Researchers Expose Space Pirates’ Cyber Campaign Across Russia and Serbia

Teilen:

The threat actor known as Space Pirates has been linked to attacks against at least 16 organizations in Russia and Serbia over the past year by employing novel tactics and adding new cyber weapons to its arsenal.

The cybercriminals’ main goals are still espionage and theft of confidential information, but the group has expanded its interests and the geography of its attacks, Positive Technologies said in a deep dive report published last week.

Targets comprise government agencies, educational institutions, private security companies, aerospace manufacturers, agricultural producers, defense, energy, and healthcare firms in Russia and Serbia.

Space Pirates was first exposed by the Russian cybersecurity company in May 2022, highlighting its attacks on the aerospace sector in the nation. The group, believed to be active since at least late 2019, has links to another adversary tracked by Symantec as Webworm.

Positive Technologies’ analysis of the attack infrastructure has revealed the threat actor’s interest in harvesting PST email archives as well as making use of Deed RAT, a malware artifact exclusively attributed to the adversarial collective.

Deed RAT is said to be a successor to ShadowPad, which in itself is an evolution of PlugX, both of which are widely used by Chinese cyber espionage crews. Under active development, the malware comes in both 32- and 64-bit versions and is equipped to dynamically retrieve additional plug-ins from a remote server.

This includes a Disk plug-in to enumerate files and folders, execute commands, write arbitrary files to disk, and connect to network drives and a Portmap module that’s used for port forwarding.

Deed RAT also functions as a conduit to serve next-stage payloads such as Voidoor, a previously undocumented malware that’s is designed to contact a legitimate forum called Voidtools and a GitHub repository associated with a user named hasdhuahd for command-and-control (C2).

Voidtools is the developer of a freeware desktop search utility for Microsoft Windows called Everything, with its forum powered using an open-source forum software called MyBB. The primary goal of Voidoor is to login to the forum using hard-coded credentials and access the user’s personal messaging system to look for a folder matching a particular victim ID.

Evidence shows that the accounts on GitHub and voidtools were registered sometime in November 2022.

The hackers are working on new malware that implements unconventional techniques, such as Voidoor, and modifying their existing malware, Positive Technologies said, adding the actors use a large number of publicly available tools for navigating networks and leverage the Acunetix web vulnerability scanner to reconnoiter infrastructures it targets.

 

(c) Thin

Kommentar verfassen

Deine E-Mail-Adresse wird nicht veröffentlicht. Erforderliche Felder sind mit * markiert

lade-bild
London, GB
9:35 am, Juli 8, 2025
Wetter-Symbol 18°C
L: 16° | H: 18°
klarer Himmel
Luftfeuchtigkeit: 57 %
Druck: 1017 mb
Wind: 4 mph NE
Windböe: 10 mph
UV-Index: 0
Niederschlag: 0 mm
Wolken: 0%
Regen Chance: 0%
Sichtbarkeit: 10 km
Sonnenaufgang: 4:53 am
Sonnenuntergang: 9:17 pm
TäglichStündlich
Tägliche VorhersageStündliche Vorhersage
Today 10:00 pm
Wetter-Symbol
16° | 18°°C 0 mm 0% 8 mph 57 % 1019 mb 0 mm/h
Tomorrow 10:00 pm
Wetter-Symbol
15° | 26°°C 0.1 mm 10% 8 mph 59 % 1023 mb 0 mm/h
Do. Juli 10 10:00 pm
Wetter-Symbol
18° | 30°°C 0 mm 0% 7 mph 75 % 1024 mb 0 mm/h
Fr. Juli 11 10:00 pm
Wetter-Symbol
19° | 29°°C 0 mm 0% 9 mph 68 % 1023 mb 0 mm/h
Sa. Juli 12 10:00 pm
Wetter-Symbol
18° | 28°°C 0 mm 0% 11 mph 71 % 1020 mb 0 mm/h
Today 10:00 am
Wetter-Symbol
18° | 18°°C 0 mm 0% 8 mph 57 % 1017 mb 0 mm/h
Today 1:00 pm
Wetter-Symbol
19° | 22°°C 0 mm 0% 8 mph 50 % 1017 mb 0 mm/h
Today 4:00 pm
Wetter-Symbol
23° | 25°°C 0 mm 0% 7 mph 37 % 1017 mb 0 mm/h
Today 7:00 pm
Wetter-Symbol
24° | 24°°C 0 mm 0% 7 mph 28 % 1017 mb 0 mm/h
Today 10:00 pm
Wetter-Symbol
19° | 19°°C 0 mm 0% 5 mph 40 % 1019 mb 0 mm/h
Tomorrow 1:00 am
Wetter-Symbol
17° | 17°°C 0 mm 0% 5 mph 50 % 1020 mb 0 mm/h
Tomorrow 4:00 am
Wetter-Symbol
15° | 15°°C 0 mm 0% 4 mph 59 % 1021 mb 0 mm/h
Tomorrow 7:00 am
Wetter-Symbol
16° | 16°°C 0 mm 0% 5 mph 53 % 1021 mb 0 mm/h
Name Preis24H (%)
Bitcoin(BTC)
€92,415.45
-0.41%
Ethereum(ETH)
€2,177.58
-0.74%
Fesseln(USDT)
€0.85
-0.01%
XRP(XRP)
€1.94
0.44%
Solana(SOL)
€127.90
-1.57%
USDC(USDC)
€0.85
0.01%
Dogecoin(DOGE)
€0.144139
-1.99%
Shiba Inu(SHIB)
€0.000010
0.06%
Pepe(PEPE)
€0.000009
-1.83%
Nach oben scrollen