ESET Details Webworm’s New Discord and Microsoft Graph Backdoors
Summary
ESET researchers describe Webworm’s 2025 shift toward European targets, detail its EchoCreep and GraphWorm backdoors and custom proxy tools, and report GitHub staging plus a compromised S3 bucket used for configuration retrieval and data exfiltration.
Key points
- ESET attributes the 2025 activity to Webworm based on decrypted EchoCreep messages, a GitHub repository containing staged tools, and a SoftEther configuration IP matching known Webworm infrastructure.
- ESET observed targeting of government organizations in Belgium, Italy, Serbia and Poland, as well as a university in South Africa, amid a shift from earlier Asia-focused activity.
- EchoCreep uses Discord for command and control; GraphWorm uses Microsoft Graph and OneDrive to receive commands and transfer victim data.
- Researchers decrypted 433 Discord messages and identified four channels they believe correspond to victims; separate reconnaissance artifacts showed scanning against 56 targets.
- Webworm’s custom proxy tools support encrypted communications and chaining connections across multiple hosts; the group also used tools including SoftEther VPN, iox and frp.
- ESET found an S3 bucket used to retrieve WormFrp configurations and reported files it identified as exfiltrated from a Spanish government entity. Italian virtual-machine snapshots were also present, though ESET said the access scope was unclear.
- ESET said it notified affected victims and that identified services, including a GitHub repository and an S3 bucket, were taken down.
Article Details
- Attack Vectors
- Webworm used nuclei to scan for vulnerabilities and dirsearch for wordlist-based web directory and file discovery. Researchers found a proof-of-concept for CVE-2017-7692 among operator artifacts and a similarly named script in a history associated with a Serbian webmail target; they assess that the vulnerability may have been used after credentials were obtained.
- The group staged tools and malware in a forked WordPress repository on GitHub for direct download to compromised systems.
- EchoCreep used Discord for command and control, while GraphWorm used Microsoft Graph API and OneDrive to receive commands and send victim information and files.
- Webworm used proxy tools to retrieve configurations from a compromised S3 bucket, create proxy connections, and support multi-hop traffic routing.
- Defensive Notes
- ESET reports that affected victims in the countries discussed were notified and that the identified GitHub repository and S3 bucket were taken down.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | wamanharipethe[.]s3[.]ap-south-1[.]amazonaws[.]com | Compromised S3 bucket used by WormFrp to retrieve configurations and by Webworm to stage or exfiltrate data. |
| IPV4 | 104[.]243[.]23[.]43 | SmuxProxy server used in Webworm infrastructure. |
| IPV4 | 108[.]61[.]200[.]151 | WormFrp proxy server used in Webworm infrastructure. |
| IPV4 | 144[.]168[.]60[.]233 | Reverse-shell IP discovered on a SmuxProxy server. |
| IPV4 | 45[.]77[.]13[.]67 | WebSocket server used by WormSocket. |
| IPV4 | 64[.]176[.]85[.]158 | SmuxProxy server; an open directory containing operator utilities was previously hosted on this address. |
| SHA1 | 1df40a4a31b30b62ec33dc6fecc2c4408302adc7 | SHA-1 hash of an ssh.exe sample identified as the WormFrp proxy tool. |
| SHA1 | 77f1970d620216c5fff4e14a6ccc13fccc267217 | SHA-1 hash of a C2OverOneDrive_v0316.exe GraphWorm backdoor sample. |
| SHA1 | 7dcfe9ee25841dfd58d3d6871bf867fe32141dfb | SHA-1 hash of an svc.exe sample identified as the WormHole proxy tool. |
| SHA1 | 948159a7fc2e688386864bea59fd40dffc4b24d6 | SHA-1 hash of a MessengerClient.exe WormSocket proxy sample. |
| SHA1 | a3c077bdf8898e612ccd65bc82e7960834adb2a9 | SHA-1 hash of a dsocks.exe sample identified as SmuxProxy. |
| SHA1 | cb4e50433336707381429707f59c3cbe8d497d98 | SHA-1 hash of a SearchApp.exe EchoCreep backdoor sample using Discord for command and control. |
