iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Operation WordDrone was a 2024 intrusion campaign in which attackers used a vulnerable Microsoft Word 2010 loading path to install a persistent backdoor on Taiwanese drone-sector systems. The evidence does not establish that WordDrone and the separately reported TIDRONE activity were the same operation.
What the WordDrone attack was
Acronis Threat Research Unit observed Operation WordDrone from April through July 2024. The campaign targeted Taiwanese drone manufacturers and organizations connected to the country’s military, aerospace and satellite supply chains. Its central technique was DLL side-loading: a genuine Microsoft Word 2010 executable loaded a malicious replacement for a library that normally accompanied it.
The executable identified by Acronis was Winword.exe, version 14.0.4762.1000. Acronis described that specific build as having a side-loading weakness that allowed an attacker to place a DLL with the expected Microsoft-supplied name beside the executable. The executable then loaded the attacker’s library as though it were a normal Word component.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →How the infection chain worked
- Legacy executable: The attackers supplied the Word 2010 executable rather than relying on a current Office installation.
- Malicious
wwlib.dll: A replaced or malicious library was placed where Word would resolve it during startup. - Encrypted payload: The loader read an encrypted file whose filename was randomly generated, making simple filename-based searches unreliable.
install.dll: The payload launched this component, which established persistence through a Windows service, a scheduled task or an injection path.ClientEndPoint.dll: The persistent component provided the operational backdoor.
Acronis documented 59 possible ActionCode values and at least 30 observable execution branches. Some branches could not be fully analyzed, so the published behavior set should be treated as incomplete rather than a definitive list of every capability.
#1 Best Overall
- Classic Office Apps | Includes classic desktop versions of Word, Excel, PowerPoint, and OneNote for creating documents, spreadsheets, and presentations with ease.
- Install on a Single Device | Install classic desktop Office Apps for use on a single Windows laptop, Windows desktop, MacBook, or iMac.
- Ideal for One Person | With a one-time purchase of Microsoft Office 2024, you can create, organize, and get things done.
- Consider Upgrading to Microsoft 365 | Get premium benefits with a Microsoft 365 subscription, including ongoing updates, advanced security, and access to premium versions of Word, Excel, PowerPoint, Outlook, and more, plus 1TB cloud storage per person and multi-device support for Windows, Mac, iPhone, iPad, and Android.
What the backdoor could do
Command and host control
ClientEndPoint.dll supported command-and-control communication, host and user discovery, data transfer and injection of additional payloads. In practical terms, an operator could learn who was logged in, collect information about the machine, exchange files and extend the compromise with further code.
Security-tool interference
The final-stage code could remove hooks from ntdll.dll and add Windows Firewall rules that blocked endpoint-security processes. Acronis linked this behavior to the publicly described EDRSilencer technique, but did not claim that the same author created both tools or techniques.
Rank #2
- Designed for Your Windows and Apple Devices | Install premium Office apps on your Windows laptop, desktop, MacBook or iMac. Works seamlessly across your devices for home, school, or personal productivity.
- Includes Word, Excel, PowerPoint & Outlook | Get premium versions of the essential Office apps that help you work, study, create, and stay organized.
- 1 TB Secure Cloud Storage | Store and access your documents, photos, and files from your Windows, Mac or mobile devices.
- Premium Tools Across Your Devices | Your subscription lets you work across all of your Windows, Mac, iPhone, iPad, and Android devices with apps that sync instantly through the cloud.
- Easy Digital Download with Microsoft Account | Product delivered electronically for quick setup. Sign in with your Microsoft account, redeem your code, and download your apps instantly to your Windows, Mac, iPhone, iPad, and Android devices.
Unresolved named-pipe component
A separate SessionServer.dll created a named pipe and may have proxied command execution through dllhost.exe running in a user context. Acronis could not determine its purpose with certainty. That uncertainty matters when building detections: the component is an observed indicator, not a fully documented part of the operator’s workflow.
