Malware
SPACESHIP
SPACESHIP searches for files with a specified set of file extensions and copies them to a removable drive.
SPACESHIP is a Windows malware family operated by APT 30.
Background
SPACESHIP looks for files matching a predefined list of extensions and transfers them onto a removable drive. According to FireEye, SHIPSHAPE serves to copy SPACESHIP onto such a drive, which can then carry the infection to another machine, including air-gapped ones. Once on the isolated host, SPACESHIP harvests documents and writes them to a removable drive plugged into the SPACESHIP-infected system.
Source: Malpedia (Fraunhofer FKIE).