Webworm Turns Microsoft OneDrive Into a Government Spy Channel

ESET decrypted 433 Discord messages from Webworm’s EchoCreep backdoor and tied 2025 spying on European governments to a Microsoft Graph channel called GraphWorm. GraphWorm talks only to OneDrive on Microsoft Graph, so a government on Microsoft 365 cannot block it without blocking its own files.

GraphWorm Turns OneDrive Into a Per-Victim Mailbox

ESET Research published its 2025 campaign technical write-up on May 20, 2026, with a newsroom note dated May 21 from Bratislava and Montreal. Researcher Eric Howard led the work. Webworm is a China-aligned spy group first described in 2022, when it still used the McRat and Trochilus remote-access tools against targets in Asia.

By 2025 those older implants were gone. In their place sat two custom backdoors. EchoCreep, written in Go, sends files, runtime reports, and commands through Discord’s own API as crafted HTTP requests. GraphWorm stores jobs and stolen data in a Microsoft Graph tenant and uses OneDrive endpoints only.

ECHOCREEP VERSUS GRAPHWORM

GraphWorm also accepts proxy settings, so its Graph calls can leave through whatever tunnel the operators already built on the host.

Each Victim Gets Three OneDrive Folders

On first run, GraphWorm builds a victim ID by joining the network-adapter IP, the processor ID, and a physical-device serial through WMI. That string becomes a OneDrive folder in the operators’ tenant. Under it sit three subfolders. /job holds queued tasks. /result takes command output. /files stores other loot.

The backdoor then posts a JSON snapshot of the machine, including the user name, the workgroup, and a public key. Commands recovered in order of discovery include keyExchange, sessionKey, kill, shell (a new cmd.exe), and exec (CreateProcessW). Kill stops the implant. Shell and exec do the operator’s work on the box.

Large Files Ride a Normal Upload Session

Because the OneDrive instance sits in Microsoft’s cloud, GraphWorm can call the Graph API to create an upload session and push large staged files in chunks. After a successful upload it deletes a local beacon file. From a firewall, that is a Microsoft 365 file transfer. From the operator’s desk, it is a mailbox with one folder per victim.

Why a Firewall Cannot Cut This Channel

A ministry that issues OneDrive to staff has to allow graph.microsoft.com. GraphWorm uses that same door, with a valid cloud account, so destination block-lists never see a strange host. Singapore’s Cyber Security Agency already warned about Graph API command-and-control abuse on May 20, 2024, two years to the day before ESET’s paper, and still told administrators to block outbound connections to C2 IP addresses. That advice does not bite when the C2 is OneDrive.

Allow-listing Discord and Microsoft by name is how this traffic survives. The useful signals are Graph API operations, OAuth grants, and a jump in S3 transfer volume on an account nobody in the agency owns. Operators still hide the implants in Discord and OneDrive spy-tool traffic that looks like chat and file sync.

EchoCreep is easier to trip over, because Discord is a weaker default on a government desktop, and because ESET recovered the bot traffic. GraphWorm is the channel that scales. Each new victim is one more directory on a tenant the operators control, with no extra domain to register and no extra certificate to burn.

European Governments, a South African University, and a Stolen Bill

In 2025 ESET saw Webworm hit government bodies in Belgium, Italy, Serbia, Spain, and Poland, and compromise a university in South Africa. A bash-history file on an operator server showed scouting commands against more than 50 unique targets. The dirsearch runs were wider still.

CAMPAIGN COUNTS FROM THE ESET ANALYSIS

• Discord haul: 433 decrypted EchoCreep messages across four victim channels.
• Scout list: more than 50 unique targets in recovered server history.
• Web scans: dirsearch run against 56 sites in Spain, Hungary, Belgium, Nigeria, Czechia, and Serbia.
• Stolen cloud stash: 20 new files on the hijacked S3 bucket between December 2025 and January 2026, two from a Spanish government body.

WormFrp, a custom proxy, pulled settings from a compromised Amazon S3 bucket at wamanharipethe.s3.ap-south-1.amazonaws.com. ESET judged that bucket a public, or policy-mis-set, twin of whpjewellers.s3.amazonaws.com. Snapshots from virtual-machine hosts were sitting in it. One held the live settings of a machine at an Italian government body. ESET could not prove whether the operators owned the whole virtual-machine farm or only a host that stored those images.

It is apparent that through this S3 bucket, Webworm can leverage data exfiltration while an unsuspecting victim foots the bill for the service.

Eric Howard, malware researcher, ESET

FILES PULLED FROM THE STOLEN BUCKET

• Italian snapshot: current settings and active state of a government virtual machine.
• Spanish XML: saved virtual-host settings from mRemoteNG, an open-source remote connection manager.
• Spanish Visio: a Microsoft Visio drawing of infrastructure behind a domain the agency uses.
• SharpSecretsdump: uploaded in late October 2025 to dump Windows credentials, in the style of Impacket’s secretsdump.py.

The Spanish pair arrived in that December 2025 to January 2026 batch of 20 files. The stolen S3 account paid Amazon for the storage of its own secrets.

EchoCreep’s Discord Trail Gave Researchers the Attribution

ESET did not start with GraphWorm. It started with Discord. After decoding EchoCreep’s messages, researchers followed unique user, channel, and guild IDs to a GitHub repo at github.com/anjsdgasdf/WordPress, a direct fork of the real WordPress project, with staged tools dropped into wp-admin. One of those tools was SoftEther VPN. Inside its settings file sat an IP address that matched a known Webworm address. That was the attribution.

https://x.com/ESETresearch/status/2057025467031453893

The Discord side also showed how small the confirmed EchoCreep set is. Channel names were the victim’s IP, or the IP plus the hostname. Four unique channels meant four victims. On first run the implant did not create a channel. It posted “Up Success” to one that already existed, so the operators had the target details before the backdoor launched.

