TIDRONE

Also known as: Earth Ammit, TIDRONE, VENOM

TIDRONE is an unidentified threat actor linked to Chinese-speaking groups, with a focus on military-related industry chains, particularly drone manufacturers in Taiwan. The actor employs advanced malware variants such as CXCLNT and CLNTEND, which are distributed through ERP software or remote desktops. The consistency in file compilation times and operational patterns aligns with other Chinese espionage activities, indicating a likely espionage motive.

🌍 Country China

Associated Operations

2024 Analysis on the Case of TIDRONE Threat Actor’s Attacks on Korean Companies https://asec.ahnlab.com/en/85119/

Introduction

TIDRONE is an unidentified threat actor linked to Chinese-speaking groups, with a focus on military-related industry chains, particularly drone manufacturers in Taiwan. The actor employs advanced malware variants such as CXCLNT and CLNTEND, which are distributed through ERP software or remote desktops. The consistency in file compilation times and operational patterns aligns with other Chinese espionage activities, indicating a likely espionage motive.

Activities and Tactics

Country of Origin: 🇨🇳 China

Notable Campaigns

  • 2024
  • Analysis on the Case of TIDRONE Threat Actor’s Attacks on Korean Companies
  • https://asec.ahnlab.com/en/85119/

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

  • RemoteCMD
  • Remote Utilities
  • RemotePC
  • DesktopNow
  • CLNTEND:
  • CXCLNT:

Attribution and Evidence

Country of Origin: China Additional attribution information pending cataloguing.

References

References pending cataloguing.