Spacecobra

SpaceCobra is a malware group known for its malicious software activities, which have been ongoing since at least 2015. The group is linked to the BingeChat and Chatico campaigns and has revived the GravityRAT malware with enhanced functionalities. This updated version of GravityRAT allows SpaceCobra to extract WhatsApp Messenger backups and receive commands from a Command and Control (C&C) server to delete files. The malware targets Windows, Android, and macOS systems as documented by cybersecurity firms such as Cisco Talos, Kaspersky, and Cyble. Despite extensive research, the identity of the actor behind GravityRAT remains unknown. In 2022, SpaceCobra launched a deceptive application named "Chatico," distributed via the website "chatico.co[.]uk." This app was used in a campaign similar to previous SpaceCobra initiatives, targeting specific individuals. According to ESET telemetry, users in India were among those targeted by the updated Chatico version of the RAT (Remote Access Trojan). In 2023, ESET reported that a Pakistan-based group, also tracked as SpaceCobra, used an updated version of the Android GravityRAT spyware to steal WhatsApp backup files and delete files on victim devices. The use of GravityRAT marks a shift in SpaceCobra's tactics, as it began focusing on Android platforms in 2020. The spyware is exclusively utilized by SpaceCobra for selected operations targeting specific individuals or groups. ESET researchers continue to monitor the group, providing indicators of compromise (IoCs) for this campaign. Despite these efforts, the threat actor behind GravityRAT, and therefore SpaceCobra, remains unidentified, highlighting the sophisticated nature of their operations and the challenges in tracking and mitigating such threats.