# China's Webworm APT Weaponizes Discord and Microsoft Graph in Sophisticated EU Government Campaign


An advanced persistent threat group linked to Chinese state interests has conducted a highly sophisticated cyberattack campaign against European government agencies, leveraging consumer communication platforms and cloud APIs to mask command-and-control infrastructure and maintain persistent network access.


Security researchers have attributed the campaign to Webworm, a Chinese state-sponsored APT group known for targeting government and critical infrastructure sectors. The group's use of Discord—the popular gaming and community communication platform—combined with Microsoft Graph API abuse and SOCKS proxy tunneling, represents an evolution in how nation-state actors are evading traditional security defenses.


## The Threat


Webworm successfully compromised multiple European government networks by exploiting legitimate cloud services to hide their operations in plain sight. Rather than relying on traditional command-and-control (C2) infrastructure that security teams monitor, the attackers established their infrastructure on Discord, embedding malicious commands within seemingly innocuous messages exchanged on the platform.


The attack chain also involved abuse of Microsoft Graph APIs, the unified gateway that provides programmatic access to Microsoft 365 services including email, files, and calendar data. By authenticating through legitimate credentials, Webworm was able to:


  • Query victim email systems and exfiltrate sensitive documents
  • Navigate file shares and cloud storage repositories
  • Maintain persistence through application-level access tokens

    • The operators further obfuscated their activities using SOCKS proxies, including deployment of SoftEther VPN—a legitimate open-source tunneling tool that routes traffic through intermediary servers, making attribution and blocking significantly more difficult.


    ## Background and Context


    Webworm has been identified since at least 2016 as a Chinese state-sponsored group with particular interest in government, military, and critical infrastructure targets across Europe, the Middle East, and Asia-Pacific regions. The group is known for:


  • Sophisticated persistence: Multi-year infections in government networks
  • Low operational visibility: Patient, methodical data exfiltration avoiding detection
  • Supply chain focus: Historical targeting of software vendors and IT service providers
  • Adaptive tradecraft: Rapid adoption of new techniques when existing methods face exposure

    • This campaign represents a notable escalation in the group's operational security practices. Rather than deploying custom malware or using bulletproof hosting providers, Webworm recognized that major cloud service platforms—Discord, Microsoft 365—are difficult for defenders to block wholesale and their traffic blends seamlessly with millions of legitimate users.


    The timing is significant: European nations have increased cybersecurity investments and threat intelligence sharing following high-profile ransomware attacks and Russian state operations. By shifting to cloud-based C2, Webworm may be adapting to enhanced network monitoring and endpoint detection deployed across EU government agencies.


    ## Technical Details


    ### The Attack Vector


    The initial compromise vector has not been fully disclosed in public reporting, but Webworm's historical methods suggest either:


  • Credential compromise via phishing or credential theft
  • Vulnerability exploitation in internet-facing services
  • Insider collaboration (historically suspected in Chinese APT operations targeting governments)

    • Once initial access was established, the group deployed implants capable of communicating with Discord servers under their control.


    ### Command and Control via Discord


    Using Discord as a C2 channel provides several operational advantages:


    | Characteristic | Advantage to Attackers |

    |---|---|

    | Legitimate traffic | Blends with 150+ million Discord users; difficult to distinguish from normal usage |

    | HTTPS encryption | Discord traffic is end-to-end encrypted, hiding commands from network inspection |

    | Scale and resilience | If one Discord bot account is detected, thousands of others can be quickly provisioned |

    | Plausible deniability | User accounts appear to be ordinary community members |

    | Minimal logging | Discord's message retention policies mean evidence of commands may be deleted |


    Webworm configured bot accounts to post messages containing encoded commands. Deployed implants would periodically query specific Discord channels, parse messages, and execute corresponding actions on compromised systems.


    ### Microsoft Graph API Abuse


    Abuse of Microsoft Graph APIs is a concerning trend in modern APT operations because:


    1. Legitimate credentials provide access: If an attacker obtains valid user credentials, they can authenticate directly without deploying malware

    2. Activities blend with normal usage: An administrator downloading files or querying email appears identical to legitimate access

    3. Minimal forensic artifacts: API access is logged, but distinguishing malicious queries from normal IT operations requires sophisticated analysis

    4. Scalable reconnaissance: Graph APIs allow rapid enumeration of organizational structure, sensitive files, and communication patterns


    In this case, Webworm leveraged Graph APIs to map target networks, identify high-value data repositories, and extract sensitive government documents without deploying file-stealing malware that might trigger endpoint detection systems.


