Webworm APT targets European government organizations with new backdoors

Multiple high-impact security developments: ESET attributes 2025 activity to Webworm (aka Space Pirates / UAT-8302), a China-aligned APT that has expanded from Asia into Europe and South Africa and is deploying new backdoors against government targets in Belgium, Italy, Poland, Serbia and Spain. Microsoft/GitHub confirmed a TeamPCP compromise of GitHub-internal repositories linked to a poisoned VS Code extension and reported exfiltration consistent with the attacker’s claims. Verizon’s 2026 DBIR finds vulnerability exploitation has overtaken stolen credentials as the leading initial access the