GraphWorm Malware Exploits Microsoft OneDrive for Stealthy Cyber Espionage

GraphWorm, a backdoor associated with the China-aligned APT group Webworm, has emerged as a significant threat in 2025, utilizing Microsoft OneDrive for command-and-control operations. This malware marks a shift in Webworm's tactics, now targeting European government entities instead of primarily Asian organizations. The use of cloud-based infrastructure allows for stealthier operations, complicating detection efforts. The evolution of this malware reflects the group's adaptation to enhance its cyber espionage capabilities. Specific details about the malware's functionality and the extent of its impact on affected organizations remain limited. Ongoing investigations are likely to reveal more about its operational scope and potential vulnerabilities. Security professionals are advised to monitor developments closely.

Key Points: • GraphWorm malware leverages Microsoft OneDrive for command-and-control operations. • The China-aligned APT group Webworm has shifted its focus to European government targets. • The malware represents an evolution in stealth techniques, complicating detection efforts.