    ### SOCKS Proxies and SoftEther VPN


    The use of SoftEther VPN—a legitimate, open-source VPN client—adds another obfuscation layer:


  • Traffic anonymization: All network traffic routes through intermediary SOCKS servers, obscuring true source IP addresses
  • Legitimate software: SoftEther is commonly used for legitimate VPN purposes, making its presence less suspicious
  • Geographic diversity: By routing through proxies in multiple countries, Webworm complicates attribution and blocking efforts

    • This multi-layered tunneling approach is reminiscent of sophisticated criminal operations and reflects the maturity of Chinese state-sponsored tradecraft.


    ## Implications for European Governments


    The successful compromise of multiple EU government networks carries strategic implications:


    Data Exfiltration Risk: Government agencies store classified communications, policy documents, military assessments, and intelligence regarding Chinese activities. Long-term access enables targeted intelligence collection.


    Diplomatic Impact: Cyber espionage operations inform geopolitical negotiations and strategy. Access to internal government communications provides significant negotiating advantage.


    Supply Chain Vulnerability: Government IT infrastructure often integrates with private sector vendors and partners. Compromised government networks may serve as pivot points into broader critical infrastructure.


    Precedent Setting: Successful operations encourage continued investment in similar techniques, establishing new operational norms for state-sponsored cyber operations.


    ## Recommendations


    ### For Government Agencies


  • Credential hygiene: Implement and enforce strong multi-factor authentication (MFA) universally; prioritize phishing-resistant authentication methods
  • Cloud API monitoring: Deploy enhanced logging and alerting on Microsoft 365 API usage, flagging unusual query patterns or access to sensitive data repositories
  • Discord and third-party platform policy: Consider restricting or monitoring use of consumer platforms for business communications; establish approved communication channels
  • Network segmentation: Isolate government networks from consumer internet services where possible; restrict outbound connections to legitimate business purposes
  • Incident response readiness: Assume long-term compromise has already occurred; conduct forensic analysis of cloud logs, email systems, and file access patterns

    • ### For Security Teams


  • Graph API baseline: Establish normal baseline patterns for Microsoft Graph API usage in your organization; configure alerts for anomalies
  • Third-party C2 detection: Develop detection signatures for Discord API calls originating from non-human accounts; monitor for bot-like behavior patterns
  • Proxy hunting: Search firewall and proxy logs for SOCKS traffic or SoftEther VPN signatures; correlate with known Webworm IP infrastructure
  • Credential investigation: Review privileged account usage and API token provisioning; validate all service principals and OAuth applications
  • Threat intelligence sharing: Participate in government-sector information sharing groups to coordinate response and detection across agencies

    • ## HackWire Analysis


    This operation represents a significant inflection point in how nation-state actors approach operational security. Chinese APTs have historically relied on sophisticated custom malware, bulletproof hosting, and technical superiority to evade detection. Webworm's pivot to weaponizing legitimate cloud services signals a maturation in tradecraft: why deploy detectable malware when you can hide in plain sight within services that every enterprise uses and trusts?


    The larger pattern is clear: defenders have made traditional APT infrastructure expensive to maintain. Enhanced network monitoring, DNS sinkholing, bullet-proof hosting takedowns, and endpoint detection platforms have raised costs. By routing through Discord, Webworm achieves C2 functionality that is nearly impossible to block without severely disrupting legitimate business operations. What company can afford to block all Microsoft Graph API traffic? Who blocks Discord entirely?


    This is particularly dangerous for government agencies, which operate with fewer restrictions on employee tool usage than private sector firms. The assumption that "we monitor our networks" becomes dangerously misplaced when attackers are operating through officially sanctioned cloud infrastructure.


    The hidden risk is in *detection ratios*. Thousands of organizations now use Discord for team communication and Microsoft Graph for legitimate administrative tasks. Identifying malicious activity requires sophisticated baseline modeling and behavioral analysis—capabilities that smaller governments may not possess. Webworm is betting on this asymmetry, and the successful compromise of multiple EU agencies suggests the bet is paying off.


    Defenders must fundamentally shift thinking: assume legitimate cloud tools are exfiltration vectors. Implement zero-trust architecture, assume everything is suspicious regardless of source, and invest in behavioral analytics that can identify anomalies within noise. For European governments specifically: this operation underscores the critical importance of the EU Cybersecurity Act and NIS2 directive's requirements for enhanced monitoring and incident reporting. These frameworks exist precisely because nation-states continue to innovate against outdated defenses.


    — HackWire Editorial


    ## Related Coverage


  • Read more in our [Breaches](https://www.hackwire.news/category/breaches) coverage
  • Cross-reference with [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)