Space Pirates
Space Pirates is a China-attributed nation-state APT group with an espionage motive, tracked by Brandefense. It targets 4 sectors, including Government and Technology, in 4 countries, including Russia and Georgia. It uses 16 MITRE ATT&CK techniques.
- Erudite Mogwai
- Origin
- China
- Techniques
- 16
- Exploited CVEs
- No CVE data
- First seen
- Jan 1, 2017
- Last seen
- Feb 27, 2025
- Record updated
Who They Target.
About Space Pirates.
Public reporting assesses activity since at least 2017 against government, IT, aerospace, and electric-power related organizations, with strong emphasis on Russian and nearby targets such as Georgia and Mongolia. In a campaign detected by Solar in November 2024 and reported in early 2025, the actors used a previously undocumented.NET backdoor named LuckyStrike Agent with Microsoft OneDrive for command-and-control, alongside Deed RAT (also described as ShadowPad Light) and a customized Stowaway proxy utility. China origin and nation-state classification remain industry vendor assessments rather than independently confirmed state assignment in this packet. currently holds a thin Space Pirates shell with incorrect motivation and broken date fields that require repair.
Last updated Sep 11, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.