to Tropic Trooper - G0081 with high confidence, affects Microsoft Windows (Explorer/LNK handling on user endpoints), maps to 10 MITRE ATT&CK techniques (T1027.009, T1036.005, T1036.008), and is covered by 9 detection rules and 20 indicators of compromise.
Key facts for TL-2026-2427
- Threat ID
- TL-2026-2427
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-09-10
- Last reviewed
- 2026-09-10
- Attribution
- Tropic Trooper - G0081
- Attribution confidence
- HIGH
- Motivation
- ESPIONAGE
- Target sectors
- corporate hr-themed targets, semi-conductors, manufacturing, high tech
- Target regions
- china, East Asia
- Detection rules
- 9
- Indicators of compromise
- 20
Malware and tooling in Tropic Trooper Spear-Phishing Campaign Uses LNK Loader, DLL
Malware and tooling: Cobalt Strike, Cobalt Strike Beacon, CrowDoor, EntryShell, KeyBoy, Xiangoop Loader, Cobalt Strike
ITOCHU Cyber & Intelligence researchers documented a spear-phishing campaign impersonating a Chinese company housing-fund benefit notice that delivers a ZIP archive containing a disguised .lnk shortcut, a hidden payload folder, and a legitimate signed McAfee executable (NTUSER.EXE) abused for DLL side-loading of a malicious loader (McVsoCfg.dll) that decrypts and launches an embedded Cobalt Strike Beacon (setting.dat) calling back to 38.54.40.178:2433. Researchers assess with high confidence the activity is attributable to Tropic Trooper (aka Pirate Panda, KeyBoy) based on the EntryShell payload's KeyBoy-lineage code artifacts documented in a companion campaign wave.
How Tropic Trooper Spear-Phishing Campaign Uses LNK Loader, DLL works
In September 2023, ITOCHU Cyber & Intelligence Inc. researchers published analysis of a targeted spear-phishing campaign against a Chinese company, disguised as a notice about the mandatory monthly housing provident fund (住房公积金) contribution rate. The lure email delivered a ZIP archive containing a shortcut file named to resemble an Excel workbook ('...xlsx.lnk') and a hidden folder named '&Recycle.Bin' to mimic the Windows Recycle Bin. Because Windows suppresses the '.lnk' extension even when 'show file extensions' is enabled, the victim sees only the fake '.xlsx' name. Opening the shortcut launches the legitimate, digitally signed McAfee binary NTUSER.EXE from the hidden folder while displaying a decoy spreadsheet (gongjijin.xlsx) to the user.
NTUSER.EXE is abused for DLL side-loading: it loads a co-located malicious DLL, McVsoCfg.dll, whose exported McVsoCfgGetObject function contains the malicious loader logic. The installer stage copies all three files (renamed NTUSER.EXE, the DLL, and the encrypted payload) to C:\Users\Public\Downloads\, renaming NTUSER.EXE to Avira.exe to masquerade as antivirus software. The loader then reads and XOR-decrypts (single-byte key 0x2E) the payload file setting.dat, producing a PE image with shellcode embedded in its MZ header to complicate static and dynamic analysis. The decrypted payload is a Cobalt Strike Beacon that calls back to 38.54.40.178 on TCP port 2433 -- a non-standard port for that address. The researchers found no persistence mechanism in the sample; the chain does not survive a reboot, which they assess as either an operational oversight or an indication the operators plan re-deployment via other means.
A companion attribution post by the same researchers (published one week later) ties this activity to Tropic Trooper by way of a parallel malware family, EntryShell, documented in the same May-October 2023 campaign wave against semiconductor and rare-metal-industry targets in East Asia. EntryShell is assessed as an evolved, fileless variant of the KeyBoy backdoor: it shares distinctive error-message strings matched by a 2016 KeyBoy YARA rule, and encrypts identifiable strings with AES-ECB under the hardcoded key 'afkngaikfaf' specifically to evade security products. Because KeyBoy has no reported use by any actor other than Tropic Trooper, the researchers treat EntryShell/KeyBoy lineage as an actor-specific fingerprint and extend that attribution to the housing-fund campaign on shared loader (Xiangoop Loader family), payload staging, and methodology. The same investigation also recovered a third-stage RAT, CrowDoor -- a variant of the SparrowDoor backdoor associated with the China-aligned group FamousSparrow -- leading the researchers to assess that Tropic Trooper and FamousSparrow are either the same group or operate in close coordination.
