Webworm Leverages Discord and MS Graph API for C2

The China-aligned threat actor Webworm has resurfaced, employing custom backdoors that utilize Discord and Microsoft Graph API for command-and-control (C2) communications. The Hacker News reports that this activity, observed in early 2025, involves novel malware families dubbed EchoCreep and GraphWorm. Webworm, known since at least 2022, has a history of targeting government agencies, suggesting a continued focus on sensitive entities.

This reliance on legitimate, widely-used services like Discord and Microsoft Graph API for C2 is a well-worn tactic, but its continued effectiveness highlights a persistent challenge for defenders. These platforms are often whitelisted or have less stringent network traffic monitoring, making it harder to detect malicious C2 channels. The use of custom backdoors indicates a sophisticated actor investing in evasion techniques.

Defenders should prioritize scrutinizing network traffic for anomalous API calls to Microsoft Graph and unusual Discord activity, especially from government-related endpoints. Implementing stricter egress filtering and enhancing endpoint detection and response (EDR) capabilities to identify suspicious process behaviors associated with these C2 channels are critical steps.