Threat actors from the Chinese-backed Tropic Trooper organization have launched a new malware campaign targeting mobile devices. Tropic Trooper is a threat organization first identified in 2011that previously targeted government, transportation, high-tech, and healthcare entities throughout Hong Kong, Taiwan, and the Philippines. In this new campaign, threat actors are utilizing the SMS Bomber tool to deliver their Yahoyah trojan backdoor to mobile devices. The SMS Bomber tool allows threat actors to flood a user’s mobile device with a corrupted message, causing system instability within the device. Once established on the system, the Yahoyah trojan variant begins transmitting host-related data to command-and-control (C2) nodes operated by threat actors. Compromised information includes device name, network SSIDs within the device’s area, MAC address, OS version, and any anti-virus products on the device. Tropic Trooper has been targeting Russian entities in their recent phishing campaigns, hinting that Russian users could be infected by this new campaign. CTIX continues to monitor threat actor activity worldwide and will provide additional updates as needed.