Loading threat actor…
Webworm is a China-aligned cyber espionage threat actor active since at least 2017. It is also tracked as Space Pirates and UAT-8302, and has documented tradecraft overlaps with FishMonger and SixLittleMonkeys. Multiple assessments indicate Webworm and Space Pirates are likely the same cluster. Webworm has targeted government organizations and enterprises, with observed victimology spanning IT services, aerospace, electric power, and academia. Early activity focused on Russia, Georgia, Mongolia, and other Asian countries, while later operations expanded into Europe and South Africa. Confirmed targeting includes government entities in Belgium, Italy, Poland, Serbia, and Spain, as well as a university in South Africa. The group has used customized variants of older remote access trojans including Trochilus, Gh0st RAT, and 9002 RAT, and later introduced newer backdoors such as EchoCreep and GraphWorm. EchoCreep uses Discord for command and control, while GraphWorm uses Microsoft Graph API and OneDrive to retrieve tasks and upload victim data. Webworm has also relied heavily on proxying and tunneling tooling, including SoftEther VPN and custom or modified proxy utilities such as WormFrp, ChainWorm, SmuxProxy, and WormSocket, indicating an emphasis on covert routing and layered operational infrastructure. Observed tradecraft includes reconnaissance and vulnerability scanning against exposed services, use of open-source scanning tools, exploitation of known web-application vulnerabilities, DLL sideloading, multi-stage loaders, token theft, User Account Control bypass, persistence mechanisms, process injection into legitimate Windows processes, and in-memory execution of payloads. Webworm has staged malware and support tooling through trusted public platforms including GitHub, Discord, Microsoft cloud services, and compromised cloud storage, and has used these channels for command and control, configuration retrieval, and data exfiltration. Webworm’s malware development pattern shows sustained customization of public or older malware codebases rather than exclusive reliance on wholly novel implants. This includes modified communication protocols, altered encryption schemes, and platform-specific adaptations intended to improve stealth and complicate detection and attribution. Its operations are consistent with long-term intelligence collection rather than financially motivated crime.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
54 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
18 malware families attributed to this actor across reporting.
13 additional families tracked in Mallory.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
52 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Used legitimate platforms for command-and-control, deploying backdoors via Discord and the Microsoft Graph API.
Chinese state-linked group noted here for shared tradecraft and use of the Trochilus codebase alongside FishMonger and SixLittleMonkeys.
Chinese threat actor linked in the article through use of Trochilus and noted to share tradecraft commonalities with FishMonger and SixLittleMonkeys.
Cyber-espionage activity cluster active since at least 2017 that develops customized versions of older RATs and targets government agencies and enterprises in IT services, aerospace, and electric power sectors across Russia, Georgia, Mongolia, and other Asian countries.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.