Widely attributedUnknown

Webworm

China-nexus espionage group using customised versions of Trochilus, Gh0st RAT and 9002 RAT. Targets government and IT service providers in Asia and Eastern Europe.

Compare attribution across sources →

Attribution signal

?Score = mentions × confidence weight, summed across all attributed sources. Higher source diversity increases the score.≥ 10 High≥ 3 Moderate< 3 Low

0.8

Low signal strength

Mentions1

Sources1

High conf.1

Last seenMay 2026

First observed

—

Last active

—

Origin

China

Aliases

Techniques

Campaigns

China

TargetsGovernmentTechnology

RegionsAsiaEastern Europe

Attribution signals

1 mention · 1 source

#1high

InfrastructureMalware

eset

May 2026