Loading story…
China-aligned threat group Webworm has expanded its espionage toolkit with two custom backdoors, GraphWorm and EchoCreep, using trusted cloud and social platforms for command-and-control. Researchers said GraphWorm is a Go-based implant that abuses Microsoft OneDrive through the Microsoft Graph API, creating a separate workspace for each victim and using cloud folders for tasking, file transfer, shell command execution, configurable sleep intervals, and data exfiltration. EchoCreep was observed using Discord for C2, while the group also staged malware and supporting tools from a GitHub repository masquerading as a WordPress fork.
The activity reflects a broader shift by Webworm away from older RATs such as Trochilus and 9002 RAT toward stealthier proxy and tunneling infrastructure, including SoftEther VPN, WormFrp, ChainWorm, SmuxProxy, and WormSocket. Victims span government and enterprise organizations across Asia and Europe, including entities in Belgium, Italy, Serbia, Poland, and Spain, as well as a university in South Africa; researchers also linked a compromised Amazon S3 bucket to proxy configuration storage and exfiltrated data, including VM snapshots and government documents. Investigators observed the group using tools such as Nuclei and dirsearch, along with a script exploiting a known post-authentication RCE flaw in SquirrelMail, indicating active targeting of exposed web applications for initial access.
TTPs, infrastructure, and targeting history in one profile.
10 events from the most recent confirmed update back to the earliest known activity.
On May 20, 2026, reporting based on ESET research disclosed that Webworm had upgraded its toolkit with GraphWorm and EchoCreep, expanded beyond Asia into Europe and South Africa, and used cloud services such as OneDrive and Discord for command and control.
On 2026-05-19, ESET Research published a GitHub repository of Webworm indicators of compromise, including malware hashes, filenames, detections, and infrastructure tied to tools such as EchoCreep, GraphWorm, WormFrp, ChainWorm, WormSocket, and SmuxProxy. The release also listed IP addresses associated with proxy servers, a web socket server, and a reverse shell endpoint observed in 2025.
Investigators identified a compromised Amazon S3 bucket used by Webworm to store proxy configuration data and exfiltrated information, including VM snapshots tied to an Italian government entity and documents from a Spanish government body.
Researchers found Webworm using a GitHub repository masquerading as a WordPress fork to host malware and operational tools for its campaign.
The group deployed proxy and tunneling tools including Wormsrp or WormFrp, ChainWorm, SmuxProxy, WormSocket, and SoftEther VPN to obscure attacker origin and route traffic through multiple hops.
Researchers observed the group using open-source tools such as Nuclei and dirsearch, along with a script for a known post-authentication remote code execution flaw in SquirrelMail, indicating active targeting of exposed web applications for initial access.
During its renewed 2025 operations, Webworm added two custom backdoors: GraphWorm, a Go-based implant using Microsoft OneDrive via the Graph API, and EchoCreep, which uses Discord for command and control.
Researchers reported renewed Webworm activity during 2025, including expanded targeting of organizations in Europe and a university in South Africa. Victims included government entities in Belgium, Italy, Serbia, Poland, and Spain.
Researchers observed Webworm using the custom EchoCreep backdoor with Discord-based command-and-control infrastructure. ESET said this activity dates back to March 21, 2024.
The China-aligned threat group Webworm has been active since at least 2017, initially focusing primarily on targets in Asia, including government and enterprise organizations in countries such as Russia, Georgia, and Mongolia.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 46 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
7 references tracked. Mallory keeps watching after this page renders.
