Threat actor
Webworm
Malpedia CN
Tracked by CyberSIXT since May 20, 2026 · last activity May 22, 2026
Coverage timeline
-
China linked Webworm uses Discord, Graph to hit EU governmentswww.darkreading.com · May 22, 2026
-
Webworm Deploys EchoCreep and GraphWorm Backdoors Using Discord and MS Graph APIthehackernews.com · May 20, 2026
-
Webworm APT targets Europe with new Discord, OneDrive backdoorswww.infosecurity-magazine.com · May 20, 2026