Analysis on the Case of TIDRONE Threat Actor’s Attacks on Korean Companies

AhnLab ASEC reports that the TIDRONE threat actor has been exploiting small/limited-distribution Korean ERP software (and previously Taiwanese targets) to distribute a RAT called CLNTEND via DLL side‑loading and droppers; the report provides technical analysis of loaders, decryption techniques (including FlsCallback usage), execution paths, sample detections, MD5 hashes and FQDNs, and recommends updating endpoint protection.