- Category
- State · Attributed to a state or working for one.
- Origin
- China(high confidence)
- Motivation
- Information theft and espionage
- Seen
- 2022
- Sources
- 6 sources carry it
- Identifier
- GINC-APT-0356 · tidrone
ChinaWhat it is
TIDRONE is an unidentified threat actor linked to Chinese-speaking groups, with a focus on military-related industry chains, particularly drone manufacturers in Taiwan. The actor employs advanced malware variants such as CXCLNT and CLNTEND, which are distributed through ERP software or remote desktops. The consistency in file compilation times and operational patterns aligns with other Chinese espionage activities, indicating a likely espionage motive.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Trend Micro
- Earth Ammit
- Other names
- VENOM
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Targets
- Countries
- Canada, South Korea, Taiwan
- Sectors
- Defense, Telecommunications
Tools
The tools and malware families the sources tie to it.
- CLNTEND
- CXCLNT
- DesktopNow
- Remote Utilities
- RemoteCMD
- RemotePC
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de