# Webworm Deploys EchoCreep and GraphWorm Backdoors Through Discord and Microsoft Graph API


## Breaking Through Legitimate Channels: China-Aligned Threat Actor Escalates Sophistication with API-Based Command-and-Control


A China-aligned threat actor known as Webworm has resumed active operations in 2025 with a new arsenal of custom backdoors—EchoCreep and GraphWorm—that leverage Discord and Microsoft's Graph API for command-and-control (C2) communications. Security researchers tracking the group document the strategic use of legitimate, widely-trusted platforms to evade traditional network detection, marking a significant escalation in the group's operational sophistication.


The backdoors represent a calculated departure from conventional C2 infrastructure. By tunneling commands through Discord's messaging API and Microsoft's cloud services API, Webworm operators reduce their attack surface to detection and complicate incident response efforts. Organizations relying on perimeter-based security controls and legacy network monitoring may find these backdoors particularly difficult to identify.


## The Threat: New Backdoor Capabilities


Webworm's 2025 toolkit introduces two distinct backdoor implants designed for persistence and remote access:


EchoCreep Backdoor:

  • Command execution and lateral movement capabilities
  • Discord-based C2 for encrypted, authenticated communications
  • Modular payload delivery architecture
  • Designed to evade signature-based detection

    • GraphWorm Backdoor:

  • Microsoft Graph API integration for C2 signaling
  • Leverages Office 365 and Azure infrastructure for command relay
  • Blends malicious traffic with legitimate cloud service activity
  • Enables data exfiltration through trusted Microsoft services

    • Both implants support:

  • Interactive command shell access
  • File transfer and data exfiltration
  • Privilege escalation mechanisms
  • Secondary payload deployment

    • ## Background and Context: Webworm's Evolution as a Persistent Threat


    ### Who Is Webworm?


    Webworm emerged as a distinct threat actor in the cybersecurity landscape when Symantec first documented the group in September 2022. Security analysts have assessed the group to be operating since at least 2022, with targeting primarily focused on government agencies and related critical infrastructure sectors. The attribution to a China-aligned threat group places Webworm within a broader ecosystem of state-sponsored operators focused on intelligence collection, espionage, and strategic network access.


    ### Historical Operations


    Prior to the 2025 activity, Webworm was known for:

  • Spear-phishing campaigns targeting government networks with sophisticated social engineering
  • Custom malware development adapted to specific victim environments
  • Living-off-the-land techniques leveraging legitimate Windows utilities to minimize detection
  • Multi-stage infection chains designed to establish deep persistence before lateral movement

    • The group's targeting has consistently favored government and quasi-governmental entities, suggesting a strategic intelligence-collection mission rather than opportunistic cybercrime.


    ### Operational Pattern Recognition


    Webworm's tactical evolution—from conventional malware to API-based C2—reflects a mature organization learning from global visibility of past intrusions. The shift toward Discord and Microsoft Graph API represents an acknowledgment that traditional C2 infrastructure has become increasingly detectable through traffic analysis and domain reputation systems.


    ## Technical Details: How the Backdoors Operate


    ### Discord as Command-and-Control Infrastructure


    Discord, the text and voice communication platform, provides Webworm operators with several advantages:


  • Legitimacy masking: Millions of organizations and individuals use Discord daily; command traffic blends seamlessly with legitimate activity
  • Encrypted channels: Discord's API supports encrypted messages, adding a layer of obfuscation
  • Rapid message deletion: The platform allows operators to erase commands and responses, reducing forensic evidence
  • Webhook integration: Automated message routing enables asynchronous command execution without active operator presence
  • Bot functionality: Discord bots can authenticate and receive instructions without human-like interaction patterns

    • Infection chains typically proceed as follows:


    1. Initial compromise via spear-phishing or supply chain attack

    2. Implant dropper downloads and executes EchoCreep

    3. Discord API credentials hard-coded or dynamically retrieved from command-and-control

    4. Bot enrollment in attacker-controlled Discord server

    5. Persistent polling of Discord channels for new commands at regular intervals

    6. Command execution with results posted back to Discord channels


    ### Microsoft Graph API as Covert Signaling Channel


    GraphWorm's use of Microsoft's Graph API is particularly sophisticated:


    | Characteristic | Advantage for Attacker |

    |---|---|

    | Authentication | OAuth tokens appear as legitimate user/service principal activity |

    | Volume | Graph API traffic is ubiquitous in modern enterprises; malicious requests disappear in the noise |

    | Logging gaps | Many organizations lack comprehensive Graph API audit logging |

    | Persistence | API calls don't require traditional malware persistence mechanisms |

    | Deniability | Operators can route commands through compromised legitimate accounts |


    GraphWorm queries against the Graph API endpoint (/me/messages, /me/mailFoldersByPath) appear as routine cloud productivity activity in Azure AD and Office 365 logs.


