Tropic Trooper Targets Taiwanese Government and Fossil Fuel Provider With Poison Ivy - Palo Alto Networks Blog

### Executive summary Unit 42 details a targeted Tropic Trooper campaign against Taiwanese government and an energy provider that used spear-phishing documents exploiting CVE-2012-0158 to drop Poison Ivy (and occasionally Yahoyah and PCShare). The report includes full malware analysis (shellcode, payload decryption, persistence), extracted Poison Ivy configuration, C2 domains/IPs, numerous file hashes and observed TTPs for detection and mitigation.