# Tropic Trooper Spear-Phishing Campaign Uses LNK Loader, DLL Side-Loading via Signed McAfee Binary, and Cobalt Strike Against Chinese Housing-Fund-Themed Targets

> ITOCHU Cyber & Intelligence researchers documented a spear-phishing campaign impersonating a Chinese company housing-fund benefit notice that delivers a ZIP archive containing a disguised .lnk shortcut, a hidden payload folder, and a legitimate signed McAfee executable (NTUSER.EXE) abused for DLL side-loading of a malicious loader (McVsoCfg.dll) that decrypts and launches an embedded Cobalt Strike Beacon (setting.dat) calling back to 38.54.40.178:2433. Researchers assess with high confidence the activity is attributable to Tropic Trooper (aka Pirate Panda, KeyBoy) based on the EntryShell payload's KeyBoy-lineage code artifacts documented in a companion campaign wave.

- **Published:** 2026-09-10T00:00:00Z
- **Last reviewed:** 2026-09-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2427
- **ID:** TL-2026-2427
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Tropic Trooper - G0081
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In September 2023, ITOCHU Cyber & Intelligence Inc. researchers published analysis of a targeted spear-phishing campaign against a Chinese company, disguised as a notice about the mandatory monthly housing provident fund (住房公积金) contribution rate. The lure email delivered a ZIP archive containing a shortcut file named to resemble an Excel workbook ('...xlsx.lnk') and a hidden folder named '&Recycle.Bin' to mimic the Windows Recycle Bin. Because Windows suppresses the '.lnk' extension even when 'show file extensions' is enabled, the victim sees only the fake '.xlsx' name. Opening the shortcut launches the legitimate, digitally signed McAfee binary NTUSER.EXE from the hidden folder while displaying a decoy spreadsheet (gongjijin.xlsx) to the user.

NTUSER.EXE is abused for DLL side-loading: it loads a co-located malicious DLL, McVsoCfg.dll, whose exported McVsoCfgGetObject function contains the malicious loader logic. The installer stage copies all three files (renamed NTUSER.EXE, the DLL, and the encrypted payload) to C:\Users\Public\Downloads\, renaming NTUSER.EXE to Avira.exe to masquerade as antivirus software. The loader then reads and XOR-decrypts (single-byte key 0x2E) the payload file setting.dat, producing a PE image with shellcode embedded in its MZ header to complicate static and dynamic analysis. The decrypted payload is a Cobalt Strike Beacon that calls back to 38.54.40.178 on TCP port 2433 -- a non-standard port for that address. The researchers found no persistence mechanism in the sample; the chain does not survive a reboot, which they assess as either an operational oversight or an indication the operators plan re-deployment via other means.

A companion attribution post by the same researchers (published one week later) ties this activity to Tropic Trooper by way of a parallel malware family, EntryShell, documented in the same May-October 2023 campaign wave against semiconductor and rare-metal-industry targets in East Asia. EntryShell is assessed as an evolved, fileless variant of the KeyBoy backdoor: it shares distinctive error-message strings matched by a 2016 KeyBoy YARA rule, and encrypts identifiable strings with AES-ECB under the hardcoded key 'afkngaikfaf' specifically to evade security products. Because KeyBoy has no reported use by any actor other than Tropic Trooper, the researchers treat EntryShell/KeyBoy lineage as an actor-specific fingerprint and extend that attribution to the housing-fund campaign on shared loader (Xiangoop Loader family), payload staging, and methodology. The same investigation also recovered a third-stage RAT, CrowDoor -- a variant of the SparrowDoor backdoor associated with the China-aligned group FamousSparrow -- leading the researchers to assess that Tropic Trooper and FamousSparrow are either the same group or operate in close coordination.

A separate, independently published cluster of reporting (EclecticIQ, and picked up by GBHackers) documented an overlapping but distinct campaign in the same Sept-Oct 2023 window: a TSMC-themed lure against semiconductor-industry targets in Taiwan, Hong Kong, and Singapore, using the identical DLL side-loading tradecraft (a signed McAfee binary, mcods.exe, side-loading a Cobalt Strike loader named mcvsocfg.dll) staged from a compromised Cobra DocGuard server, but with different C2 infrastructure (38.54.119.239:443, 45.77.37.145:8443) and an unnamed PRC-nexus attribution (noted overlaps with Carderbee/APT27-linked infrastructure). This indicates the McAfee-binary DLL side-loading technique for staging Cobalt Strike is shared tradecraft reused by multiple China-nexus clusters in this period, not unique to the housing-fund incident's infrastructure -- a nuance relevant to confidence in infrastructure-based attribution, though the ITOCHU researchers' code-lineage-based attribution (KeyBoy string/crypto fingerprints) is independent of this shared-loader observation.

MITRE ATT&CK Group G0081 (Tropic Trooper, aka Pirate Panda, KeyBoy) has been tracked since at least 2011, historically targeting government, healthcare, transportation, and high-tech organizations in Taiwan, the Philippines, and Hong Kong; this campaign's targeting of a mainland Chinese company via a China-specific HR benefit lure, and the sequel article's semiconductor/rare-metal sector focus, reflect the actor's continued expansion into Chinese-language, high-tech-adjacent targets.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1036.008 Masquerade File Type
- T1036.005 Match Legitimate Resource Name or Location
- T1564.001 Hidden Files and Directories
- T1574.001 DLL
- T1140 Deobfuscate/Decode Files or Information
- T1027.009 Embedded Payloads
- T1071 Application Layer Protocol
- T1571 Non-Standard Port

## Sources

- [Gifts from Tropical Pirates - New Dangerous Weapons Hidden in Email and Malware (EN)](https://blog-en.itochuci.co.jp/entry/2023/09/28/171001)
- [熱帯の海賊からの贈り物 -メールとマルウェアに隠された新しい危険な武器- (JP original)](https://blog.itochuci.co.jp/entry/2023/09/27/105758)
- [Sequel: Gifts from Tropical Pirates - Who is the Sender? Look for the Attacker Group (EN)](https://blog-en.itochuci.co.jp/entry/2023/10/06/173200)
- [続 : 熱帯の海賊から届く贈り物 -贈り主は誰？攻撃者グループを推定する- (JP)](https://blog.itochuci.co.jp/entry/2023/10/06/003000)
- [Tropic Trooper, Pirate Panda, KeyBoy, Group G0081](https://attack.mitre.org/groups/G0081/)
- [Unveiling activities of Tropic Trooper 2023: deep analysis of Xiangoop Loader and EntryShell payload (VB2023 abstract)](https://www.virusbulletin.com/conference/vb2023/abstracts/unveiling-activities-tropic-trooper-2023-deep-analysis-xiangoop-loader-and-entryshell-payload)
- [Chinese State-Sponsored Cyber Espionage Activity Targeting Semiconductor Industry in East Asia](https://blog.eclecticiq.com/chinese-state-sponsored-cyber-espionage-activity-targeting-semiconductor-industry-in-east-asia)
- [Chinese Hackers Attacking Semiconductor Industries using Cobalt Strike beacon](https://gbhackers.com/chinese-semiconductor-industries/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2427