Ancient MSFT Word Bug Anchors Taiwanese Drone-Maker Attacks

An attack dubbed WordDrone that uses an old flaw to install a backdoor could be related to previously reported cyber incidents against Taiwans military and satellite industrial supply chain.

Attackers are weaponizing an ancient version of Microsoft Word in a recent wave of attacks on Taiwanese drone makers thats delivering malware aimed at cyber espionage and disrupting the military- and satellite-related industrial supply chains.
Researchers from the Acronis Threat Research Unit have discovered an attack theyve dubbed WordDrone that uses a dynamic link library (DLL) side-loading technique common in the installation process of Microsoft Word, to install a persistent backdoor called ClientEndPoint on infected systems.
The Acronis team members discovered the unusual attack vector when they investigated a customer escalation from Taiwan about a strangely behaving process of an ancient version of Microsoft Word, they wrote in
a blog post
published Sept. 10.
Three files were brought to the system: a legitimate copy of Winword 2010, a signed wwlib.dll file, and a file with a random name and file extension, they wrote in the post. Microsoft Word was used to side load the malicious wwlib DLL, which acts as a loader for the actual payload, the one residing inside the encrypted file with a random name.
They eventually found similar two-stage attack scenarios across multiple environments between April and July this year. The first stage of the attacks focuses on Windows desktop machines, while the second stage sees attackers trying to move over to Windows servers, the researchers said.
Its unclear if the attack vector is related to a
similar wave of cyber incidents
against Taiwanese drone makers by a threat actor dubbed TIDrone reported by researchers
at Trend Micro
. That actor, linked to other Chinese-speaking threat groups, uses
enterprise resource planning (ERP) software
or remote desktop tools to deploy proprietary malware.
Similarly, the WordDrone attack also appears to have an ERP component, the researchers said. While they couldnt find definitive evidence about how attackers were gaining initial access, the first appearance of the malicious files in the attack was inside the folder of a popular Taiwanese ERP software called Digiwin.
Upon further investigation, we found multiple components of Digiwin … being deployed in the target environments, the researchers wrote. Moreover, some of Digiwins components contained known vulnerabilities like
CVE-2024-40521
, a remote code execution (RCE) flaw with a CVSS score of 8.8.
Based on all the information collected, we believe that there is high probability of exploitation or a supply chain attack being involved with the ERP software in question, the researchers noted.
The attack leverages
a side-loading vulnerability
in an old version of Winword (v14.0.4762.1000) allowing attackers to use it to load a DLL that has a name matching the original supplied by Microsoft.
In the very same directory where Winword was located, we could see only two additional files, a ... DLL called wwlib.dll, which is normally part of a standard Microsoft Office installation package — this time having an unusually small size — and another file called gimaqkwo.iqq which already looked suspicious, the researchers explained.
Upon further inspection, the wwlib library turned out to be acting as a loader with the sole purpose of reading the main payload that is stored in the encrypted gimaqkwo.iqq file in the same directory, they said. The file name of the payload — the ClientEndPoint backdoor — is stored in an encrypted form in the loader.
The backdoor has functionality typical to this type of malware, including the ability to listen in on user sessions, send and receive commands from the attacker-controlled command and control (C2), and exfiltrate data and send it back to the C2. It also has a proxy configuration mode in which one infected host can receive data and commands from another infected host on the local network while only one of them is in direct communication with the C2.
The fact that two separate security research teams have been investigating a spate of cyberattacks against Taiwanese drone makers brings up the question of motive on the part of attackers, which the Acronis team attempted to address.
Drone manufacturing has increased remarkably in Taiwan since 2022, with significant financial backing from the government, the researchers noted. There currently are about a dozen Taiwanese companies in the space — often providing components for original equipment manufacturers (OEMs) — and even more if the countrys
global aerospace industry
is taken into consideration, they said.
This investment in drone manufacturing and the considerable technological prowess of Taiwan, as well as its position as a US ally, make them a prime target for adversaries interested in military espionage or supply chain attacks, the researchers observed.
The extreme growth of the drone industry in the past decade also had an unfortunate side effect — even consumer models are used for military purposes now, they wrote in the post.
The research team shared their intelligence with Taiwans appropriate cybersecurity authorities and included a list of indicators of compromise (IoCs) in the blog post. As drone makers of all sizes could be targeted by WordDrone attacks, defenders should be mindful of any suspicious activity, especially as it relates to older versions of Microsoft Word that might be present in their environment. Small businesses in the sector in particular should be mindful and shore up defenses, the researchers wrote, as traditional AV solutions are no longer efficient against the type of advanced threats they might face in the near future.
Dont miss the latest
Dark Reading Confidential podcast
,
where we talk to two cybersecurity professionals who were arrested in Dallas County, Iowa and forced to spend the night in jail -- just for doing their pen-testing jobs.
Listen now!

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Ancient MSFT Word Bug Anchors Taiwanese Drone-Maker Attacks