What Digiwin and CVE-2024-40521 have to do with it
Acronis found the first malicious files in a directory associated with Digiwin software. It reported that some Digiwin components contained CVE-2024-40521, describing it as a remote-code-execution issue with a CVSS score of 8.8, and assessed exploitation or a supply-chain attack as highly probable.
Rank #3
- THE ALTERNATIVE: The Office Suite Package is the perfect alternative to MS Office. It offers you word processing as well as spreadsheet analysis and the creation of presentations.
- LOTS OF EXTRAS:✓ 1,000 different fonts available to individually style your text documents and ✓ 20,000 clipart images
- EASY TO USE: The highly user-friendly interface will guarantee that you get off to a great start | Simply insert the included CD into your CD/DVD drive and install the Office program.
- ONE PROGRAM FOR EVERYTHING: Office Suite is the perfect computer accessory, offering a wide range of uses for university, work and school. ✓ Drawing program ✓ Database ✓ Formula editor ✓ Spreadsheet analysis ✓ Presentations
- FULL COMPATIBILITY: ✓ Compatible with Microsoft Office Word, Excel and PowerPoint ✓ Suitable for Windows 11, 10, 8, 7, Vista and XP (32 and 64-bit versions) ✓ Fast and easy installation ✓ Easy to navigate
Digiwin disputed that interpretation in a clarification dated September 14, 2024. The company said its ERP products do not contain CVE-2024-40521. It explained that the directory belonged to the DigiwinSCP cloud-management connection tool, not the ERP program, and said it had proactively closed the original connection service while preparing a replacement.
Therefore, the defensible conclusion is narrow: the campaign used files found in a DigiwinSCP-related context, while Digiwin’s published statement rejects the claim that its ERP software was vulnerable. The two statements should not be treated as interchangeable.
Rank #4
- Designed for Your Windows and Apple Devices | Install premium Office apps on your Windows laptop, desktop, MacBook or iMac. Works seamlessly across your devices for home, school, or personal productivity.
- Includes Word, Excel, PowerPoint & Outlook | Get premium versions of the essential Office apps that help you work, study, create, and stay organized.
- Up to 2 TB Shared Cloud Storage | Store and access your documents, photos, and files from your Windows, Mac or mobile devices.
- Premium Tools Across Your Devices | Your subscription lets you work across all of your Windows, Mac, iPhone, iPad, and Android devices with apps that sync instantly through the cloud.
- Share Your Family Subscription | You can share all of your subscription benefits with up to 6 people for use across all their devices.
Are WordDrone and TIDRONE the same group?
No public source cited here proves that they are. Dark Reading noted that WordDrone might be related to earlier TIDRONE incidents involving Taiwan’s military and satellite-industrial supply chain. Kaspersky’s third-quarter 2024 report separately described TIDRONE as a previously undocumented actor with likely Chinese-speaking ties and summarized Acronis’s WordDrone observations. Those reports establish a possible relationship, not a confirmed common operator.
| Comparison point | WordDrone | TIDRONE reporting | Assessment |
|---|---|---|---|
| Primary targets | Taiwanese drone manufacturers and adjacent industrial suppliers | Taiwanese military and satellite-industrial entities | Overlapping strategic ecosystem, but not identical target descriptions |
| Initial-access evidence | Legacy Word 2010 DLL side-loading, with DigiwinSCP-related files in the observed directory | Not established by the cited reports | Insufficient for actor attribution |
| Malware evidence | wwlib.dll, encrypted random-name payload, install.dll, ClientEndPoint.dll and SessionServer.dll |
Specific shared malware was not established in the cited reports | No demonstrated code overlap |
| ERP or remote-access tooling | DigiwinSCP connection-tool context was reported | Not established by the cited reports | Tooling overlap remains unproven |
| Observed period | April–July 2024 | Earlier incidents were reported, but the cited material does not give one matching campaign window | Timing alone cannot link the operations |
| Attribution confidence | Campaign name assigned by Acronis; operator not publicly identified | Likely Chinese-speaking ties reported by Kaspersky | Possible connection, no definitive “same group” finding |
Why drone manufacturers were attractive targets
Drone companies often sit between commercial suppliers and defense, aerospace or satellite programs. Access to engineering files, production data, supplier relationships and communications can support espionage or intellectual-property theft. The same access could also enable disruption. Public reporting cited for WordDrone does not provide a verified victim count, so claims about the campaign’s scale should remain qualified.
