New Cyber Espionage Campaign Targets Taiwanese Drone Manufacturers

A newly discovered cyber threat actor, likely linked to Chinese-speaking groups, has been targeting Taiwanese drone manufacturers in an espionage campaign that began in 2024. Cybersecurity firm Trend Micro has identified this group, named TIDRONE, focusing on military-related industries.

The attackers’ initial access method remains unclear, but Trend Micro has identified custom malware, CXCLNT and CLNTEND, deployed via remote desktop tools like UltraVNC. A shared use of enterprise resource planning (ERP) software among victims suggests a potential supply chain attack.

The attack progresses through three stages, aiming to escalate privileges, bypass User Access Control (UAC), and disable antivirus software. The malware, launched through Microsoft Word, allows the attackers to extract sensitive information and maintain control over compromised systems.

Trend Micro researchers believe that the group’s operational patterns align with other Chinese espionage activities, indicating that TIDRONE is likely an as-yet unidentified Chinese-speaking entity. The investigation into this threat is ongoing.