"In recent years, it has started moving toward both existing and custom proxy tools, which are more stealthy than full-fledged backdoors. In 2025, Webworm also added two new backdoors to its toolset: EchoCreep, which uses Discord for C&C communication, and GraphWorm, which uses Microsoft Graph API for the same purpose."
"Underlying these efforts is the use of a GitHub repository impersonating a WordPress fork ("github[.]com/anjsdgasdf/WordPress") as a staging ground for malware and tools like SoftEther VPN in an effort to blend in and fly under the radar. The reliance on SoftEther VPN is a tried-and-tested approach adopted by several Chinese hacking groups."
"Webworm, first publicly documented by Broadcom-owned Symantec in September 2022, is assessed to be active since at least 2022, targeting government agencies and enterprises spanning IT services, aerospace, and electric power sectors in Russia, Georgia, Mongolia, and several other Asian nations."
"Attacks mounted by the group have leveraged remote access trojans (RATs) like Trochilus RAT, Gh0st RAT, and 9002 RAT (aka Hydraq and McRat). The threat actor is said to overlap with China-nexus clusters tracked as FishMonger (aka Aquatic Panda), SixLittleMonkeys, and Space Pirates. SixLittleMonkeys is best known for deploying Gh0st RAT and a RAT called Mikroceen targeting entities in Central Asia, Russia, Belarus, and Mongolia."
Webworm, a China-aligned threat actor active since at least 2022, targets government agencies and enterprises in IT services, aerospace, and electric power across Russia, Georgia, Mongolia, and other Asian countries. The activity includes custom backdoors and remote access trojans such as Trochilus RAT, Gh0st RAT, and 9002 RAT (Hydraq/McRat). The actor overlaps with China-nexus clusters tracked as FishMonger (Aquatic Panda), SixLittleMonkeys, and Space Pirates. In recent years, activity has shifted toward stealthier proxy tools rather than full backdoors. In 2025, two new backdoors were added: EchoCreep using Discord for C2 and GraphWorm using Microsoft Graph API. Malware staging uses a GitHub repository impersonating a WordPress fork and includes SoftEther VPN to blend in and evade detection.
Read at The Hacker News
Unable to calculate read time
Collection
[
|
...
]