ESET Details Webworm’s Shift to European Government Targets and New C2 Backdoors
Summary
ESET reports that China-aligned Webworm has shifted toward European government targets and introduced EchoCreep, using Discord for C2, and GraphWorm, using Microsoft Graph and OneDrive. Its initial access vector remains unclear.
Key points
- ESET reports Webworm activity targeting government organizations in Belgium, Italy, Serbia, Spain and Poland, as well as activity in South Africa.
- In 2025, Webworm introduced EchoCreep, which uses Discord to receive commands, upload files and send runtime reports, and GraphWorm, which uses Microsoft Graph and OneDrive to receive jobs and upload victim information.
- ESET attributed EchoCreep activity in part by decrypting Discord messages that led to a GitHub repository and an IP address matching one previously associated with Webworm.
- Webworm has used SoftEther VPN and custom proxy tools, including ChainWorm, SmuxProxy, WormFrp and WormSocket, to tunnel communications and connect hosts.
- ESET observed WormFrp retrieving configurations from a compromised Amazon S3 bucket; the initial access vector and much of the attack chain remain unclear.
- ESET recommends patching systems, limiting exposed assets, and monitoring unusual communications and data transfers to Discord, Microsoft Graph and S3.
Article Details
- Attack Vectors
- Webworm used open-source vulnerability scanners to search target web-server files and directories for vulnerabilities; the initial access vector remains unclear.
- After compromise, EchoCreep used Discord for command and control, while GraphWorm used Microsoft Graph and OneDrive endpoints to receive jobs and upload victim information.
- Webworm staged malware and tools in GitHub repositories for download onto victim machines.
- The group used proxy tools, SoftEther VPN, port forwarding, and proxy chaining to tunnel communications between hosts inside and outside victim networks.
- WormFrp was used to retrieve configurations from a compromised Amazon S3 bucket.
- Defensive Notes
- Keep systems patched and limit the exposure of assets.
- Review communications from non-standard processes and applications to Discord, Microsoft Graph, and S3.
- Monitor data transfers to those endpoints, especially when they are outside standard workflows.
MITRE ATT&CK
T1090 · ProxyWebworm used SOCKS proxies, SoftEther VPN, port forwarding, and custom proxy tools to relay communications between hosts.T1102.002 · Bidirectional CommunicationEchoCreep exchanged commands and files through Discord, while GraphWorm used Microsoft Graph and OneDrive endpoints to receive jobs and upload victim information.T1105 · Ingress Tool TransferWebworm staged malware and tools in GitHub repositories so they could be downloaded onto victim machines.T1567.002 · Exfiltration to Cloud StorageGraphWorm uploaded victim information through OneDrive endpoints.T1595.002 · Vulnerability ScanningWebworm used open-source vulnerability scanners to search target web-server files and directories for vulnerabilities.
People
Threat Actors
Malware
9002 RATESET says the group has evolved its tradecraft in 2024–2025, replacing older malware such as McRat and Trochilus with backdoors like EchoCreep and GraphWorm while continuing to probe for vulnerabilities and hiddenEchoCreepits tradecraft in 2024–2025, replacing older malware such as McRat and Trochilus with backdoors like EchoCreep and GraphWorm while continuing to probe for vulnerabilities and hidden access points.GraphWormin 2024–2025, replacing older malware such as McRat and Trochilus with backdoors like EchoCreep and GraphWorm while continuing to probe for vulnerabilities and hidden access points.TrochilusESET says the group has evolved its tradecraft in 2024–2025, replacing older malware such as McRat and Trochilus with backdoors like EchoCreep and GraphWorm while continuing to probe for vulnerabilities and hidden
Vendors
ESETESET says the group has evolved its tradecraft in 2024–2025, replacing older malware such as McRat and Trochilus with backdoors like EchoCreep and GraphWorm while continuing to probe for vulnerabilities and hiddenIT7 Networks“All Webworm proxies and VPN services are cloud servers that belong to network infrastructure controlled by Vultr and IT7 Networks.Vultr#Webworm
Products
DiscordAsia to European governmental organizations and is using stealthier command-and-control methods like Discord, Microsoft Graph, and custom proxy tools.GitHubESET also observed Webworm staging malware and tools in GitHub repositories so the attackers can easily download malware onto the victim’s machine.Microsoft Graphgovernmental organizations and is using stealthier command-and-control methods like Discord, Microsoft Graph, and custom proxy tools.Microsoft OneDriveEchoCreep uses Discord for command and control, while GraphWorm uses Microsoft Graph and OneDrive.
Tools
ChainWorm#WebwormIOXThese proxy solutions include port forwarding and proxy tool iox as well as custom tools ChainWorm, SmuxProxy, WormFrp, and WormSocket.SmuxProxy#WebwormSoftEther VPNIn these cases, which were mainly observed in 2024, Webworm relied on “legitimate or semi-legitimate tools, such as SOCKS proxies (SoftEther VPN) and other networking solutions.”WormFrp#WebwormWormSocket#Webworm
Countries
Belgiumwrote that the threat actor has shifted its focus to Europe, including governmental organizations in Belgium, Italy, Serbia, Spain, and Poland.ChinaWebworm, a China-backed persistent threat actor, has shifted its targeting from Asia to European governmental organizations and is using stealthier command-and-control methods like Discord, Microsoft Graph, and customItalythat the threat actor has shifted its focus to Europe, including governmental organizations in Belgium, Italy, Serbia, Spain, and Poland.Polandshifted its focus to Europe, including governmental organizations in Belgium, Italy, Serbia, Spain, and Poland.Serbiathe threat actor has shifted its focus to Europe, including governmental organizations in Belgium, Italy, Serbia, Spain, and Poland.South AfricaThe group has shifted from Asia-focused operations to Europe and South Africa.Spainactor has shifted its focus to Europe, including governmental organizations in Belgium, Italy, Serbia, Spain, and Poland.