WebwormThreat actor
- space pirates
Space Pirates is a cybercrime group that has been active since at least 2017. They primarily target Russian companies and have been observed using various malware, including Deed RAT and ShadowPad. The group uses a combination of publicly available tools and their own protocols to communicate with their command-and-control servers.From MISP Galaxy
Last reported 5 months ago, by ESET WeLiveSecurity (ES)2 reports
ATT&CK techniques
6 of 36 · each with the sentence it comes from- T1005Data from Local System
“T1005”
- T1021.007Cloud Services
“T1021.007”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information: Encrypted/Encoded File”
- T1027.013Encrypted/Encoded File
“T1027.013”
- T1041Exfiltration Over C2 Channel
“T1041”
- T1053Scheduled Task/Job
“Scheduled Task/Job: Scheduled Task”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Webworm: el grupo APT evoluciona sus tácticas y se apoya en plataformas legítimas“Webworm: el grupo APT evoluciona sus tácticas y se apoya en plataformas legítimas”
-
Webworm: New burrowing techniques“Webworm: New burrowing techniques”
Indicators in its reports
named in the reports above- wamanharipethe.s3.ap-south-1.amazonaws[.]comin 2 reports
- whpjewellers.s3.amazonaws[.]comin 2 reports
- hxxps://github[.]com/anjsdgasdf/WordPressin 2 reports
- 64.176.85[.]158in 2 reports
- socket[.]ioin 2 reports
- cb4e504333367073…3cbe8d497d98in 2 reports
- 1df40a4a31b30b62…c4408302adc7in 2 reports
- 7dcfe9ee25841dfd…67fe32141dfbin 2 reports
- 77f1970d620216c5…13fccc267217in 2 reports
- 948159a7fc2e6883…40dffc4b24d6in 2 reports
- a3c077bdf8898e61…960834adb2a9in 2 reports
- 45.77.13[.]67in 2 reports
- 104.243.23[.]43in 2 reports
- 108.61.200[.]151in 2 reports
- 144.168.60[.]233in 2 reports
Copy these 15 indicators · defanged
Thanks — we review every report.