Attackers replaced Digiwin’s original Update.exe execution file with Winword.exe. Update.exe is part of Digiwin’s auto update workflow, but attackers caused it to launch Microsoft Word 2010 instead, which loaded a backdoor that could carry out malicious actions. Still, concerns over drones remain; so much so that the chief of the North American Aerospace Defense Command (NORAD) told lawmakers in February that the Pentagon needed more resources to deal with drones flying over U.S. military installations. The Taiwan attacks demonstrate that American officials and other global watchdogs worried about unidentified drones have legitimate concerns. As such, it seems likely that this strain of drone attacks is a highly sophisticated, targeted attack with careful planning and execution by the threat actors. Taiwan’s central government opened UAV AI Innovation Application R&D Center in Chiayi County and offered a NT$50 million tender for 3,000 commercial-grade drones to be used for military applications. With command and control capabilities installed as part of the breach, attackers gained access to company PCs within drone manufacturers. There are now about a dozen companies in Taiwan participating in drone manufacturing, and even more when taking into account the island’s global aerospace industry. Taiwan’s allegiance to the U.S. and strong technological background make the island a prime target for adversaries interested in military espionage or supply chain attacks. The military said it wasn’t operating the drones but that they didn’t pose a threat. They brought three files to the system: a legitimate copy of Microsoft Word 2010, a signed wwlib.dll file and a file with a random name and file extension. In January, the German cabinet approved a plan to shoot down drones that flew over their military installations. The extreme growth of the drone industry in the past decade also had an unfortunate side effect: even consumer models are used for military purposes now. Taiwan is home to some of the world’s most advanced drone makers, and drone production on the island has ramped up significantly since 2022. The Acronis Threat Research Unit (TRU) found evidence of multiple components of Digiwin deployed in target environments. The drones were real, and reported by citizens, law enforcement officers and members of the U.S. military. “The primary threat I see for them in the way they’ve been operating is detection and perhaps surveillance of sensitive capabilities on our installations,” NORAD chief Gen. Attackers there used malware to spy on drone manufacturers’ corporate computers and likely exfiltrate data. Some of Digiwin’s components contain known vulnerabilities, and it seems very likely that exploitation or a supply chain attack originated in the ERP software. In August 2022, drone manufacturing in Taiwan got a jumpstart.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Wed, 05 Mar 2025 15:30:13 +0000