Webworm Deploys EchoCreep and GraphWorm Backdoors Using Discord and MS Graph API

A China-aligned threat actor known as Webworm has expanded its arsenal with two new backdoors, EchoCreep and GraphWorm, utilizing Discord and the Microsoft Graph API for command-and-control communications. The group, active since 2022 and linked to clusters like FishMonger and SixLittleMonkeys, has been targeting government agencies and enterprises across Russia, Europe, and Asia, leveraging RATs such as Trochilus and Gh0st RAT, and employing techniques like open-source proxy tools and GitHub repositories for stealth. This expansion highlights Webworm's evolving tactics and continued activity in exploiting vulnerabilities.