Tropic Trooper Exploits SumatraPDF and VS Code Tunnels for Espionage

A sophisticated campaign by the threat group Tropic Trooper is targeting Chinese-speaking individuals. The attackers are leveraging a trojanized version of the SumatraPDF reader to deploy the AdaptixC2 post-exploitation agent. This allows them to gain a foothold and further abuse Microsoft Visual Studio Code (VS Code) tunnels for persistent remote access, as detailed by Zscaler ThreatLabz.

The exploit chain demonstrates a clear focus on covert operations. By compromising a legitimate, widely used PDF reader, Tropic Trooper aims to bypass initial detection. The subsequent use of VS Code’s remote development features as a C2 channel is a novel approach, blending legitimate developer tools with malicious intent to maintain command and control with reduced suspicion.