Webworm

Also known as: Erudite Mogwai, Space Pirates, Webworm

Space Pirates is a cybercrime group that has been active since at least 2017. They primarily target Russian companies and have been observed using various malware, including Deed RAT and ShadowPad. The group uses a combination of publicly available tools and their own protocols to communicate with their command-and-control servers.

🌍 Country China

Associated Operations

2022-09 2024-11 Space Pirates Targets Russian IT Firms With New LuckyStrike Agent Malware Webworm: Espionage Attackers Testing and Using Older Modified RATs https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/webworm-espionage-rats https://thehackernews.com/2025/02/space-pirates-targets-russian-it-firms.html

Introduction

Space Pirates is a cybercrime group that has been active since at least 2017. They primarily target Russian companies and have been observed using various malware, including Deed RAT and ShadowPad. The group uses a combination of publicly available tools and their own protocols to communicate with their command-and-control servers.

Activities and Tactics

Country of Origin: 🇨🇳 China

Notable Campaigns

  • 2022-09
  • 2024-11
  • Space Pirates Targets Russian IT Firms With New LuckyStrike Agent Malware
  • Webworm: Espionage Attackers Testing and Using Older Modified RATs
  • https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/webworm-espionage-rats
  • https://thehackernews.com/2025/02/space-pirates-targets-russian-it-firms.html

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

  • SPACESHIP
  • CyberGate
  • Cyber Eye RAT
  • 9002 RAT:
  • BH_A006:
  • Deed RAT:
  • Gh0st RAT:
  • MyKLoadClient:
  • PCShare:
  • PlugX:
  • Poison Ivy:
  • ShadowPad Winnti:
  • Trochilus RAT:
  • Zupdax:

Attribution and Evidence

Country of Origin: China Additional attribution information pending cataloguing.

References

References pending cataloguing.