EchoCreep
EchoCreep is a backdoor associated with the China-aligned threat actor Webworm, also tracked as Space Pirates and UAT-8302. Public reporting states Webworm introduced EchoCreep in 2025 as part of campaigns targeting government organizations in Belgium, Italy, Poland, Serbia, and Spain, as well as activity involving a university in South Africa. EchoCreep uses Discord for command-and-control communication and is described as allowing operators to upload files, send runtime reports, receive commands, and execute commands via cmd.exe. ESET reported decrypting 433 Discord messages tied to EchoCreep across four victim-specific Discord channels, with recovered activity indicating use dating back to March 21, 2024 and the first actual compromise in the recovered logs on April 9, 2025. The malware is described as Go-based, using crafted HTTP requests to Discord APIs; commands are base64-decoded and decrypted with AES-CBC-128. A known sample is SearchApp.exe, detected by ESET as WinGo/Agent.ZK, with SHA-1 CB4E50433336707381429707F59C3CBE8D497D98. Reported detection and hunting artifacts include the persistence task name MicrosoftSSHUpdate, the handshake string "Up Success," and Discord-related JSON field literals referenced in YARA material. EchoCreep was part of a broader Webworm toolset that also included GraphWorm and multiple proxy tools, and reporting notes that Webworm used GitHub repositories to stage malware and support tools, although the specific delivery mechanism for EchoCreep remains unknown.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Through 2026 the same idea spread fast: China-aligned Webworm deployed backdoors using Discord and the Microsoft Graph API.
According to ESET, the group’s latest campaigns introduced two new backdoors: EchoCreep and GraphWorm. EchoCreep uses Discord for C&C communication, allowing attackers to upload files, send runtime reports, and receive commands.
According to ESET, the group’s latest campaigns introduced two new backdoors: EchoCreep and GraphWorm. EchoCreep uses Discord for C&C communication, allowing attackers to upload files, send runtime reports, and receive commands.
Techniques & procedures
17 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 technique
Resource Development
Execution
3 techniques
Execution
Persistence
2 techniques
Persistence
Privilege Escalation
2 techniques
Privilege Escalation
Stealth
3 techniques
Stealth
GraphWorm and EchoCreep use encryption and encoding techniques to obfuscate data.
Lateral Movement
1 technique
Lateral Movement
Collection
1 technique
Collection
Command and Control
7 techniques
Command and Control
EchoCreep uses Discord for C&C communication, allowing attackers to upload files, send runtime reports, and receive commands. GraphWorm relies on Microsoft Graph API and OneDrive endpoints to retrieve tasks and upload victim information. | By decrypting more than 400 Discord messages used for command-and-control (C&C) communication, ESET gained visibility into the group’s infrastructure and operations.
EchoCreep backdoor using Discord for C&C. ... GraphWorm backdoor using the Microsoft Graph API for C&C.
EchoCreep (HIGH) -- adds MicrosoftSSHUpdate task name, Up Success handshake string, and Discord-JSON field literals.
EchoCreep and GraphWorm use Discord and the Microsoft Graph API for C&C infrastructure.
This confirms the actor delivers tools through operator-controlled open directories, not mass-mail or drive-by chains.
IOCs tracked for this family
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A backdoor referenced in reporting about Webworm using Discord and Microsoft Graph API for command and control.
A custom backdoor used by Webworm that communicates over Discord for C2 and supports file upload/download plus command execution via cmd.exe.
A Go-written backdoor that uses Discord for C&C communication, supports file upload/download, shell execution, and sleep commands, and communicates through crafted HTTP requests to Discord APIs.
A backdoor used for command-and-control over Discord, enabling file uploads, runtime reporting, and receipt of attacker commands.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.