HOW THE DISCORD CHANNEL CAME APART

1. March 21, 2024: EchoCreep messages begin on the recovered Discord server, months before the first confirmed victim.
2. April 9, 2025: The first real compromise, a new channel, and fresh “Up Success” posts; curl then pulls files down through shell commands.
3. April 14, 2025: Operator jonson889912 sends “shell whoami” to a channel named fire.
4. May 20, 2026: ESET publishes the 2025-campaign paper and, in a follow-on post, notes a talk at ESET World 2026 titled “China-aligned Webworm targets EU countries, abuses Discord and government-hosted public apps.”

EchoCreep’s command set is short: upload a file to Discord, download from a URL, run a string in cmd.exe, and sleep. Persistence on the first victims looked like a post-compromise afterthought, not a built-in service. The 433 messages were still enough to open the GitHub stager, the SoftEther file, and the rest of the 2025 tool set.

An Eight-Year-Old Webmail Bug Opened One Door

ESET never found the first click that put EchoCreep or GraphWorm on a desktop. It did recover the scouting kit. A victim host talked to a proxy at 64.176.85.158, and that address had hosted an open directory on port 80. Inside were nuclei, dirsearch, and a bash-history file.

dirsearch brute-forced web paths on 56 targets. nuclei, an open-source vulnerability scanner, sat in its own folder. Next to it was a LegalHackers proof-of-concept named _1.sh for CVE-2017-7692 in SquirrelMail, a post-login remote code execution bug from 2017. A similarly named script had been run against a Serbian webmail target. ESET’s working read is that the operators already had that victim’s credentials and used the eight-year-old bug as a way in.

Howard put it in plainer terms. Through the recovered server commands, he said, the team got “a view into the group’s potential initial access techniques, using an open-source vulnerability scanner as well as identifying some of its focused targets.” Public webmail that still speaks SquirrelMail is an old door. Webworm still tried the handle.

Custom Proxies Try to Turn Victims Into a Hidden Network

The backdoors are only half the kit. In 2024 Webworm had already moved from full remote-access tools toward SoftEther VPN and other SOCKS-style helpers, which hide well and then lean on cmd.exe or PowerShell for the actual work. In 2025 it kept the open-source Go tools iox and frp, and added WormFrp, ChainWorm, SmuxProxy, and WormSocket. Those custom proxies encrypt traffic and chain across hosts inside and outside a network. ESET’s read is that the operators pair them with SoftEther to cover their tracks, and that the volume of proxy code hints they are tricking victims into running a larger hidden network.

Every proxy and VPN node ESET mapped sat on cloud servers under Vultr or IT7 Networks. Sample names on disk were bland on purpose: ssh.exe for WormFrp, svc.exe for ChainWorm, dsocks.exe for SmuxProxy (a custom iox with a hardcoded IP), MessengerClient.exe for WormSocket.

SAMPLES AND PROXY SERVERS ESET PUBLISHED

ESET also posted hashes and proxy server addresses for the Vultr and IT7 nodes, including 45.77.13.67 (WormSocket, first seen April 7, 2025), 108.61.200.151 (WormFrp, April 10, 2025), 104.243.23.43 (SmuxProxy, April 9, 2025), 64.176.85.158 (SmuxProxy, June 28, 2025), and 144.168.60.233 (a reverse-shell address found on a SmuxProxy server, June 30, 2025). Staging on a WordPress GitHub fork, command traffic on Discord and OneDrive, and stolen files on someone else’s S3 bill are the same idea: live on a service the victim already trusts.

ESET notified the victims it could identify. The GitHub stager and the S3 bucket were taken down. OneDrive stays on in those same networks, and GraphWorm’s job folder is just another directory on a Microsoft tenant the operators control.

Frequently Asked Questions

Which other groups does ESET link to Webworm?

ESET links Webworm to the China-aligned clusters it tracks as SixLittleMonkeys and FishMonger, and it has watched the group since the 2022 write-up that first described it. A later ESET threat-intel roster also lists Webworm as a customer of StartupNation, a shop ESET says writes malware for several China-aligned teams.

How does EchoCreep stay on a Windows PC?

ESET mapped EchoCreep to a scheduled task named MicrosoftSSHUpdate. GraphWorm instead writes Registry Run keys so it launches at login. EchoCreep’s first victims looked as if persistence was added with live commands after the box was already owned, which matches the “Up Success” posts into channels that already existed.

Were the GitHub repo and the S3 bucket taken down?

Yes. ESET said victims in the countries named in the paper were notified, and that the GitHub WordPress fork and the compromised S3 bucket were taken down after the investigation. The Discord bot token ESET held was too limited to list the server owners, so that piece of the channel was never a public takedown target in the write-up.

What name does GraphWorm use on disk?

The GraphWorm sample ESET published is C2OverOneDrive_v0316.exe, detected as Win32/Agent.VWD. EchoCreep shipped as SearchApp.exe, detected as WinGo/Agent.ZK. Those names sit in the same IoC set as the proxy hashes.

What does GraphWorm send home on first run?

After it creates the per-victim OneDrive folder, GraphWorm uploads a JSON object that includes the user name, the workgroup, and a publicKey field. keyExchange and sessionKey commands later stash more key material in memory; ESET could not fully map those two commands, and flagged keyExchange as a possible path to a reverse shell.