CyberHappenings logo
☰
Home Browse Watchlists Experimental About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

China-nexus Webworm expands toolset with EchoCreep and GraphWorm backdoors leveraging Discord and Microsoft Graph API for C2

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

A China-aligned threat actor tracked as Webworm has deployed two new custom backdoors, EchoCreep and GraphWorm, using Discord and Microsoft Graph API respectively for command-and-control (C2) communications during 2025 activities. The group, active since at least 2022 and previously associated with RATs such as Trochilus, Gh0st, and 9002, has shifted toward stealthier (semi-)legitimate utilities including SOCKS proxies and custom proxy tools like WormFrp, ChainWorm, SmuxProxy, and WormSocket. Targeting spans government agencies and enterprises in Russia, Georgia, Mongolia, European countries including Belgium, Italy, Serbia, and Poland, and a university in South Africa, often blending operations using SoftEther VPN and GitHub-hosted malware staging. Initial access vectors remain unclear though brute-forcing of web server files and directories using open-source tools like dirsearch and nuclei has been observed.

Timeline

  1. 20.05.2026 15:51 1 articles · 6h ago

    Webworm deploys EchoCreep and GraphWorm backdoors via Discord and Microsoft Graph API in 2025 campaigns

    China-nexus threat actor Webworm has deployed two new custom backdoors, EchoCreep and GraphWorm, using Discord and Microsoft Graph API respectively for command-and-control communications during 2025 operations. EchoCreep enables file upload/download and command execution via cmd.exe, while GraphWorm supports process spawning, file transfer via OneDrive, and self-termination on operator signal. The actor’s shift away from traditional RATs such as Trochilus and 9002 aligns with increased use of stealthier proxy tools including WormFrp, ChainWorm, SmuxProxy, and WormSocket, which support encrypted multi-hop chaining and configuration retrieval from compromised Amazon S3 buckets. Webworm’s operational footprint includes targeting government agencies and enterprises across Russia, Georgia, Mongolia, and multiple European countries, with evidence of initial access via brute-force scanning of web server files and directories using dirsearch and nuclei.

    Show sources
    Open in new tab

Information Snippets