Webworm APT 2025 European Campaign and Custom Toolset

ESET researchers have identified a significant shift in Webworm's (a China-aligned APT) operational focus from Asia to Europe in 2025, targeting government organizations in Belgium, Italy, Serbia, and Poland. The group has moved away from traditional RATs like McRat and Trochilus, favoring a more stealthy toolset that leverages legitimate cloud services and custom proxy utilities.

Technically, Webworm has introduced two new backdoors: EchoCreep, which abuses Discord for C2 communication, and GraphWorm, which utilizes Microsoft Graph API (OneDrive) for data exfiltration and command execution. The group extensively uses GitHub for staging and has been observed leveraging compromised Amazon S3 buckets for configuration management. Their initial access strategy includes using open-source scanners like nuclei and dirsearch, potentially exploiting vulnerabilities such as CVE-2017-7692 in SquirrelMail.

This shift represents a heightening of tradecraft, moving toward living-off-the-cloud techniques that evade traditional network-based detections. Organizations in the government and higher education sectors in Europe and South Africa should prioritize monitoring for unauthorized use of cloud storage APIs and unexpected Discord traffic in production environments.