TClient is actually one of Tropic Trooper’s other backdoors. The backdoor noted by other security researchers was encoded with different algorithms and configured with different parameter names in 2016, for instance. TClient uses symmetric encryption to decrypt its configuration with one 16-byte key in 2018. The image and table below illustrate TClient’s encrypted configuration that we decrypted (via Python code