| URL | hxxps[:]//github[.]com/anjsdgasdf/WordPress | Forked repository identified as a Webworm file stager for tools and malware. |
MITRE ATT&CK
T1005 · Data from Local SystemEchoCreep can upload files from the infected host, and GraphWorm collects victim-machine information.T1027.013 · Encrypted/Encoded FileEchoCreep and GraphWorm use encryption and encoding; the article describes AES encryption and base64 encoding of data.T1059.003 · Windows Command ShellEchoCreep executes received shell commands through cmd.exe, and GraphWorm can spawn cmd.exe.T1071.001 · Web ProtocolsEchoCreep sends crafted HTTP requests to Discord APIs; WormSocket also uses HTTP and WebSocket connections.T1074.001 · Local Data StagingGraphWorm writes shell-command output to beacon_shell_output.txt in a temporary directory before upload.T1074.002 · Remote Data StagingGraphWorm stores victim-specific jobs and files in OneDrive through Microsoft Graph API.T1090.003 · Multi-hop ProxyChainWorm and WormSocket can forward traffic across multiple proxy hops.T1102.002 · Bidirectional CommunicationEchoCreep uses Discord and GraphWorm uses Microsoft Graph API for command-and-control communication.T1132.001 · Standard EncodingEchoCreep and GraphWorm use base64 encoding for command or data handling.T1547.001 · Registry Run Keys / Startup FolderGraphWorm persists by modifying registry Run keys.T1567.002 · Exfiltration to Cloud StorageGraphWorm uploads victim data to OneDrive through Microsoft Graph API.T1588.006 · VulnerabilitiesResearchers found a proof-of-concept for CVE-2017-7692 among operator artifacts and a similarly named script associated with a Serbian webmail target; they assess it may have been used after credentials were obtained.T1595.002 · Vulnerability ScanningWebworm used nuclei to scan targets for vulnerabilities.T1595.003 · Wordlist ScanningWebworm used dirsearch wordlists to discover web directories and files on targets.T1608.002 · Upload ToolWebworm staged tools and malware in a GitHub repository for direct download onto compromised systems.
CVE
Threat Actors
Malware
9002 RATIn the past, it made use of well-known malware families such as McRat (aka 9002 RAT) and Trochilus, though in recent years, it has started moving toward both existing and custom proxy tools, which are more stealthy thanEchoCreepESET researchers tracked Webworm, a China-aligned APT group that shifted from Asia to Europe in 2025 and expanded its toolkit with Discord-based EchoCreep and Microsoft Graph API-based GraphWorm backdoors.GraphWormESET researchers tracked Webworm, a China-aligned APT group that shifted from Asia to Europe in 2025 and expanded its toolkit with Discord-based EchoCreep and Microsoft Graph API-based GraphWorm backdoors.TrochilusIn the past, it made use of well-known malware families such as McRat (aka 9002 RAT) and Trochilus, though in recent years, it has started moving toward both existing and custom proxy tools, which are more stealthy than
Vendors
Amazon Web ServicesAn Amazon S3 bucket is a public cloud storage solution available in Amazon Web Services, with the S3 standing for simple storage service.DiscordESET researchers tracked Webworm, a China-aligned APT group that shifted from Asia to Europe in 2025 and expanded its toolkit with Discord-based EchoCreep and Microsoft Graph API-based GraphWorm backdoors.GitHubThe group also relied on GitHub staging, custom proxy tools, and compromised cloud infrastructure such as an Amazon S3 bucket to support spying, exfiltration, and multi-hop proxying.IT7 NetworksAll Webworm proxies and VPN services are cloud servers that belong to network infrastructure controlled by Vultr and IT7 Networks.MicrosoftESET researchers tracked Webworm, a China-aligned APT group that shifted from Asia to Europe in 2025 and expanded its toolkit with Discord-based EchoCreep and Microsoft Graph API-based GraphWorm backdoors.Vultr[T1583.003 ] Acquire Infrastructure: Virtual Private Server – The group used SoftEther VPN servers hosted on cloud services (‘SoftEther VPN servers that have been seen hosted on Vultr cloud services’).
