Security Experts:

Connect with us

Hi, what are you looking for?



New Cyberespionage Group ‘Worok’ Targeting Entities in Asia

Cybersecurity firm ESET has detailed a new cyberespionage group targeting high-profile private and public entities in Asia and Africa since 2020.

Cybersecurity firm ESET has detailed a new cyberespionage group targeting high-profile private and public entities in Asia and Africa since 2020.

Referred to as Worok, the group was seen targeting organizations in multiple countries in 2020, including a telecommunications company, a bank, and a maritime industry company in Asia, a government entity in the Middle East, and a private company in Southern Africa.

ESET has found some possible links to the threat actor known as TA428, which has been tied to China and is also known as Colourful Panda and Bronze Dudley.

After an operational break between May 2021 and January 2022, Worok resumed activity in February 2022, targeting an energy company and a public sector entity in Asia.

Likely focused on information theft, Worok exploited the ProxyShell vulnerability (CVE-2021-34523) in some attacks in 2021 and 2022, and then dropped web shells to achieve persistence, along with various implants to gain further capabilities, ESET says.

After initial compromise, Worok would deploy publicly available tools for reconnaissance (including Mimikatz, EarthWorm, ReGeorg, and NBTscan), followed by custom implants (a first-stage loader and a second-stage .NET loader).

In 2021, the group was seen using a CLR assembly named ‘CLRLoad’ as the first-stage loader, but replaced it with a full-featured PowerShell backdoor dubbed ‘PowHeartBeat’ in 2022.

Written in C++, CLRLoad would simply fetch a C# loader named ‘PNGLoad’, which relies on steganography to extract payloads hidden within PNG files. ESET believes that the PowHeartBeat backdoor has been used to launch PNGLoad in more recent attacks.

PowHeartBeat would send a request to its command and control (C&C) server in an infinite loop, waiting for instructions. Based on the received reply, it can run commands, upload or download files, fetch file information, manipulate files, harvest system information, or update its configuration.

“Worok is a cyberespionage group that develops its own tools, as well as leveraging existing tools, to compromise its targets. Stealing information from their victims is what we believe the operators are after because they focus on high-profile entities in Asia and Africa, targeting various sectors, both private and public, but with a specific emphasis on government entities,” ESET notes.

Related: Microsoft: Multiple Iranian Groups Conducted Cyberattack on Albanian Government

Related: Chinese Cyberspies Use Supply Chain Attack to Deliver Windows, macOS Malware

Related: North Korea’s Lazarus Targets Energy Firms With Three RATs

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.


Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.


Expert Insights

Related Content


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.


WASHINGTON - Cyberattacks are the most serious threat facing the United States, even more so than terrorism, according to American defense experts. Almost half...


No one combatting cybercrime knows everything, but everyone in the battle has some intelligence to contribute to the larger knowledge base.

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...


Websites of German airports, administration bodies and banks were hit by DDoS attacks attributed to Russian hacker group Killnet


The overall effect of current global geopolitical conditions is that nation states have a greater incentive to target the ICS/OT of critical industries, while...

Malware & Threats

Threat actors are increasingly abusing Microsoft OneNote documents to deliver malware in both targeted and spray-and-pray campaigns.