Skip to main content
Mallory
MalwareUsed by 3 actors

GraphWorm

GraphWorm is a backdoor associated with the China-aligned threat actor Webworm, also tracked as Space Pirates and UAT-8302. It was observed in Webworm’s 2025 campaigns targeting government organizations in Europe, including Belgium, Italy, Poland, Serbia, and Spain, as well as activity involving a university in South Africa. The malware uses Microsoft Graph API and Microsoft OneDrive for command-and-control, retrieving tasks from OneDrive and uploading victim information and command results back to actor-controlled OneDrive storage. Reported capabilities include spawning a new cmd.exe session, executing newly created processes, uploading and downloading files via OneDrive, stopping its own execution on operator signal, and adjusting sleep intervals. GraphWorm persists by executing when the victim logs in and by modifying Windows registry Run keys. It generates a unique victim identifier from host attributes including network adapter IP, processor ID, and a physical device serial number obtained through WMI, then creates a separate OneDrive folder for each victim with subfolders such as /files, /result, and /job for staging and tasking. Data is reported as encrypted with AES-256-CBC and base64-encoded, and large files are uploaded using the Microsoft Graph /createUploadSession endpoint. File-level artifacts cited in the reporting include the sample C2OverOneDrive_v0316.exe, detected by ESET as Win32/Agent.VWD, with SHA-1 77F1970D620216C5FFF4E14A6CCC13FCCC267217. Reverse-engineering details mentioned in the content include Visual Studio 2019 source paths such as AutoStart.cpp, BaseInfo.cpp, and Beacon.cpp, a build tag v0316, OneDrive call sites, and an OAuth refresh_token literal. The infection vector for GraphWorm is not confirmed in the provided content; reporting states Webworm’s initial access and delivery mechanism for EchoCreep and GraphWorm are currently unknown.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

THREAT ACTORS

Groups observed using it

3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details
Webworm

The GraphWorm binary carried VS2019 source paths ( AutoStart.cpp , BaseInfo.cpp , Beacon.cpp ), a build tag v0316 (March 16), OneDrive call sites, and an OAuth refresh_token literal. Confirms the published Microsoft Graph + OneDrive C&C role at the file level.

via github gist webgist.github.com
Space Pirates

According to ESET, the group’s latest campaigns introduced two new backdoors: EchoCreep and GraphWorm. GraphWorm relies on Microsoft Graph API and OneDrive endpoints to retrieve tasks and upload victim information.

via help net securityhelpnetsecurity.com
UAT-8302

According to ESET, the group’s latest campaigns introduced two new backdoors: EchoCreep and GraphWorm. GraphWorm relies on Microsoft Graph API and OneDrive endpoints to retrieve tasks and upload victim information.

via help net securityhelpnetsecurity.com
MITRE ATT&CK

Techniques & procedures

22 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique
T1078.004Cloud AccountsEvidence1

GraphWorm uses a valid cloud account to access Microsoft Graph APIs.

Execution

1 technique
T1059.003Windows Command ShellEvidence3
TacticExecution

EchoCreep and GraphWorm both use the Windows command line to execute operator commands.

Persistence

3 techniques
T1078.004Cloud AccountsEvidence1

GraphWorm uses a valid cloud account to access Microsoft Graph APIs.

T1112Modify RegistryEvidence1

GraphWorm makes modifications to registry Run keys for persistence.

T1547.001Registry Run Keys / Startup FolderEvidence1

GraphWorm persists by making updates to registry Run keys.

T1078.004Cloud AccountsEvidence1

GraphWorm uses a valid cloud account to access Microsoft Graph APIs.

T1547.001Registry Run Keys / Startup FolderEvidence1

GraphWorm persists by making updates to registry Run keys.

Stealth

4 techniques
T1027.013Encrypted/Encoded FileEvidence1
TacticStealth

GraphWorm and EchoCreep use encryption and encoding techniques to obfuscate data.

T1036MasqueradingEvidence1
TacticStealth

the use of a GitHub repository impersonating a WordPress fork ("github[.]com/anjsdgasdf/WordPress") as a staging ground for malware and tools like SoftEther VPN in an effort to blend in and fly under the radar.

T1070.004File DeletionEvidence1
TacticStealth

GraphWorm cleans up a created beacon file after successful upload.

T1078.004Cloud AccountsEvidence1

GraphWorm uses a valid cloud account to access Microsoft Graph APIs.

T1112Modify RegistryEvidence1

GraphWorm makes modifications to registry Run keys for persistence.

Discovery

1 technique
T1082System Information DiscoveryEvidence1
TacticDiscovery

Upon first execution, the backdoor generates a unique victim identifier by combining network adapter details, processor information, and a device serial number.

Lateral Movement

1 technique
T1550.001Application Access TokenEvidence1

GraphWorm and EchoCreep use API keys to communicate with the C&C infrastructure.

Collection

3 techniques
T1005Data from Local SystemEvidence1

Both EchoCreep and GraphWorm can collect data from the local system.

T1074.001Local Data StagingEvidence1

GraphWorm stages a beacon file locally before uploading to the C&C.

T1074.002Remote Data StagingEvidence1

GraphWorm stages files and tasks within OneDrive via the Microsoft Graph API.

T1071Application Layer ProtocolEvidence4

EchoCreep backdoor using Discord for C&C. ... GraphWorm backdoor using the Microsoft Graph API for C&C.

T1071.001Web ProtocolsEvidence3

EchoCreep backdoor using Discord for C&C. ... GraphWorm backdoor using the Microsoft Graph API for C&C.

T1090.002External ProxyEvidence1

WormFrp, ChainWorm, WormSocket, SmuxProxy, and GraphWorm have the capability to connect to external proxies.

T1102.002Bidirectional CommunicationEvidence1

EchoCreep and GraphWorm use Discord and the Microsoft Graph API for C&C infrastructure.

T1105Ingress Tool TransferEvidence4

This confirms the actor delivers tools through operator-controlled open directories, not mass-mail or drive-by chains.

T1132.001Standard EncodingEvidence1

EchoCreep, GraphWorm, and WormSocket make use of base64 encoding.

T1572Protocol TunnelingEvidence1

Confirms the published Microsoft Graph + OneDrive C&C role at the file level.

T1573.002Asymmetric CryptographyEvidence1

EchoCreep, GraphWorm, WormSocket, and WormFrp use AES in some capacity.

Exfiltration

2 techniques
T1041Exfiltration Over C2 ChannelEvidence1

EchoCreep and GraphWorm exfiltrate data to their respective C&C infrastructures.

T1567.002Exfiltration to Cloud StorageEvidence1

GraphWorm exfiltrates data to OneDrive via the Microsoft Graph API.

INDICATORS OF COMPROMISE

IOCs tracked for this family

3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app
Network
1 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes
2 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting
hash.sha1●●●●●●●●●●●●View more in app14 days ago
hash.sha256●●●●●●●●●●●●View more in app14 days ago
ip.v4●●●●●●●●●●●●View more in app15 days ago
ACTIVITY FEED

Recent activity

6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching3

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution3

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping22

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.