Threat Actor 🇨🇳 China

TIDRONE

Also known as: Earth Ammit · VENOM

TIDRONE is an unidentified threat actor linked to Chinese-speaking groups, with a focus on military-related industry chains, particularly drone manufacturers in Taiwan. The actor employs advanced malware variants such as CXCLNT and CLNTEND, which are distributed through ERP software or remote desktops. The consistency in file compilation times and operational patterns aligns with other Chinese espionage activities, indicating a likely espionage motive.

MITRE ATT&CK TTPs 5

T1059
Command and Scripting Interpreter
Execution
 T1078
Valid Accounts
Defense Evasion
 T1090
Proxy
Command And Control
 T1195.001
Compromise Software Dependencies and Development Tools
Initial Access
 T1555
Credentials from Password Stores
Credential Access

Source Articles

New phishing kits target Microsoft 365 accounts, evade MFA
Two new phishing kits, Jalisco and OmegaLord, are targeting Microsoft 365 accounts using techniques that bypass multi-factor authentication (MFA). Jalisco leverages device-code phishing via OAuth 2.0 Device Authorization Grant, tricking users into authorizing attacker-controlled devices. OmegaLord uses a fake PDF reader login page to harvest credentials and phone numbers, aiding in MFA bypass. Both kits enable rapid data exfiltration from SaaS platforms like SharePoint, often within minutes of compromise.
bleeping-computer ·2w ago