Tropic Trooper Uses Trojanized SumatraPDF and GitHub to Deploy AdaptixC2

Source: The Hacker News

Overview

Chinese‑speaking individuals are the target of a new campaign that uses a trojanized version of the SumatraPDF reader to deploy the AdaptixC2 Beacon post‑exploitation agent and ultimately facilitate the abuse of Microsoft Visual Studio Code (VS Code) tunnels for remote access.

Campaign Details

• Malicious Tool: A modified SumatraPDF reader that contains the AdaptixC2 payload.
• Payload: AdaptixC2 Beacon, a post‑exploitation agent designed to establish persistent control.
• Abuse Vector: The beacon leverages VS Code tunnels to provide remote access to compromised systems.

Attribution

Zscaler ThreatLabz, which discovered the campaign last month, has attributed it with high confidence to Tropic Trooper (aka …).