Webworm Deploys EchoCreep and GraphWorm Backdoors Using Discord and MS Graph API

Webworm, a China-aligned threat actor, deploys new backdoors EchoCreep and GraphWorm that use Discord and Microsoft Graph API for C2 communications in 2025.

• •EchoCreep and GraphWorm enable file upload/download, command execution via cmd.exe, and OneDrive integration for stealthy operations
• •The threat actor has shifted from traditional RATs like Trochilus and Gh0st to legitimate utilities and custom proxy tools to evade detection
• •Webworm targets government and enterprise sectors across Russia, Asia, and increasingly Europe since at least 2022
• •Custom proxy tools including WormFrp, ChainWorm, SmuxProxy, and WormSocket support encryption and network chaining for operational security
• •GitHub repositories impersonating WordPress and SoftEther VPN are leveraged as infrastructure for malware staging and communication concealment