Webworm APT targets European government organizations with new backdoors
Overview
ESET has reported that the Webworm APT group, also known as Space Pirates and UAT-8302, has shifted its focus from Asian targets to European government organizations in 2025. The group has been active since at least 2022 and is believed to be aligned with China. Its recent targets include government entities in Belgium, Italy, Poland, Serbia, and Spain, as well as a local university in South Africa. This expansion into Europe raises concerns about the potential for increased cyber espionage and data breaches affecting national security and government operations. Organizations in the affected regions need to bolster their cybersecurity measures to defend against these sophisticated attacks.
Key Takeaways
- Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
- Affected Systems: Government organizations in Belgium, Italy, Poland, Serbia, Spain, and a university in South Africa.
- Action Required: Organizations should enhance their cybersecurity protocols, monitor network traffic for suspicious activity, and consider employing advanced threat detection solutions.
- Timeline: Ongoing since 2022
Original Article Summary
ESET has released an analysis of the 2025 activity of Webworm, a China-aligned APT group tracked as Space Pirates and UAT-8302. Active since at least 2022, the group initially focused on targets in Asia, but has recently expanded its operations into Europe. ESET observed Webworm targeting government organizations in Belgium, Italy, Poland, Serbia, and Spain during 2025. The group also expanded its activity into South Africa, where researchers identified activity involving a local university. Discord … More → The post Webworm APT targets European government organizations with new backdoors appeared first on Help Net Security.
Impact
Government organizations in Belgium, Italy, Poland, Serbia, Spain, and a university in South Africa.
Exploitation Status
This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.
Timeline
Ongoing since 2022
Remediation
Organizations should enhance their cybersecurity protocols, monitor network traffic for suspicious activity, and consider employing advanced threat detection solutions.
Additional Information
This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.
Related Topics: This incident relates to APT.