GraphWorm Malware Abuses Microsoft OneDrive for Stealthy C2 Operations

This report describes Webworm, a China-aligned APT, evolving in 2025 to use stealthy, cloud-based C2 including a OneDrive/Graph API backdoor (GraphWorm) and a Discord-based backdoor (EchoCreep), supported by custom proxy tools and abused cloud hosting/storage; the campaign targeted multiple European governments and resulted in exfiltration of sensitive data, with detailed IOCs provided.