Reddit NetSec

AlienVault OTX General

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

CVE Database V5

Exploit-DB RSS Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Earth Ammit, a Chinese-linked threat actor, conducted two campaigns targeting drone supply chains in Taiwan and South Korea from 2023 to 2024. The VENOM campaign focused on software service providers using open-source tools, while TIDRONE targeted military industries with custom malware. Their tactics included supply chain attacks, credential theft, and cyberespionage. Victims spanned military, satellite, heavy industry, media, technology, and healthcare sectors. Earth Ammit's goal was to compromise trusted networks for downstream attacks. They employed evolving techniques like fiber-based evasion and custom backdoors CXCLNT and CLNTEND. The campaigns showed progression from broad, low-cost tools to tailored capabilities for sensitive targets.

The threat actor Earth Ammit, linked to Chinese state-sponsored activities, has executed coordinated multi-wave cyber campaigns targeting drone supply chains primarily in Taiwan and South Korea between 2023 and 2024. These campaigns, named VENOM and TIDRONE, represent a strategic effort to disrupt and infiltrate critical supply chains associated with drone manufacturing and military industries. The VENOM campaign leveraged open-source tools to compromise software service providers, enabling broad access to downstream targets through trusted networks. In contrast, the TIDRONE campaign employed custom malware specifically designed to target military sectors, demonstrating an evolution from generic to highly tailored attack methodologies. The threat actor utilized a variety of sophisticated tactics including supply chain attacks, credential theft, and cyberespionage to gain persistent access. Notably, they deployed custom backdoors such as CXCLNT and CLNTEND and employed fiber-based evasion techniques to avoid detection. The victim profile is diverse, spanning military, satellite, heavy industry, media, technology, and healthcare sectors, indicating a wide-reaching impact on critical infrastructure and strategic industries. The campaigns also incorporated multiple MITRE ATT&CK techniques such as T1583 (Acquire Infrastructure), T1003 (Credential Dumping), T1543 (Create or Modify System Process), T1190 (Exploit Public-Facing Application), and T1078 (Valid Accounts), among others, highlighting a comprehensive and multi-faceted approach to compromise and persistence. The progression from broad, low-cost tools to customized malware underscores the threat actor’s adaptability and focus on high-value targets within sensitive sectors.

MD5 of 5235fecd3e1449ba9f78a25ddb89948a638484411a7bf91af3bb4d1b159f255a

MD5 of 19bbc2daa05a0e932d72ecfa4e08282aa4a27becaabad03b8fc18bb85d37743a

MD5 of 8907907a571a90c28ae72c10945f626fd22a6f587f664a6b86ad3a8f344f1aae

MD5 of 40bcd87bcd851c5c2d6e5c901c59312d480eed58b4ebb2981607c0d80c27b529

MD5 of 1b08f1af849f34bd3eaf2c8a97100d1ac4d78ff4f1c82dbea9c618d2fcd7b4c8

MD5 of c3c4443c3fee858e71fb8017288d9f3b79b2ae0f3f37f93d373765261b299d46

MD5 of 2f2d4cc6266fe1671fa03737059622e03466a80d43a0342bff21b73c7aa5419a

SHA1 of 40bcd87bcd851c5c2d6e5c901c59312d480eed58b4ebb2981607c0d80c27b529

SHA1 of 8907907a571a90c28ae72c10945f626fd22a6f587f664a6b86ad3a8f344f1aae

SHA1 of c3c4443c3fee858e71fb8017288d9f3b79b2ae0f3f37f93d373765261b299d46

SHA1 of 19bbc2daa05a0e932d72ecfa4e08282aa4a27becaabad03b8fc18bb85d37743a

SHA1 of 5235fecd3e1449ba9f78a25ddb89948a638484411a7bf91af3bb4d1b159f255a

SHA1 of 1b08f1af849f34bd3eaf2c8a97100d1ac4d78ff4f1c82dbea9c618d2fcd7b4c8

SHA1 of 2f2d4cc6266fe1671fa03737059622e03466a80d43a0342bff21b73c7aa5419a

Detailed information about Disruption of Drone Supply Chains Through Coordinated Multi-Wave Attacks in Taiwan. Get real-time updates, technical details, and mit

Title	Severity	Type	Source	Date

Threats Tagged 'custom backdoor'

Filter Threats

Threats Tagged 'custom backdoor'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility