A highly advanced cyber threat entity, referred to as Earth Ammit, has initiated a series of calculated, multi-phase assaults aimed at disrupting drone supply networks, with a particular focus on Taiwan’s defense and satellite infrastructure.
Security analysts have traced the group’s operations to Chinese-speaking APT factions. Over the course of 2023 and 2024, Earth Ammit has carried out two separate and increasingly sophisticated campaigns, showcasing a notable advancement in their strategies and technologies. This growing threat poses a considerable challenge to military and aerospace industries worldwide.
Earth Ammit’s Operation Timeline (Source – Trend Micro)
Earth Ammit’s first assault, named VENOM, targeted software service providers and tech firms by exploiting vulnerabilities in web servers to deploy malicious web shells. This attack leaned on open-source tools to secure a foothold in compromised systems, ensuring long-term access while minimizing the risk of detection.
After the initial breach, Earth Ammit shifted to a more refined strategy in its second phase, called TIDRONE. This wave specifically focused on military-related entities within the upstream supply chain, targeting companies vital to the defense sector.
The majority of the victims were based in Taiwan and South Korea, spanning industries such as military, satellite communications, heavy manufacturing, media, tech services, and healthcare.
By exploiting these supply chain weaknesses, Earth Ammit effectively reached downstream targets, further extending its influence and impacting high-priority military assets.
According to Trend Micro, the group’s operations reflect a deep understanding of supply chain vulnerabilities. They employed two primary attack vectors: traditional supply chain attacks, which involve injecting malicious code into trusted software, and general supply chain tactics, utilizing secure communication channels to propagate malware without altering the software itself.
Earth Ammit’s overarching goal appears to be penetrating secure networks to access sensitive military technologies, with a particular focus on drones used for defense purposes.
The companies affected by these attacks face considerable risks, including theft of credentials, unauthorized data exfiltration, and prolonged access by the attackers.
Malware Arsenal Advancements
One of the most alarming aspects of Earth Ammit’s operations is their rapid enhancement of malware tools. The CLNTEND backdoor, first detected in 2024, marks a major upgrade from the earlier CXCLNT version, signaling a troubling evolution in their hacking capabilities.
The Loader’s Evolution from 2023 to 2024 (Source – Trend Micro)
Both CLNTEND and CXCLNT execute entirely in memory to avoid detection, but CLNTEND distinguishes itself by functioning as a dynamic link library (DLL) instead of an executable (EXE) file. Additionally, it supports seven communication protocols, a significant increase compared to the two protocols utilized by CXCLNT.
What sets CLNTEND apart in terms of sophistication is its use of fiber-based evasion strategies. By exploiting Windows fiber API functions, CLNTEND can effectively conceal its malicious operations from security tools, making detection more challenging.
The Connection Between VENOM and TIDRONE Campaigns (Source – Trend Micro)
Examining the code below reveals how the malware employs functions such as ConvertThreadToFiber and CreateFiber to execute code stealthily, making it harder for security systems to detect:
c
hModule = hinstDLL;
ModuleHandleA = GetModuleHandleA(0);
dword_10013300 = *(_DWORD *)((char *)ModuleHandleA + *((_DWORD *)ModuleHandleA + 15) + 40);
lpFiber = ConvertThreadToFiber(0);
Fiber = (char *)CreateFiber(0, (LPFIBER_START_ROUTINE)StartAddress, 0);
dword_100132C4 = (int)Fiber;
*(_DWORD *)&Fiber[(dword_10013300 ^ 0x10EC) + 196] = (char *)sub_10001480 + (dword_10013300 ^ 0x10EC);
SwitchToFiber(Fiber);
The attacker also employs a range of anti-analysis tactics, such as entrypoint checks with GetModuleHandle, XOR operations, and execution dependencies designed to thwart analysis efforts.
In addition to these methods, the group has integrated a screen capture tool called SCREENCAP, which is derived from open-source software. This tool allows the threat actors to conduct surveillance on victims by capturing screen data and transmitting it to their command and control infrastructure.
Analysis of the compiled file timestamps and execution logs indicates that the operations are aligned with the GMT+8 timezone. Furthermore, the group’s techniques bear striking similarities to those used by Dalbit, a previously reported threat actor tracked by AhnLab.
To defend against these types of threats, organizations should adopt comprehensive third-party risk management strategies, keep a close eye on fiber API usage, enhance their endpoint detection and response (EDR) systems, and implement Zero Trust Architecture to validate each connection attempt.
