Webworm
Also reported as Space Pirates and Erudite Mogwai. Linked to China by three sources.
Reports per quarter
Techniques seen in the last two years
- T1059.003 4 reports
- T1566.001 4 reports
- T1566.002 4 reports
- T1003.001 3 reports
- T1016 3 reports
- T1021.002 3 reports
- T1036.005 3 reports
- T1053.005 3 reports
- T1055 3 reports
- T1056.001 3 reports
Show all 88 techniques Show fewer
- T1057 3 reports
- T1071.001 3 reports
- T1082 3 reports
- T1083 3 reports
- T1087.001 3 reports
- T1095 3 reports
- T1105 3 reports
- T1106 3 reports
- T1140 3 reports
- T1543.003 3 reports
- T1555.003 3 reports
- T1573.001 3 reports
- T1620 3 reports
- T1008 2 reports
- T1027.001 2 reports
- T1027.002 2 reports
- T1033 2 reports
- T1036.004 2 reports
- T1040 2 reports
- T1053.002 2 reports
- T1055.001 2 reports
- T1059.001 2 reports
- T1059.005 2 reports
- T1068 2 reports
- T1069.002 2 reports
- T1071.004 2 reports
- T1078.002 2 reports
- T1087.002 2 reports
- T1090.001 2 reports
- T1091 2 reports
- T1102.002 2 reports
- T1112 2 reports
- T1119 2 reports
- T1132.001 2 reports
- T1190 2 reports
- T1197 2 reports
- T1218.011 2 reports
- T1546.015 2 reports
- T1547.001 2 reports
- T1548.002 2 reports
- T1553.002 2 reports
- T1560.001 2 reports
- T1564.001 2 reports
- T1569.002 2 reports
- T1571 2 reports
- T1572 2 reports
- T1614.001 2 reports
- T1659 2 reports
- T1003.002 1 report
- T1007 1 report
- T1027.013 1 report
- T1027.015 1 report
- T1055.012 1 report
- T1071 1 report
- T1072 1 report
- T1074.001 1 report
- T1125 1 report
- T1189 1 report
- T1195 1 report
- T1212 1 report
- T1217 1 report
- T1218 1 report
- T1480 1 report
- T1556.002 1 report
- T1557 1 report
- T1560 1 report
- T1564.003 1 report
- T1566.003 1 report
- T1567.002 1 report
- T1573.002 1 report
- T1574 1 report
- T1574.014 1 report
- T1583.001 1 report
- T1583.004 1 report
- T1585.003 1 report
- T1588.001 1 report
- T1595.002 1 report
- T1622 1 report
Counts come from technique IDs in the actor's report text.
CVEs named in reports
- CVE-2008-3431 KEV
- CVE-2016-5195 KEV
- CVE-2017-0213 KEV ransomware
- CVE-2017-1182
- CVE-2018-0798 KEV
- CVE-2018-0824 KEV
- CVE-2018-13379 KEV ransomware
- CVE-2018-8872
- CVE-2019-0604 KEV ransomware
- CVE-2019-10149 KEV
- CVE-2019-11510 KEV ransomware
- CVE-2019-16098
Show all 54 CVEs Show fewer
- CVE-2019-19781 KEV ransomware
- CVE-2019-9489
- CVE-2020-0688 KEV ransomware
- CVE-2020-0796 KEV ransomware
- CVE-2020-0986 KEV
- CVE-2020-10189 KEV
- CVE-2020-1380 KEV
- CVE-2020-1472 KEV ransomware
- CVE-2020-15782
- CVE-2020-2021 KEV ransomware
- CVE-2020-8468 KEV
- CVE-2021-1675 KEV ransomware
- CVE-2021-22555 KEV
- CVE-2021-26855 KEV ransomware
- CVE-2021-31207 KEV ransomware
- CVE-2021-34473 KEV ransomware
- CVE-2021-34481
- CVE-2021-34523 KEV ransomware
- CVE-2021-34527 KEV ransomware
- CVE-2021-36958
- CVE-2021-4034 KEV ransomware
- CVE-2021-44515 KEV
- CVE-2022-24682 KEV ransomware
- CVE-2022-24934
- CVE-2022-27924 KEV ransomware
- CVE-2022-27925 KEV ransomware
- CVE-2022-30333 KEV ransomware
- CVE-2022-37042 KEV ransomware
- CVE-2023-36884 KEV ransomware
- CVE-2023-46747 KEV ransomware
- CVE-2024-11182 KEV
- CVE-2024-1709 KEV ransomware
- CVE-2024-24919 KEV ransomware
- CVE-2024-4577 KEV ransomware
- CVE-2024-49039 KEV ransomware
- CVE-2024-7262 KEV
- CVE-2024-7263
- CVE-2024-8190 KEV
- CVE-2024-8963 KEV
- CVE-2024-9680 KEV ransomware
- CVE-2025-55182 KEV ransomware
- CVE-2026-21236
KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.
Reports
-
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Ghost RAT (Malware Family)
-
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Poison Ivy (Malware Family)
Show all 83 reports Show fewer
-
Webworm- Espionage Attackers Testing and Using Older Modified RATs
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Webworm- Espionage Attackers Testing and Using Older Modified RATs
-
Targets of Interest - Russian Organizations Increasingly Under Attack By Chinese APTs
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Targets of Interest - Russian Organizations Increasingly Under Attack By Chinese APTs
-
Space Pirates analyzing the tools and connections of a new hacker group
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Space Pirates analyzing the tools and connections of a new hacker group
-
Winnti is Coming - Evolution after Prosecution@HITCON2021
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Winnti is Coming - Evolution after Prosecution@HITCON2021
-
The original link failed its last check. Original publisher Detailsfor Презентация PowerPoint
-
the-operations-of-winnti-group.pdf
The original link failed its last check. Original publisher Detailsfor the-operations-of-winnti-group.pdf
-
Higaisa or Winnti? APT41 backdoors, old and new
The original link failed its last check. Original publisher Detailsfor Higaisa or Winnti? APT41 backdoors, old and new
-
The original link failed its last check. Original publisher Detailsfor winnti-2020-rus.pdf
Newest first. Details opens the report in Explore.