other

GraphWorm

Windows backdoor family that uses Microsoft Graph and a OneDrive account as its command and control channel instead of attacker-owned servers or domains.

Current clusters

leadership1 publisher

GraphWorm answers token revocation by swapping its own OAuth credentials

CSO Online's teardown of a Webworm implant found an upgrade command that replaces all five credential strings in a single task. The revocation step at the top of most identity runbooks costs the operator one poll cycle.

Publishers:csoonline.com

Reality

Evidence58
Adoption: Insufficient
Hype gap+15
Incentives22
Confidence56