GraphWorm Malware Abuses Microsoft OneDrive For C2 Operations

ESET researchers attribute a 2025 espionage campaign to the China-aligned APT group Webworm, which replaced older tools with two Go backdoors—GraphWorm (using Microsoft Graph/OneDrive for encrypted C2) and EchoCreep (Discord-based C2)—targeting government organizations across Europe and beyond; the report describes persistence, command capabilities, custom proxy infrastructure, victim countries, and provides SHA-1 indicators.