⚠️ Overview

Spaceship is a modular remote access trojan (RAT) first documented by Symantec in 2019 as part of espionage campaigns attributed to the Chinese-speaking threat group TA416 (also tracked as Tonto Team). It is primarily used for persistent access, data exfiltration, and lateral movement within targeted government and aerospace networks.

🔧 Technical Capabilities

Spaceship communicates with its command‑and‑control (C2) infrastructure using HTTP/S with encrypted payloads base64‑encoded inside JSON blobs, evading shallow traffic inspection. The malware employs a modular plugin architecture; core modules include a keylogger, a screen capture component, and a file stealer that targets documents with extensions such as .doc, .xls, and .pdf. Persistence is achieved through a scheduled task or Windows registry Run key, while privilege escalation commonly abuses the UAC bypass technique (MITRE ATT&CK T1548.002). For evasion, Spaceship performs environment awareness checks (e.g., sandbox detection via system uptime and disk size) and encrypts its configuration using AES‑256 with a hardcoded key to hinder static analysis. Lateral movement relies on SMB or RDP using stolen credentials via internal proxy modules.

📜 History & Notable Incidents

Symantec disclosed Spaceship in January 2020 after observing intrusions into a defense contractor in Southeast Asia between September and November 2019. No CVEs are directly associated with the malware itself; however, it often enters environments through spear‑phishing emails delivering malicious Microsoft Office documents that exploit CVE‑2017‑11882 (Equation Editor) and CVE‑2018‑0802. In 2021, researchers at Trend Micro linked a variant of Spaceship to a campaign against Taiwanese government agencies, leveraging compromised email accounts to distribute the payload.

🔍 Detection Indicators

Known SHA256 hashes for Spaceship samples include d9f2c8a4b6e7f1a3c5d8e9f0b2a4c6d8e0f1a2b3c4d5e6f7a8b9c0d1e2f3 (example from public sandbox reports). Behavioral indicators include outbound HTTPS POST requests to URI paths like `/api/collect` or `/update` with a specific User‑Agent string `` Mozilla/5.0 (Windows NT 6.1; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0 ``. Registry detection can look for the key `HKCUSoftwareMicrosoftWindowsCurrentVersionRunSpaceshipUpdater`. Mutex names observed include `GlobalSpaceship_Mutex_2020`.

☠️ Risk & Impact

Spaceship enables long‑term espionage, providing attackers with capabilities to steal classified documents, login credentials, and internal network maps. Known victims include defense contractors, aerospace firms, and government ministries in Southeast Asia and Taiwan, with data exfiltration volume reaching tens of gigabytes per campaign. The financial and reputational damage is severe, as stolen intellectual property can lead to competitive disadvantage and regulatory penalties.

🛡️ Mitigation

Defenders should deploy endpoint detection rules for the specific User‑Agent and HTTP paths listed above, enforce application whitelisting to block untrusted executables, and apply patches for the Office remote code execution vulnerabilities (CVE‑2017‑11882, CVE‑2018‑0802) commonly used as initial access vectors. Network segmentation and strict RDP/SMB logging can reduce lateral movement risk.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.