GraphWorm Malware Abuses Microsoft OneDrive for Stealthy C2 Operations

Gbhackers •Mayura Kathir • May 20, 2026

A new activity from Webworm, a China-aligned advanced persistent threat (APT) group, revealing a significant evolution in its cyber espionage toolkit during 2025. The group, first publicly documented in 2022, has shifted its targeting from primarily Asian organizations to government entities across Europe, while adopting stealthier techniques and cloud-based command-and-control (C2) infrastructure. One of the […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

GraphWorm Malware Exploits Microsoft OneDrive for Stealthy Cyber Espionage GraphWorm, a backdoor associated with the China-aligned APT group Webworm, has emerged as a significant threat in 2025, utilizing Microsoft OneDrive for command-and-control operations. This malware marks a shift in Webworm's tactics, now targeting European government entities instead of primarily Asian organizations. The use of cloud-based infrastructure allows for stealthier operations, complicating detection efforts. The evolution of this malware reflects the group's adaptation to enhance its cyber espionage capabilities. Specific details about the malware's functionality and the extent of its impact on affected organizations remain limited. Ongoing investigations are likely to reveal more about its operational scope and potential vulnerabilities. Security professionals are advised to monitor developments closely. 2 sources 73

Extracted Entities

GraphWorm Malware Abuses Microsoft OneDrive for Stealthy C2 Operations

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Industries (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)