Chinese APT “Webworm” Leverages Discord and Microsoft Graph to Target EU Government Networks
What Happened — The state‑sponsored threat group known as Webworm has been observed using Discord as a covert command‑and‑control (C2) channel and abusing Microsoft Graph API calls to move laterally and exfiltrate data from European government networks. The group also employs SOCKS proxies such as SoftEther VPN to hide its traffic.
Why It Matters for TPRM —
- Attackers are exploiting legitimate SaaS platforms, making detection harder for third‑party risk managers.
- Government‑grade data can be harvested and later used to compromise downstream suppliers or partners.
- The use of public‑cloud services for C2 expands the attack surface of any vendor that integrates with those services.
Who Is Affected — Public sector agencies across the EU, including ministries, regulatory bodies, and any contractors that host or process government data.
Recommended Actions —
- Review any third‑party contracts that involve Discord, Microsoft 365, or other SaaS tools for privileged access.
- Enforce strict API usage monitoring and least‑privilege principles for Microsoft Graph.
- Deploy network‑level egress filtering to detect unauthorized Discord or proxy traffic.
Technical Notes —
- Attack vector: Abuse of legitimate cloud services (Discord, Microsoft Graph) combined with SOCKS proxy tunneling (SoftEther VPN).
- Data types accessed: Email, calendar, SharePoint, and other Microsoft 365 resources; potentially classified government documents.
- Indicators: Unusual Graph API calls, Discord bot traffic from internal IP ranges, outbound connections to known SoftEther VPN endpoints.
Source: Dark Reading