GraphWorm Malware Uses Microsoft OneDrive as Command-and

Cybersecuritynews •Tushar Subhra Dutta • May 20, 2026

A well-known China-aligned threat group has quietly evolved its attack methods, and its latest toolset reveals just how far it is willing to go to stay hidden. A backdoor called GraphWorm has surfaced as part of this group’s growing arsenal, and what makes it stand out is the way it uses Microsoft OneDrive as its […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

GraphWorm Malware Exploits Microsoft OneDrive for Stealthy Cyber Espionage GraphWorm, a backdoor associated with the China-aligned APT group Webworm, has emerged as a significant threat in 2025, utilizing Microsoft OneDrive for command-and-control operations. This malware marks a shift in Webworm's tactics, now targeting European government entities instead of primarily Asian organizations. The use of cloud-based infrastructure allows for stealthier operations, complicating detection efforts. The evolution of this malware reflects the group's adaptation to enhance its cyber espionage capabilities. Specific details about the malware's functionality and the extent of its impact on affected organizations remain limited. Ongoing investigations are likely to reveal more about its operational scope and potential vulnerabilities. Security professionals are advised to monitor developments closely. 2 sources 73

Extracted Entities

GraphWorm Malware Uses Microsoft OneDrive as Command-and

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)