Trend Micro researchers identified that Earth Ammit’s operations demonstrate sophisticated understanding of supply chain vulnerabilities, employing two distinct attack paths: classic supply chain attacks that inject malicious code into legitimate software, and general supply chain attacks that leverage trusted communication channels to distribute malware without altering software artifacts. A sophisticated threat actor known as Earth Ammit has launched coordinated multi-wave attacks targeting drone supply chains, primarily in Taiwan’s military and satellite industries. Through these supply chain attacks, Earth Ammit positioned itself to target downstream customers, creating a ripple effect that extended the attackers’ reach to high-value military assets. The group, which security researchers have linked to Chinese-speaking APT groups, has executed two distinct campaigns between 2023 and 2024, demonstrating an evolution in tactics and tooling that poses significant risks to military and aerospace sectors. Following this initial compromise, Earth Ammit pivoted to a more targeted second wave called TIDRONE, which specifically aimed at military industry entities through the upstream supply chain. Victims of these attacks primarily originated from Taiwan and South Korea, affecting organizations within military, satellite, heavy industry, media, technology, software services, and healthcare sectors.
This Cyber News was published on cybersecuritynews.com. Publication date: Wed, 14 May 2025 12:35:04 +0000