Webworm
Aliases: Space Pirates
- First seen
- 2017-01-01 00:00:00
- Origin
- CN
- Primary motivation
- financial-gain
- Sophistication
- advanced
- Resource level
- organization
- Actor type
- criminal
- Last IoC activity
- 2026-07-03 00:11:43
- Profile updated
- 2026-07-07 12:09:43
Targeted industries: financial-services technology-and-telecommunications government-and-public-sector
Targeted regions: country_code:ru
Context
Space Pirates is a cybercrime group that has been active since at least 2017. They primarily target Russian companies and have been observed using various malware, including Deed RAT and ShadowPad. The group uses a combination of publicly available tools and their own protocols to communicate with their command-and-control servers.
Reports & references
- Broadcom/Symantec — Webworm Espionage Rats (report)
- ptsecurity.com — Space Pirates A Look Into The Group S Unconventional Techniques New Attack Vectors And Tools (report)
- blog.polyswarm.io — Space Pirates Target Russian Aerospace (report)