thehackernews.com·May 20, 2026
Cybersecurity researchers have identified new activities from the China-aligned threat actor Webworm in 2025, utilizing custom backdoors for command-and-control communications via Discord and Microsoft Graph API, and have been active since at least 2022, primarily targeting government agencies.
The most valuable insight for you is the emergence of Webworm's new tactics involving the use of Discord and Microsoft Graph API for C2 communications. This highlights the need to monitor and secure these platforms within your organization's network to mitigate potential threats from sophisticated state-aligned actors, ensuring your threat intelligence and incident response teams are prepared to address such novel attack vectors.