Products
DiscordESET researchers tracked Webworm, a China-aligned APT group that shifted from Asia to Europe in 2025 and expanded its toolkit with Discord-based EchoCreep and Microsoft Graph API-based GraphWorm backdoors.GitHubThe group also relied on GitHub staging, custom proxy tools, and compromised cloud infrastructure such as an Amazon S3 bucket to support spying, exfiltration, and multi-hop proxying.Microsoft GraphESET researchers tracked Webworm, a China-aligned APT group that shifted from Asia to Europe in 2025 and expanded its toolkit with Discord-based EchoCreep and Microsoft Graph API-based GraphWorm backdoors.Microsoft OneDriveWebworm added two new backdoors in 2025: EchoCreep, which uses Discord for C&C, and GraphWorm, which uses Microsoft Graph API and OneDrive.SquirrelMailIt is a proof-of-concept exploit of CVE-2017-7692, a vulnerability allowing post-authentication remote code execution within the webmail client SquirrelMail.
Tools
ChainWormThe group increasingly uses legitimate or semi-legitimate proxy tooling, including SoftEther VPN, frp, iox, and custom tools such as WormFrp, ChainWorm, SmuxProxy, and WormSocket.dirsearch[T1595.003 ] Active Scanning: Wordlist Scanning – Webworm used dirsearch for directory brute forcing and web path discovery (‘used dirsearch, which leverages wordlists, to perform web directory scanning on targets’).FRPThe group increasingly uses legitimate or semi-legitimate proxy tooling, including SoftEther VPN, frp, iox, and custom tools such as WormFrp, ChainWorm, SmuxProxy, and WormSocket.IOXThe group increasingly uses legitimate or semi-legitimate proxy tooling, including SoftEther VPN, frp, iox, and custom tools such as WormFrp, ChainWorm, SmuxProxy, and WormSocket.Nuclei[T1595.002 ] Active Scanning: Vulnerability Scanning – Webworm used nuclei to scan targets for vulnerabilities (‘used the open-source vulnerability scanner nuclei against targets’).SharpSecretsdump[Tool / Script Name ] reconnaissance and exploit artifacts found on operator hosts – _1.sh, SharpSecretsdumpSmuxProxyThe group increasingly uses legitimate or semi-legitimate proxy tooling, including SoftEther VPN, frp, iox, and custom tools such as WormFrp, ChainWorm, SmuxProxy, and WormSocket.SoftEther VPNThe group increasingly uses legitimate or semi-legitimate proxy tooling, including SoftEther VPN, frp, iox, and custom tools such as WormFrp, ChainWorm, SmuxProxy, and WormSocket.WormFrpThe group increasingly uses legitimate or semi-legitimate proxy tooling, including SoftEther VPN, frp, iox, and custom tools such as WormFrp, ChainWorm, SmuxProxy, and WormSocket.WormSocketThe group increasingly uses legitimate or semi-legitimate proxy tooling, including SoftEther VPN, frp, iox, and custom tools such as WormFrp, ChainWorm, SmuxProxy, and WormSocket.
Countries
BelgiumThe group shifted its targeting from Asia toward Europe in 2025, including government entities in Belgium, Italy, Serbia, and Poland, plus a university in South Africa.ChinaESET researchers tracked Webworm, a China-aligned APT group that shifted from Asia to Europe in 2025 and expanded its toolkit with Discord-based EchoCreep and Microsoft Graph API-based GraphWorm backdoors.Czechiabeen executed against 56 targets from a variety of countries such as Spain, Hungary, Belgium, Nigeria, Czechia, and Serbia.Hungaryrevealed that the tool had been executed against 56 targets from a variety of countries such as Spain, Hungary, Belgium, Nigeria, Czechia, and Serbia.ItalyThe group shifted its targeting from Asia toward Europe in 2025, including government entities in Belgium, Italy, Serbia, and Poland, plus a university in South Africa.Nigeriatool had been executed against 56 targets from a variety of countries such as Spain, Hungary, Belgium, Nigeria, Czechia, and Serbia.PolandThe group shifted its targeting from Asia toward Europe in 2025, including government entities in Belgium, Italy, Serbia, and Poland, plus a university in South Africa.SerbiaThe group shifted its targeting from Asia toward Europe in 2025, including government entities in Belgium, Italy, Serbia, and Poland, plus a university in South Africa.South AfricaThe group shifted its targeting from Asia toward Europe in 2025, including government entities in Belgium, Italy, Serbia, and Poland, plus a university in South Africa.SpainBetween December 2025 and January 2026, the operators uploaded 20 new files to the service, two of which had been exfiltrated from a governmental entity in Spain.