Tropic Trooper Uses Custom Beacon and VS Code Tunnels for Stealthy Remote Access

A new Tropic Trooper campaign that combines a trojanized PDF reader, a custom AdaptixC2 Beacon listener, and Visual Studio (VS) Code tunnels to gain and maintain remote access to targeted systems.

The operation appears to focus on Chinese-speaking individuals in Taiwan, as well as victims in South Korea and Japan. It is attributed to Tropic Trooper (aka Earth Centaur, Pirate Panda) with high confidence based on strong overlaps in tools and techniques.

When launched, the trojanized SumatraPDF displayed a decoy PDF that matched the lure’s theme, while silently downloading and executing shellcode that deployed an AdaptixC2 Beacon agent in memory.

Most documents were benign-looking, but the file “Comparative Analysis of US-UK and US-Australia Nuclear Submarine Cooperation (2025).exe” was actually a trojanized SumatraPDF reader that kicked off a multi-stage infection chain.

On March 12, 2026, ThreatLabz identified a malicious ZIP archive containing several military- and defense-themed documents in Chinese, including files referencing metaverse industrial bases, acoustic intelligence centers, unmanned systems, and nuclear submarine cooperation.

The loader code closely matches the TOSHIS loader previously documented in Trend Micro’s TAOTH campaign, including similar control-flow hijacking and configuration handling, but with updated stack strings and the removal of a language ID check.

TOSHIS loader and AdaptixC2 Beacon

The modified SumatraPDF binary abuses the _security_init_cookie function to divert execution to malicious TOSHIS loader code instead of normal application startup.

This loader constructs key configuration values (C2 IP, file paths, DLL names, crypto key), resolves APIs via the Adler-32 hashing algorithm, then downloads a PDF decoy and a second-stage shellcode from a staging server before decrypting the shellcode using AES-128-CBC and running it in memory as an AdaptixC2 Beacon.

Unlike earlier TOSHIS variants that typically deployed Cobalt Strike Beacons or Merlin agents, this campaign pivots to the open-source AdaptixC2 framework, indicating Tropic Trooper’s shift toward more diverse post-exploitation toolsets.

The staging server also hosted Cobalt Strike Beacon (with watermark “520”) and the custom EntryShell backdoor, both previously linked to Tropic Trooper operations, reinforcing the attribution.

ThreatLabz found that the AdaptixC2 Beacon used a custom listener that leverages GitHub as its command-and-control (C2) platform, abusing GitHub issues and repository contents APIs to send beacons, receive tasks, and exfiltrate results.

The trojanized executable resembles the open-source SumatraPDF reader at first glance, featuring identical certificates and PDB paths to those of the legitimate SumatraPDF executable.

The extracted configuration included a fake repository owner and name, an API host of api.github.com, and an RC4 key used to decrypt encrypted config sections and beacon traffic.

The Beacon generates a per-session RC4 key, retrieves the victim’s external IP via ipinfo.io, embeds that IP in each beacon, and then posts to a specific GitHub issue to establish a session.

Tasks are delivered via open GitHub issues whose titles and bodies encode commands and parameters; the malware parses these using simple substring matching, then downloads Base64-encoded task files from repository paths like “upload/{agent_id}/…”, executes them, and uploads encrypted results back as “download_*.txt” files.

Abuse of VS Code tunnels

C2 monitoring showed that Tropic Trooper operators deleted beacon artifacts from GitHub within seconds, likely to destroy session keys and limit forensic visibility into live C2 traffic.

The RC4 key in the config above is used to decrypt the encrypted parts of the config, as well as beacon heartbeats. 

The AdaptixC2 Beacon was primarily used for reconnaissance and establishing an initial foothold, after which high-value victims were migrated to VS Code tunnels for interactive remote access.

Operators issued commands to download and install the VS Code command-line client, log in via “code tunnel user login –provider github”, and set up scheduled tasks for persistence under stealthy task names such as “\MicrosoftUDN” and “\MSDNSvc,” alongside additional trojanized binaries for camouflage.

This reuse of VS Code tunnels, TOSHIS loader, EntryShell, Cobalt Strike with watermark “520,” and similar post-infection commands mirrors the TAOTH campaign and underpins ThreatLabz’s high-confidence attribution to Tropic Trooper.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.