Connect with us

Hi, what are you looking for?



New Cyberespionage Group ‘Worok’ Targeting Entities in Asia

Cybersecurity firm ESET has detailed a new cyberespionage group targeting high-profile private and public entities in Asia and Africa since 2020.

Cybersecurity firm ESET has detailed a new cyberespionage group targeting high-profile private and public entities in Asia and Africa since 2020.

Referred to as Worok, the group was seen targeting organizations in multiple countries in 2020, including a telecommunications company, a bank, and a maritime industry company in Asia, a government entity in the Middle East, and a private company in Southern Africa.

ESET has found some possible links to the threat actor known as TA428, which has been tied to China and is also known as Colourful Panda and Bronze Dudley.

After an operational break between May 2021 and January 2022, Worok resumed activity in February 2022, targeting an energy company and a public sector entity in Asia.

Likely focused on information theft, Worok exploited the ProxyShell vulnerability (CVE-2021-34523) in some attacks in 2021 and 2022, and then dropped web shells to achieve persistence, along with various implants to gain further capabilities, ESET says.

After initial compromise, Worok would deploy publicly available tools for reconnaissance (including Mimikatz, EarthWorm, ReGeorg, and NBTscan), followed by custom implants (a first-stage loader and a second-stage .NET loader).

In 2021, the group was seen using a CLR assembly named ‘CLRLoad’ as the first-stage loader, but replaced it with a full-featured PowerShell backdoor dubbed ‘PowHeartBeat’ in 2022.

Written in C++, CLRLoad would simply fetch a C# loader named ‘PNGLoad’, which relies on steganography to extract payloads hidden within PNG files. ESET believes that the PowHeartBeat backdoor has been used to launch PNGLoad in more recent attacks.

Advertisement. Scroll to continue reading.

PowHeartBeat would send a request to its command and control (C&C) server in an infinite loop, waiting for instructions. Based on the received reply, it can run commands, upload or download files, fetch file information, manipulate files, harvest system information, or update its configuration.

“Worok is a cyberespionage group that develops its own tools, as well as leveraging existing tools, to compromise its targets. Stealing information from their victims is what we believe the operators are after because they focus on high-profile entities in Asia and Africa, targeting various sectors, both private and public, but with a specific emphasis on government entities,” ESET notes.

Related: Microsoft: Multiple Iranian Groups Conducted Cyberattack on Albanian Government

Related: Chinese Cyberspies Use Supply Chain Attack to Deliver Windows, macOS Malware

Related: North Korea’s Lazarus Targets Energy Firms With Three RATs

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment


Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Learn how to utilize tools, controls, and design models needed to properly secure cloud environments.


Event: ICS Cybersecurity Conference

The leading industrial cybersecurity conference for Operations, Control Systems and IT/OT Security professionals to connect on SCADA, DCS PLC and field controller cybersecurity.


People on the Move

SaaS security company AppOmni has hired Joel Wallenstrom as its General Manager.

FTI Consulting has appointed Brett Callow as Managing Director in its Cybersecurity & Data Privacy Communications practice.

Mobile security firm Zimperium has welcomed David Natker as its VP of Global Partners and Alliances.

More People On The Move

Expert Insights