Best Value
![Microsoft Office Home & Business 2024 | Classic Desktop Apps: Word, Excel, PowerPoint, Outlook and OneNote | One-Time Purchase for 1 PC/MAC | Instant Download [PC/Mac Online Code]](https://m.media-amazon.com/images/I/41H8B5iqO4L._SL160_.jpg)
- [Ideal for One Person] — With a one-time purchase of Microsoft Office Home & Business 2024, you can create, organize, and get things done.
- [Classic Office Apps] — Includes Word, Excel, PowerPoint, Outlook and OneNote.
- [Desktop Only & Customer Support] — To install and use on one PC or Mac, on desktop only. Microsoft 365 has your back with readily available technical support through chat or phone.
How defenders can detect this side-loading pattern
Hunt for the loader relationship
- Inventory systems that contain
Winword.exeversion14.0.4762.1000, especially copies outside a standard Office installation. - Alert when a Word process loads
wwlib.dllfrom an unexpected directory, when the DLL is unsigned or newly created, or when its signer does not match the installed Office files. - Correlate Word execution with an encrypted, randomly named file being read immediately afterward.
- Search for
install.dll,ClientEndPoint.dllandSessionServer.dllin user-writable or application-data directories, rather than assuming they will be in the normal Office path.
Look for persistence and follow-on behavior
- Review new or modified services, scheduled tasks and process-injection alerts that appear shortly after a legacy Word executable runs.
- Inspect named-pipe creation involving
SessionServer.dlland unusual command activity throughdllhost.exein a user session. - Hunt for Windows Firewall rules that block endpoint-security processes, and investigate any concurrent evidence of user-mode
ntdll.dllhook removal. - Use process, module-load, service, scheduled-task, firewall and DNS or proxy telemetry together; any single indicator can be legitimate in isolation.
Check the Digiwin exposure separately
Identify whether affected systems use the DigiwinSCP connection tool, which is distinct from Digiwin’s ERP products according to the company’s September 14 clarification. Confirm the vendor’s replacement-service guidance and isolate systems that still expose the original connection service.
Incident response priorities
- Isolate the host: Remove compromised machines from the network while preserving volatile evidence where your response procedures allow.
- Acquire evidence: Collect memory, process trees, loaded-module records, service and scheduled-task definitions, firewall-rule changes and the encrypted payload.
- Scope laterally: Search for the same DLL names, Word version, named pipes, persistence artifacts and unusual
dllhost.exeactivity across the environment. - Block command channels: Use network and endpoint controls to stop identified command-and-control destinations, while avoiding destructive cleanup before forensic collection.
- Remove persistence and rebuild when necessary: Delete confirmed malicious services or tasks only after evidence is captured; reimage systems when integrity cannot be established.
- Reset exposed credentials: Change credentials used on affected hosts and review privileged-account activity for the compromise window.
Acronis says its Advanced Security + XDR product detects Operation WordDrone components and can block command-and-control access when URL protection is enabled. Availability through a particular partner or licensing channel must be confirmed separately; the statement is not evidence that every endpoint product detects the campaign.
Bottom line
WordDrone demonstrates how an obsolete, trusted application can become the execution vehicle for a modern intrusion. The strongest evidence is the Word 2010 side-loading chain and its persistent backdoor; the Digiwin connection-tool context requires careful separation from Digiwin ERP; and the suggested TIDRONE connection remains unconfirmed.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