gist.github.com
Open sourcethehackernews.com
Open sourcecybersecuritynews.com
Open sourcewelivesecurity.com
Open sourcehelpnetsecurity.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **XWorm**, a .NET-based Windows remote access trojan, has been both actively deployed in phishing attacks and marketed online as a builder for criminal operators. The malware has been advertised with modules for **RAT control, ransomware, HVNC, hidden RDP, DDoS, keylogging, credential theft, clipper functions, and persistence**, while incident analysis found live samples communicating with command-and-control servers such as `system6458[.]ddns[.]net` over port `6666`. Reverse engineering also showed that XWorm uses anti-analysis checks to terminate in virtualized or sandboxed environments and can persist through startup-folder copies, scheduled tasks, AppData placement, and registry autorun entries. Separate investigations tied XWorm to ongoing delivery campaigns, including the **MEME#4CHAN** phishing operation, which used fake hotel reservation lures and Microsoft Word documents exploiting `CVE-2022-30190` to launch multi-stage infection chains involving PowerShell, JScript, and in-memory .NET loading. Analysts found XWorm variants capable of **PowerShell execution, in-memory .NET execution, screenshots, plugin retrieval, USB spreading, uninstall functions, and DDoS**, with configuration fields such as `Host`, `Port`, and `KEY` encrypted using AES and derived keys. In some intrusions, the malware disabled **AMSI**, weakened Microsoft Defender, created a local administrator account named **System32**, disabled the Windows Firewall, and injected the final payload into processes including `RegSvcs.exe` and `Msbuild.exe`, with observed C2 infrastructure including `212.87.204[.]83:3000` and `port3000newspm.duckdns[.]org`.
Aug 15, 2026
Researchers reported evolving **multi-stage, script-heavy infection chains** used to deliver remote access trojans, including **XWorm**, **AsyncRAT**, and **Xeno RAT**. Securonix described a campaign dubbed **VOID#GEIST** that starts from phishing-delivered batch scripts fetched from *TryCloudflare* infrastructure, then chains additional batch/PowerShell stages, deploys a legitimate embedded Python runtime, decrypts shellcode, and executes it filelessly by injecting into `explorer.exe` using **Early Bird APC injection**, reducing disk artifacts and making each stage appear benign in isolation. Separately, SANS ISC documented another **XWorm** wave using an obfuscated JavaScript-to-PowerShell loader chain that drops a temporary PowerShell script (e.g., `C:\Temp\ps_...ps1`), decodes additional in-memory PowerShell, and uses a DLL exporting `ProcessHollowing` to inject the XWorm client into a .NET compiler process. The write-up included configuration and IOCs such as a C2 endpoint `204[.]10[.]160[.]190:7003`, mutex `Cqu1F0NxohroKG5U`, and multiple SHA-256 hashes for the JavaScript, PowerShell, DLL loader, and XWorm payload, indicating continued high-volume distribution with frequently changing delivery techniques.
Jun 29, 2026
Researchers detailed multiple China-aligned intrusion sets using modular tooling to compromise targets across Windows, web, and mobile environments. ESET said **TheWizards** used a tool called **Spellbinder** to abuse IPv6 `SLAAC` by sending rogue `ICMPv6 Router Advertisements`, positioning the attackers as the default gateway for adversary-in-the-middle operations. The group then intercepted DNS requests for Chinese software vendors and redirected update traffic so legitimate applications such as **Tencent QQ** and previously **Sogou Pinyin** fetched malicious payloads instead of real updates. The resulting infection chain used a downloader DLL, an encrypted blob, and in-memory loading of the **WizardNet** backdoor, which patched `AMSI` and `ETW`, supported modular execution, and injected shellcode into other processes while maintaining encrypted command-and-control. Separate reporting described broader China-linked operations using flexible malware delivery and post-compromise frameworks. Trend Micro tied **Earth Minotaur** to the **MOONSHINE Exploit Kit** and the **DarkNimbus** Android backdoor, while TrendAI documented **PeckBirdy**, a JScript-based framework used since 2023 across browsers, `MSHTA`, `WScript`, Classic ASP, Node.js, and `.NET ScriptControl` for watering-hole attacks, credential theft, lateral movement, reverse shells, and persistent backdoor access. PeckBirdy was observed in campaigns against Chinese gambling sites, Asian government entities, and private organizations, alongside modular backdoors **HOLODONUT** and **MKDOOR**. The reporting also noted infrastructure and tooling overlaps linking some of these activities to **UNC3569**, **Earth Baxia**, and supplier **UPSEC**, underscoring an ecosystem of China-aligned operators reusing shared malware, hijacking infrastructure, and fake software-update lures.
Aug 21, 2026