Siege of the Drone Supply Chain: Inside Earth Ammit's Multi-Stage Espionage

In the high-stakes world of modern warfare, the drone supply chain has become a primary battlefield for cyberespionage. Recent research from Trend Micro has shed light on a sophisticated campaign targeting Taiwan's burgeoning drone industry. This operation, attributed to an actor known as Earth Ammit, demonstrates a chillingly effective strategy: compromising upstream service providers to lay a "grand siege" to high-value military targets.

This post explores the dual-campaign strategy involving the VENOM and TIDRONE operations, the technical nuances of their custom malware, and the advanced evasion techniques—including the use of Windows Fibers—that make this actor particularly dangerous for defenders in the defense and technology sectors.

The Two-Phased Assault: VENOM and TIDRONE

Earth Ammit does not strike their primary targets directly. Instead, they utilize a multi-stage approach designed to maximize infiltration while minimizing early detection.

Phase 1: Operation VENOM

The VENOM campaign targets the "upstream" of the supply chain—the service providers, ERP vendors, and software companies that the drone manufacturers trust. The primary goal of VENOM is credential theft. By exploiting web server vulnerabilities and deploying web shells, Earth Ammit gains a foothold in these provider networks. They then move laterally to domain controllers to steal the NTDS.dit file, effectively owning the identities of everyone within the organization and its trusted channels.

To avoid early attribution, Earth Ammit uses a "cheap and effective" toolkit in this stage, consisting largely of modified open-source tools like FRPC for reverse proxying and tunneling. By blending in with common red-teaming tools, they make it harder for analysts to identify the specific threat actor behind the breach.

Phase 2: Operation TIDRONE

Once the credentials and trusted channels are secured, the operation transitions to TIDRONE. This phase targets the "downstream"—the drone manufacturers and military contractors themselves. Using the trusted connections established in VENOM (such as remote management tools or update mechanisms), Earth Ammit deploys highly customized malware tailored for long-term espionage. This is where the actor's technical sophistication truly shines.

Technical Deep Dive: The Evolution of Stealth

One of the most compelling aspects of the research is the analysis of Earth Ammit's malware loaders. Over the years, these loaders have evolved to incorporate advanced evasion techniques that challenge traditional security monitoring.

The Rise of Fiber-Based Evasion

Traditional security tools, including many EDR solutions, monitor system threads to detect malicious behavior. Earth Ammit exploits a blind spot in this monitoring by using Windows Fibers. Unlike threads, which are managed by the operating system kernel, fibers are managed at the application level (user mode).

Earth Ammit’s malware (CXCLNT and CLNTEND) utilizes several fiber-based techniques:

1. Direct Fiber Conversion: Using ConvertThreadToFiber and CreateFiber, the malware moves its execution context into a fiber structure. Because security products often only check system-scheduled threads, the malicious logic running inside a fiber remains undetected.
2. FLS Callbacks: The malware leverages FlsAlloc (Fiber Local Storage) to register a callback function. When the fiber object is freed or deleted, the callback triggers the execution of the encrypted payload in memory.
3. Exception Handling Manipulation: Later versions of the loader use custom exception handlers to redirect code execution flow, further obfuscating the malware's true intent from static and dynamic analysis tools.

Custom Backdoors: CXCLNT and CLNTEND

The backdoors themselves are modular and stealthy. They do not exist as files on the disk; instead, they are decompressed and executed directly in memory.

• CXCLNT (CX Client): A modular backdoor that relies on C2-delivered plugins for its main functionality. This makes initial analysis difficult, as the "meat" of the malware is never present on the infected system until the attacker decides to send it.
• CLNTEND (Client End): A more advanced version that supports both client and server modes and implements multiple connection methods to bypass restrictive network environments. It also features aggressive anti-AV/EDR capabilities, specifically injecting into legitimate processes like WinWord.exe to hide its activities.

Post-Exploitation and Persistence

Once established, the actor ensures they cannot be easily removed. Their post-exploitation toolkit includes:

• TrueSight Killer: A specialized tool designed to identify and terminate EDR and AV processes.
• ScreenCapt: A screen surveillance tool adapted from open-source projects to monitor the victim's desktop in real-time.
• Credential Dumping: Frequent use of cmdkey.exe and process dumping of lsass.exe to maintain a steady stream of administrative credentials.

Mitigation and Defense Strategies

Defending against a supply-chain-focused actor like Earth Ammit requires a shift in perspective. You cannot just defend your own perimeter; you must evaluate the security of your entire ecosystem.

1. Monitor Fiber APIs: Defenders should look for unusual usage of FlsAlloc, CreateFiber, and SwitchToFiber within non-standard applications.
2. AD Security is Paramount: Since Earth Ammit prioritizes NTDS.dit theft, organizations must implement strict Tiered Administration models and monitor for unauthorized access to Domain Controllers.
3. Audit Service Provider Access: Limit the permissions granted to third-party management and monitoring tools. Treat incoming traffic from "trusted" service providers with the same scrutiny as external traffic.
4. Process Integrity: Monitor for unusual process parenting, such as WinWord.exe spawning cmd.exe or making external network connections.

Conclusion

The Earth Ammit campaigns serve as a stark reminder that the supply chain is the path of least resistance for advanced persistent threats. By starting with "common" tools and graduating to sophisticated, fiber-based custom malware, they successfully infiltrated critical military infrastructure. For the cybersecurity community, the lesson is clear: we must look beyond threads and files to the deeper, more subtle mechanisms of the Windows OS to catch the next generation of espionage tools. Stay vigilant, monitor your providers, and always assume that a trusted channel might be compromised.