A separate, independently published cluster of reporting (EclecticIQ, and picked up by GBHackers) documented an overlapping but distinct campaign in the same Sept-Oct 2023 window: a TSMC-themed lure against semiconductor-industry targets in Taiwan, Hong Kong, and Singapore, using the identical DLL side-loading tradecraft (a signed McAfee binary, mcods.exe, side-loading a Cobalt Strike loader named mcvsocfg.dll) staged from a compromised Cobra DocGuard server, but with different C2 infrastructure (38.54.119.239:443, 45.77.37.145:8443) and an unnamed PRC-nexus attribution (noted overlaps with Carderbee/APT27-linked infrastructure). This indicates the McAfee-binary DLL side-loading technique for staging Cobalt Strike is shared tradecraft reused by multiple China-nexus clusters in this period, not unique to the housing-fund incident's infrastructure -- a nuance relevant to confidence in infrastructure-based attribution, though the ITOCHU researchers' code-lineage-based attribution (KeyBoy string/crypto fingerprints) is independent of this shared-loader observation.
MITRE ATT&CK Group G0081 (Tropic Trooper, aka Pirate Panda, KeyBoy) has been tracked since at least 2011, historically targeting government, healthcare, transportation, and high-tech organizations in Taiwan, the Philippines, and Hong Kong; this campaign's targeting of a mainland Chinese company via a China-specific HR benefit lure, and the sequel article's semiconductor/rare-metal sector focus, reflect the actor's continued expansion into Chinese-language, high-tech-adjacent targets.
MITRE ATT&CK techniques used in TL-2026-2427
Defense Evasion
T1027.009 Embedded Payloads; T1036.005 Match Legitimate Resource Name or Location; T1036.008 Masquerade File Type; T1140 Deobfuscate/Decode Files or Information; T1564.001 Hidden Files and Directories; T1574.001 DLL
Command and Control
T1071 Application Layer Protocol; T1571 Non-Standard Port
Execution
Initial Access
Affected products and versions in Tropic Trooper Spear-Phishing Campaign Uses LNK Loader, DLL
- Microsoft — Windows (Explorer/LNK handling on user endpoints)
Vulnerable versions: All Windows versions that suppress the .lnk extension by default in Explorer - McAfee — NTUSER.EXE (legitimate signed component abused as a DLL side-loading host; not itself vulnerable)
Remediation for Tropic Trooper Spear-Phishing Campaign Uses LNK Loader, DLL
Immediate actions
- Block/monitor network egress to 38.54.40.178:2433 at perimeter firewalls, proxies, and DNS/network sensors.
- Hunt endpoints for NTUSER.EXE, McVsoCfg.dll, and setting.dat located outside legitimate McAfee installation paths, especially under C:\Users\Public\Downloads\ or renamed to Avira.exe.
- Search mail gateways and attachment sandboxes for ZIP archives containing .lnk files disguised as .xlsx documents, particularly those referencing housing-fund/公积金 benefit themes or containing a hidden '&Recycle.Bin'-named folder.
- Block/alert on the confirmed file hashes (ZIP, LNK, decoy XLSX, McVsoCfg.dll, NTUSER.EXE, setting.dat) across EDR and email security gateways.
Workarounds
- Configure mail gateways to strip or sandbox-detonate LNK files inside ZIP/archive attachments before delivery.
- Enable Windows Explorer/GPO settings that always display full file extensions and flag double-extension filenames (e.g., '.xlsx.lnk').
Longer-term hardening
- Deploy DLL side-loading detection (unsigned/mismatched-origin DLLs loaded by signed third-party AV/security binaries) in EDR.
- Enforce attack surface reduction (ASR) rules blocking execution of executable content extracted from archives/email attachments, and restrict LNK execution from user-writable download directories.
- Apply application allowlisting to prevent execution of vendor security-product binaries (e.g., McAfee NTUSER.EXE) from non-standard, user-writable install locations.
