Webworm is a cybercrime group targeting Russian companies with Deed RAT and ShadowPad malware.
Webworm, also known as Space Pirates, is a cybercrime group active since at least 2017. They primarily target Russian companies. The group utilizes malware such as Deed RAT and ShadowPad, alongside custom C2 communication protocols. Defenders should focus on indicators for these specific RATs and monitor for anomalous network traffic.
Space Pirates is a cybercrime group that has been active since at least 2017. They primarily target Russian companies and have been observed using various malware, including Deed RAT and ShadowPad. The group uses a combination of publicly available tools and their own protocols to communicate with their command-and-control servers.
The Webworm group uses Deed RAT and ShadowPad malware.
Defenders should focus on indicators for Deed RAT and ShadowPad, as well as monitor for anomalous network traffic.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.