    ## Implications for Organizations


    ### Who Is at Risk?


  • Government agencies (primary target based on historical targeting)
  • Critical infrastructure operators (energy, transportation, communications)
  • Organizations with extensive Microsoft 365 deployments (expanded attack surface)
  • Entities managing sensitive national interests

    • ### Detection Challenges


    Traditional security monitoring often fails to catch these backdoors because:


  • EDR tools lack Discord/Graph API behavior baselines
  • Proxy logs show encrypted connections to legitimate platforms
  • SIEM rules rarely flag Microsoft Graph API anomalies unless specifically configured
  • Endpoint telemetry may miss malicious code execution if obfuscated or memory-resident

    • ### Dwell Time Risk


    If EchoCreep or GraphWorm achieve persistence in a government network, the time to detection could extend significantly—potentially months—before forensic analysis reveals the compromise.


    ## Recommendations for Defense


    ### For Organizations


    Immediate Actions:

  • Hunt for Discord API calls originating from internal networks (especially from non-user-facing systems)
  • Audit Microsoft Graph API authentication logs for anomalous service principals or user accounts
  • Review Discord application integrations within your organization
  • Block Discord and other general-purpose communication platforms at the firewall unless explicitly required

    • Medium-Term Actions:

  • Implement API behavioral analytics to detect unusual Graph API query patterns
  • Enforce OAuth token lifetime limits and mandatory re-authentication for sensitive operations
  • Deploy endpoint detection and response (EDR) with behavioral analysis for process creation and API calls
  • Segment networks to prevent lateral movement from an initial compromise point
  • Increase audit logging for Office 365, Azure AD, and application-level authentication

    • Long-Term Strategy:

  • Assume breach mentality for government and critical infrastructure networks
  • Develop playbooks specifically for API-based C2 incidents
  • Conduct red-team exercises simulating Webworm tactics
  • Establish threat intelligence sharing with peers and relevant government agencies

    • ### For Security Vendors


  • Develop Graph API behavioral baselines to distinguish malicious from legitimate traffic
  • Create signatures and heuristics for Discord bot authentication patterns
  • Enhance Office 365 audit logging visibility in SIEM platforms
  • Improve cross-platform threat correlation between Discord activity and endpoint telemetry

    • ## HackWire Analysis


    Webworm's shift to Discord and Microsoft Graph API for C2 signals a critical inflection point in state-sponsored tradecraft. This is not incremental optimization—it represents a fundamental recognition that traditional infrastructure-based C2 has become commoditized and detectable. By migrating command channels to platforms with billions of legitimate daily transactions, Webworm operators have effectively raised the baseline difficulty for defenders.


    What makes this particularly concerning is the targeting vector intersection: government agencies and critical infrastructure operators often deploy Microsoft 365 heavily for productivity and collaboration. GraphWorm transforms this infrastructure advantage into an attack surface. A single compromised Exchange Online mailbox or service principal becomes a potential C2 staging ground.


    The API-based C2 pattern represents a broader trend: advanced persistent threat actors are systematically eliminating the "tell-tale" indicators of compromise that security teams trained on for decades. IP reputation? Bypassed. Domain blacklists? Irrelevant. Certificate anomalies? Masked by legitimate platform certificates. Instead, defenders now face the inverse problem: distinguishing malicious API calls from the overwhelming volume of legitimate ones.


    For defenders, this requires three concrete shifts: First, rebuild detection logic around *behavior* rather than *infrastructure*—watch for abnormal API call patterns, unusual service principals, and data exfiltration queries, not for malicious domain connections. Second, assume that legitimate platforms (Discord, Microsoft, Google, Slack) will be exploited as C2, and plan accordingly with platform-native audit logging and behavioral analysis. Third, prioritize threat hunting for Graph API anomalies in organizations with high-value targeting profiles; waiting for EDR to detect EchoCreep passively is no longer viable.


    The sophistication and timing of Webworm's 2025 activity suggests the group is preparing for a sustained campaign. Organizations should respond accordingly. — *HackWire Editorial*


    ## Related Coverage


  • Read more in our [Malware](https://www.hackwire.news/category/malware) coverage
  • Cross-reference with [Threat Actors](https://www.hackwire.news/category/threat-actors) and [APT](https://www.hackwire.news/category/apt)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)