- Monitor outbound beaconing to non-standard high-numbered TCP ports as a Cobalt Strike Beacon indicator, independent of destination reputation.
Timeline of Tropic Trooper Spear-Phishing Campaign Uses LNK Loader, DLL
- Tropic Trooper (MITRE ATT&CK Group G0081, aka Pirate Panda, KeyBoy) assessed by MITRE as active since at least 2011, historically targeting government, healthcare, transportation, and high-tech organizations in Taiwan, the Philippines, and Hong Kong.
- A YARA rule capturing distinctive KeyBoy backdoor error-message strings is published; ITOCHU researchers later match these same strings in the EntryShell payload documented alongside this campaign, anchoring the KeyBoy/Tropic Trooper attribution.
- ITOCHU researchers assess related Tropic Trooper activity begins, targeting semiconductor and rare-metal-industry organizations with the Xiangoop Loader family delivering EntryShell and Cobalt Strike Beacon payloads -- the same loader/staging methodology used in the housing-fund campaign.
- ITOCHU Cyber & Intelligence Inc. publishes the original Japanese-language analysis of the housing-fund-themed spear-phishing campaign.
- English translation published, publicly documenting the ZIP/LNK delivery chain, NTUSER.EXE/McVsoCfg.dll DLL side-loading, and the Cobalt Strike Beacon callback to 38.54.40.178:2433.
- Virus Bulletin VB2023 conference (London) hosts the presentation 'Unveiling activities of Tropic Trooper 2023: deep analysis of Xiangoop Loader and EntryShell payload,' covering the broader campaign wave including CrowDoor.
- EclecticIQ publishes a separate report on an overlapping but distinct PRC-nexus campaign reusing the same signed-McAfee-binary DLL side-loading technique (mcods.exe/mcvsocfg.dll) to stage Cobalt Strike against semiconductor-industry targets in Taiwan, Hong Kong, and Singapore, with different C2 infrastructure.
- ITOCHU publishes a follow-up attribution analysis tying the campaign to Tropic Trooper via KeyBoy/EntryShell code lineage, and assessing operational overlap between Tropic Trooper and the China-aligned FamousSparrow group via the shared CrowDoor/SparrowDoor malware family.
- GBHackers reports on the parallel PRC-backed Cobalt Strike campaign against semiconductor industries using the same signed McAfee binary DLL side-loading tradecraft, corroborating technique reuse across China-nexus clusters in this period.
Sources cited for Tropic Trooper Spear-Phishing Campaign Uses LNK Loader, DLL
- Gifts from Tropical Pirates - New Dangerous Weapons Hidden in Email and Malware (EN)
- 熱帯の海賊からの贈り物 -メールとマルウェアに隠された新しい危険な武器- (JP original)
- Sequel: Gifts from Tropical Pirates - Who is the Sender? Look for the Attacker Group (EN)
- 続 : 熱帯の海賊から届く贈り物 -贈り主は誰？攻撃者グループを推定する- (JP)
- Tropic Trooper, Pirate Panda, KeyBoy, Group G0081
- Unveiling activities of Tropic Trooper 2023: deep analysis of Xiangoop Loader and EntryShell payload (VB2023 abstract)
- Chinese State-Sponsored Cyber Espionage Activity Targeting Semiconductor Industry in East Asia
- Chinese Hackers Attacking Semiconductor Industries using Cobalt Strike beacon
More in malware
- Compromised HBO Max Reddit Account Distributes ClickFix Malware in "PasteSwitch" Cross-Platform Malvertising Campaign
- SmokeLoader Backdoor/Loader: Process Hollowing Injection into explorer.exe with Anti-VM/Anti-Debug Evasion (Smoky Spider)
- Multi-Stage Cobalt Strike Loader Deploys Stageless Beacon via Anti-Sandbox .NET Chain
- Access-Code-Gated Phishing Chain Delivers Vidar Infostealer via DocuSign Impersonation
- ScarfaceStealer: Electron-Delivered Infostealer with Sandbox-Scoring Evasion and Smart-Contract C2
Detection coverage for TL-2026-2427
As of 2026-09-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2427 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.