Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
5 IOCs
Tropic Trooper Pivots to AdaptixC2 and Custom Beacon Listener
Malware Families
Excerpt
IntroductionOn March 12, 2026, Zscaler ThreatLabz discovered a malicious ZIP archive containing military-themed document lures targeting Chinese-speaking individuals. Our analysis of this sample uncovered a campaign leveraging a multi-stage attack chain where a trojanized SumatraPDF reader deploys an AdaptixC2 Beacon agent, ultimately leading to the download and abuse of Visual Studio (VS) Code tunnels for remote access. During our analysis, we observed that the threat actor…
Read the original report →Diamond Model
Adversary
Infrastructure(5)
Capability(2)
Victim
Indicators of Compromise
Open the mindmap →5 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 158.247.193.100 | High | Score 58/100 | First seen |
| IP | 47.76.236.58 | High | Score 58/100 | First seen |
| URL | http://bashupload.app/zgel2a.bin | High | Score 58/100 | First seen |
| URL | http://bashupload.app/6e1lhccurl | High | Score 58/100 | First seen |
| IP | 58.247.193.100 | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…