# Webworm: New burrowing techniques

DevFeed: [Webworm: New burrowing techniques](<https://devfeed.tech/articles/webworm-new-burrowing-techniques-8383.md>)

Original publisher: [Read original article](<https://www.welivesecurity.com/en/eset-research/webworm-new-burrowing-techniques/>)

Author: Eric Howard

Published: 2026-05-20T08:40:00Z

Content type: article

Language: en

Sources: [WeLiveSecurity](<https://devfeed.tech/sources/welivesecurity.md>)

Topics: [Malware](<https://devfeed.tech/topics/malware.md>), [backdoor](<https://devfeed.tech/topics/backdoor.md>), [Reconnaissance](<https://devfeed.tech/topics/recon.md>), [Discord](<https://devfeed.tech/topics/discord.md>), [GitHub](<https://devfeed.tech/topics/github.md>), [API](<https://devfeed.tech/topics/api.md>), [Microsoft](<https://devfeed.tech/topics/microsoft.md>), [Bash](<https://devfeed.tech/topics/bash.md>), [Virtual Private Network](<https://devfeed.tech/topics/vpn.md>), [Amazon S3](<https://devfeed.tech/topics/amazon-s3.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [apt](<https://devfeed.tech/tags/apt.md>), [backdoor](<https://devfeed.tech/tags/backdoor.md>), [bash](<https://devfeed.tech/tags/bash.md>), [china](<https://devfeed.tech/tags/china.md>), [discord](<https://devfeed.tech/tags/discord.md>), [eset-research](<https://devfeed.tech/tags/eset-research.md>), [europe](<https://devfeed.tech/tags/europe.md>), [github](<https://devfeed.tech/tags/github.md>), [ip](<https://devfeed.tech/tags/ip.md>), [malware](<https://devfeed.tech/tags/malware.md>), [microsoft](<https://devfeed.tech/tags/microsoft.md>), [s3](<https://devfeed.tech/tags/s3.md>), [server](<https://devfeed.tech/tags/server.md>), [techniques](<https://devfeed.tech/tags/techniques.md>), [tools](<https://devfeed.tech/tags/tools.md>)

## AI overview

ESET researchers analyze Webworm's 2025 activity, including its shift toward Europe, new Discord- and Microsoft Graph API-based backdoors, proxy tools, reconnaissance activity, and GitHub-hosted malware staging.

## Source excerpt

ESET researchers describe new tools and techniques that the Webworm APT group recently added to its arsenal