Webworm APT Group Expands with New Malware Tools

EXECUTIVE SUMMARY

A China-aligned APT group, known as Webworm, has been actively targeting organisations in various sectors across Asia and Europe since at least 2022. The group's primary goal appears to be data theft, with a focus on compromising governmental organisations and other high-profile targets. Webworm's tactics have evolved significantly over time, with the group adopting new tools and techniques to evade detection. In 2025, the group began using Discord-based and Microsoft Graph API-based backdoors, as well as custom proxy solutions to maintain persistence and lateral movement.[emaillocker id="1283"]

The malware infection begins with the compromise of a victim's system, typically through exploitation of vulnerabilities or phishing attacks. Once inside, the malware establishes persistence and begins to exfiltrate sensitive data, often using cloud storage services such as OneDrive. The attackers maintain control through the use of command and control (C2) servers, which are often hosted on cloud services operated by Vultr and IT7 Network. Webworm's tools and techniques are designed to be stealthy and difficult to detect, making it challenging for organisations to identify and respond to the threat.

The Webworm threat is significant due to its targeted nature and the potential for data theft. Organisations in high-profile sectors, such as government and finance, are particularly vulnerable to this threat. The group's use of custom proxy solutions and cloud storage services makes it difficult to detect and recover from the attack. To mitigate this risk, organisations should prioritise patching and monitoring, implement robust endpoint protection, and maintain regular backups to ensure business continuity.

THREAT PROFILE:

REFERENCES:

reports contain further technical details:
https://www.welivesecurity.com/en/eset-research/webworm-new-burrowing-techniques/