Webworm

Also known as Space Pirates

Space Pirates is a cybercrime group that has been active since at least 2017. They primarily target Russian companies and have been observed using various malware, including Deed RAT and ShadowPad. The group uses a combination of publicly available tools and their own protocols to communicate with their command-and-control servers.

Recent activity

No posts or advisories have named this actor recently.

References

• http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/webworm-espionage-rats
• https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/space-pirates-a-look-into-the-group-s-unconventional-techniques-new-attack-vectors-and-tools/
• https://blog.polyswarm.io/space-pirates-target-russian-aerospace

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.