Tropic Trooper Targets Taiwanese Government and Fossil Fuel Provider With Poison Ivy
Summary: Unit 42 identified two early-August attacks using similar techniques, one targeting the Secretary General of Taiwan's Executive Yuan and the other an energy sector company in Taiwan, both tied to the Tropic Trooper campaign active since at least 2011. One attack used the known Yahoyah malware while the other deployed the Poison Ivy RAT, and further analysis found ties suggesting the actors may also use the PCShare malware family, previously not linked to the group.
Why it matters: The spear-phishing email was spoofed to appear from a Democratic Progressive Party staff member and carried a document exploiting CVE-2012-0158, a Microsoft Office vulnerability old enough that many organizations may no longer treat it as a live threat.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2012-0158
- Related
- When combining exploits for added effect goes wrong Cyber Risks ·