GraphWorm

Reported Context (3)

in 2024–2025, replacing older malware such as McRat and Trochilus with backdoors like EchoCreep and GraphWorm while continuing to probe for vulnerabilities and hidden access points. ESET Details Webworm’s Shift to European Government Targets and New C2 Backdoors
Webworm, a China-aligned threat actor active since at least 2022, has expanded its 2025 toolkit with EchoCreep and GraphWorm backdoors that use Discord and Microsoft Graph API for stealthy C2 communications. Webworm Adds EchoCreep and GraphWorm Backdoors Using Discord and Microsoft Graph API
ESET researchers tracked Webworm, a China-aligned APT group that shifted from Asia to Europe in 2025 and expanded its toolkit with Discord-based EchoCreep and Microsoft Graph API-based GraphWorm backdoors. ESET Details Webworm’s New Discord and Microsoft Graph Backdoors

CVE (1)

Malware (7)

People (2)

Threat Actors (6)

MITRE ATT&CK (17)

Vendors (7)

Products (6)

Tools (10)

Industries (4)

Countries (14)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.