China-aligned Webworm now routes command and control through Discord and Microsoft Graph

EchoCreep talks to Discord. GraphWorm talks to the Microsoft Graph API ^[5]. Both sit inside egress that a government network almost certainly already permits, and the staging works the same way: Webworm keeps its malware in GitHub repositories so it can be pulled straight down onto the victim machine ^[6].

The Discord channel is also what gave ESET the attribution. Researchers decrypted the messages EchoCreep used for command and control, and the contents pointed them at the operators' GitHub repository. In that repository were staged artifacts including the SoftEther VPN application, and inside the SoftEther configuration file was an IP address matching a known Webworm address ^[8]. ESET says the repository and an S3 bucket it identified have been taken down, and that victims in the affected countries were notified ^[9].

The proxy fleet is the bulk of the toolset. Webworm kept two off-the-shelf tools, the Go-written iox port forwarder and frp ^[15], and added four of its own: WormFrp, ChainWorm, SmuxProxy and WormSocket ^[16]. That is six proxies in one campaign ^[1]. The custom four encrypt their traffic and support chaining across multiple hosts both inside and outside a network ^[17], which ESET believes the operators run alongside SoftEther VPN to cover their tracks ^[18]. All of the proxy and VPN servers sit on cloud infrastructure controlled by Vultr and IT7 Networks ^[19].

Proxies buy stealth at a price. They lack the full command set a backdoor hands an operator, so since 2024 the hands-on work has run through interpreters such as cmd.exe and powershell.exe ^[11]. ESET recovered more than 400 decrypted Discord messages and a bash history file from an operator server, with reconnaissance commands used against more than 50 unique targets ^[7].

Symantec first reported the group in 2022, when it was using McRat, also known as 9002 RAT, and Trochilus against targets mainly in Asia ^[2][4]. ESET saw the Asian tempo slow in 2024 as the focus moved to Europe ^[12]. In 2025 the victims were governmental organizations in Belgium, Italy, Serbia and Poland, plus a university in South Africa ^[12][13], and McRat and Trochilus were gone from the toolset entirely ^[14]. ESET links Webworm to two other China-aligned groups, SixLittleMonkeys and FishMonger ^[3].

Given the number and complexity of the proxies, ESET says Webworm may be building a much larger hidden network by tricking victims into running them ^[20].