GraphWorm Malware Abuses Microsoft OneDrive For C2 Operations

A China-aligned advanced persistent threat (APT) group tracked as Webworm has expanded its cyberespionage toolkit with a new backdoor called GraphWorm, which abuses the Microsoft Graph API specifically OneDrive endpoints for command-and-control (C2) communications.

ESET researchers, who have tracked the group since its public debut in a 2022 Symantec report, published new findings exposing Webworm’s 2025 campaign targeting governmental organizations across Europe and beyond.

Webworm, linked to other China-aligned APT groups including SixLittleMonkeys and FishMonger, has historically relied on established malware families such as McRat (9002 RAT) and Trochilus.

In 2025, the group has abandoned those older tools entirely and deployed two new Go-written backdoors: EchoCreep, which uses Discord for C2, and GraphWorm, which leverages Microsoft Graph API.

Victims in Belgium, Italy, Serbia, Poland, and South Africa were identified in the latest wave of attacks.

GraphWorm Abuses OneDrive C2

GraphWorm persists on victim machines by adding entries to Windows registry Run keys, ensuring execution at every user login.

Upon first execution, it generates a unique victim ID by combining the network adapter IP address, processor ID, and physical device serial number using the WMI framework.

This ID is then used to create a dedicated OneDrive folder inside the attacker’s Microsoft Graph tenant, with three subfolders /files, /result, and /job for storing files, command results, and queued operator tasks, respectively.

All communications are encrypted using AES-256-CBC via the OpenSSL EVP library and then base64-encoded before transmission.

The backdoor supports a broad range of operator commands including shell (spawning cmd.exe), exec (launching processes), upload, download, kill, sleep, and a keyExchange function potentially used to establish reverse shell access.

For large shell output files, the operators leverage the Microsoft Graph API endpoint /createUploadSession to handle oversized uploads to OneDrive.

After a successful upload, GraphWorm deletes the local beacon file (beacon_shell_output.txt) to remove evidence of its activity.

The use of legitimate cloud infrastructure makes GraphWorm particularly stealthy its C2 traffic is indistinguishable from routine Microsoft 365 activity, helping it blend in on enterprise networks and evade network-based detection.

Alongside GraphWorm, ESET researchers decrypted over 400 Discord messages from EchoCreep’s C2 infrastructure, identifying at least four compromised victims based on unique Discord channel names tied to victim IP addresses and hostnames.

The Discord messages also led investigators to a fake GitHub repository a fork of the legitimate WordPress project used to stage malware and tools for direct download onto victim machines.

Webworm also deployed a suite of custom proxy tools: WormFrp (retrieves AES-encrypted configs from a compromised Amazon S3 bucket), ChainWorm (chains multi-hop proxies across internal and external hosts), SmuxProxy (a customized version of the open-source iox tool), and WormSocket (a socket. io-based scalable proxy network).

All proxy and VPN infrastructure runs on cloud servers hosted by Vultr and IT7 Networks, welivesecurity said.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.