Operation Tropic Trooper: Relying on Tried-and-Tested Flaws to Infiltrate Secret Keepers

Trend Micro's analysis of "Operation Tropic Trooper" describes a targeted espionage campaign (active since ~2012) against Taiwanese and Philippine government and military targets using spear-phishing weaponized Office documents to exploit CVE-2010-3333 and CVE-2012-0158. The attackers employ a staged infection chain (TROJ_YAHOYAH downloader → TROJ_YAHAMAM service DLL → BKDR_YAHAMAM backdoor), steganography in image files, an accompanying rootkit (usb30.sys/RTKT_HIDEPORT) to hide communications, extensive C2 infrastructure and lateral-movement tools, and provide numerous IoCs and defensive recommendations.