A newly identified threat actor, dubbed TIDRONE, is targeting drone manufacturers in Taiwan, with a broader focus on military and satellite-related industrial supply chains. This espionage-driven campaign, which began in early 2024, is believed to have connections to other Chinese-speaking groups. TIDRONE employs sophisticated attack methods, including the deployment of custom malware such as CXCLNT and CLNTEND, often using enterprise resource planning (ERP) software or remote desktop tools like UltraVNC to infiltrate targets. The exact vector for initial access remains unclear, but commonalities among victims suggest a potential supply chain attack. Once inside a network, TIDRONE’s attack chain involves three (3) stages designed to escalate privileges, dump credentials, and evade defenses by disabling antivirus software. The malware is typically introduced via sideloading a rogue DLL through the Microsoft Word application, enabling the attackers to collect a wide range of sensitive information. CXCLNT is equipped with basic file upload and download capabilities, trace-clearing functions, and tools for gathering victim information such as file listings and computer names. It can also download and execute additional portable executable (PE) and DLL files. CLNTEND, first detected in April 2024, is a more advanced remote access tool (RAT) supporting multiple network protocols, including TCP, HTTP, HTTPS, TLS, and SMB (port 445). Analyses highlight that TIDRONE’s operations align with other Chinese espionage activities, supported by the consistency in file compilation times and operational patterns. The threat actors have continually updated their toolsets and optimized their attack chains, employing anti-analysis techniques in their loaders to alter execution flows and evade detection. The campaign’s reach extends beyond Taiwan, with artifacts from VirusTotal indicating varied targeted countries, prompting a warning from CTIX analysts for global vigilance against this threat.