Webworm

Executive Summary

Webworm, also known as Space Pirates, is a cybercrime threat actor targeting government and education sectors in multiple countries. Since their activity began in 2017, they have been linked to the use of malware such as Deed RAT and ShadowPad, employing both public tools and custom protocols for communication with command-and-control servers.

Goals & Targeting

Webworm's targeting of government and education sectors suggests potential interests in sensitive data or financial gain. Their focus on multiple countries may indicate a broad operational reach or strategic objectives related to espionage or theft.

Webworm (aka Space Pirates) is a cybercrime group active since at least 2017, primarily targeting Russian companies but also government and education sectors across several countries. They utilize malware like Deed RAT and ShadowPad, combining public tools with custom protocols to communicate with servers. Despite their activity span, details on their primary motivations, goals, and exact tactics remain unclear, creating uncertainty in threat intelligence.

Key Capabilities

• Malware development/deployment (Deed RAT, ShadowPad)
• Use of public tools combined with custom protocols for C2

Software / Tooling

Campaigns & Victims

Webworm's campaigns show persistence and operational skill in leveraging malware. Notable for their malware toolset but lacks specific known campaigns beyond targeting Russian companies.

IOC Patterns

• Presence of Deed RAT/ShadowPad malware indicators
• Network traffic indicative of C2 protocols used by Webworm

Recommended Actions

• Monitor for custom protocol-based C2 activity
• Implement endpoint detection to identify Deed RAT/ShadowPad signatures
• Conduct regular vulnerability assessments in targeted sectors

Suggested Tags