The cyber espionage group known as Earth Ammit has been linked to two (2) related campaigns, VENOM and TIDRONE, targeting various sectors in Taiwan and South Korea between 2023 and 2024. These campaigns, attributed to Chinese-speaking nation-state actors, aimed at compromising the drone supply chain and other critical sectors such as military, satellite, heavy industry, media, technology, software services, and healthcare. The VENOM campaign primarily targeted software service providers in Taiwan and heavy industry firms in South Korea by exploiting web server vulnerabilities to deploy web shells and remote access tools. This allowed Earth Ammit to harvest credentials and set the stage for the subsequent TIDRONE campaign. VENOM’s use of open-source tools like REVSOCK and Sliver was a deliberate attempt to obscure attribution. The TIDRONE campaign focused on the military industry, particularly drone manufacturers. It involved three (3) stages: initial access through service providers, command-and-control using DLL loaders to drop CXCLNT and CLNTEND backdoors, and post-exploitation activities like privilege escalation and information collection. These campaigns demonstrated Earth Ammit’s strategy of infiltrating upstream segments of the supply chain to target downstream customers, causing broad global consequences. The connection between VENOM and TIDRONE is evident through shared victims, service providers, and command-and-control infrastructure, suggesting a common threat actor behind both campaigns. The tactics, techniques, and procedures (TTPs) resemble those used by another Chinese nation-state hacking group, Dalbit, indicating a shared toolkit.