Earth Ammit Hackers Deploy New Tools to Target Military Drones

The threat actor group known as Earth Ammit, believed to be associated with Chinese-speaking APTs, has emerged as a significant concern for military and industrial sectors in Eastern Asia.

This group orchestrated two distinct campaigns-VENOM and TIDRONE-primarily targeting Taiwan and South Korea.

Their focus on supply chain infiltration, particularly within the drone and military industries, underscores a strategic intent to compromise high-value downstream targets.

Earth Ammit’s VENOM campaign zeroed in on upstream software service providers, exploiting web server vulnerabilities and deploying open-source tools like proxy utilities and remote access trojans (RATs) to maintain persistence and evade attribution.

By penetrating the drone supply chain, they positioned themselves to ripple malicious impact across connected ecosystems.

Supply Chain Attacks Unveiled

The TIDRONE campaign, disclosed in July 2024, marked a tactical evolution as Earth Ammit shifted to custom-built malware, including the backdoors CXCLNT and CLNTEND, tailored for cyberespionage within Taiwan’s military and satellite sectors.

Unlike the reliance on open-source tools in VENOM, TIDRONE introduced sophisticated fiber-based evasion techniques such as ConvertThreadToFiber and FlsAlloc, inspired by recent Black Hat conference discussions.

According to Trend Micro Report, these methods, alongside anti-analysis tricks like entry point verification and execution order dependencies, allowed in-memory execution to bypass traditional endpoint detection and response (EDR) systems.

CLNTEND, an advanced successor to CXCLNT, further enhanced stealth with support for diverse communication protocols including HTTP, TLS, and WebSocket, while incorporating anti-EDR features like process injection into legitimate Windows processes such as dllhost.exe.

Additionally, tools like SCREENCAP enabled screenshot exfiltration, amplifying data theft capabilities across compromised networks.

Malware Arsenal in TIDRONE Campaign

Earth Ammit’s dual campaigns exploited both classic and general supply chain attack vectors.

In the classic approach, malicious code was injected into legitimate software updates, while the general method leveraged trusted communication channels for lateral movement without altering software artifacts.

Victimology data highlights a concentrated impact on Taiwan and South Korea, affecting sectors from heavy industry to healthcare, with a clear emphasis on military-related suppliers and drone vendors.

Shared victims and overlapping command-and-control (C&C) infrastructure, including domains like fuckeveryday[.]life, confirm the linkage between VENOM and TIDRONE, pointing to a coordinated operation by a single entity.

Attribution indicators, such as GMT+8 timestamps and similarities to the Dalbit threat group’s tactics, suggest a Chinese-speaking origin, though definitive ties remain unconfirmed.

For organizations, the implications are stark. Supply chain vulnerabilities must be addressed through rigorous third-party risk management, code signing enforcement, and Zero Trust Architecture adoption to validate every connection.

Monitoring fiber-related API usage and enhancing behavioral detection in EDR solutions are critical to countering evasion techniques.

As Earth Ammit continues to refine its tradecraft-from low-cost open-source tools to bespoke malware-proactive defense measures and continuous threat intelligence updates, as offered by solutions like Trend Vision One, are vital to safeguarding against these persistent and evolving cyber threats targeting trusted networks and sensitive industries.

Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates!