Tropic Trooper (APT23), a long-established state-aligned threat group, has upgraded its attack toolkit and is now delivering malware through trojanized SumatraPDF installers, routing command-and-control traffic through GitHub and Microsoft VS Code tunnels, developer services that most enterprise firewalls treat as trusted. The campaign targets Chinese-speaking individuals in Taiwan, South Korea, and Japan, with lures themed around military content. The deliberate use of legitimate developer infrastructure makes this campaign significantly harder to detect through conventional network monitoring, increasing the risk of sustained, undetected access to compromised environments.