Cybersecurity firm ESET has detailed a new cyberespionage group targeting high-profile private and public entities in Asia and Africa since 2020.
Referred to as Worok, the group was seen targeting organizations in multiple countries in 2020, including a telecommunications company, a bank, and a maritime industry company in Asia, a government entity in the Middle East, and a private company in Southern Africa.
ESET has found some possible links to the threat actor known as TA428, which has been tied to China and is also known as Colourful Panda and Bronze Dudley.
After an operational break between May 2021 and January 2022, Worok resumed activity in February 2022, targeting an energy company and a public sector entity in Asia.
Likely focused on information theft, Worok exploited the ProxyShell vulnerability (CVE-2021-34523) in some attacks in 2021 and 2022, and then dropped web shells to achieve persistence, along with various implants to gain further capabilities, ESET says.
After initial compromise, Worok would deploy publicly available tools for reconnaissance (including Mimikatz, EarthWorm, ReGeorg, and NBTscan), followed by custom implants (a first-stage loader and a second-stage .NET loader).
In 2021, the group was seen using a CLR assembly named ‘CLRLoad’ as the first-stage loader, but replaced it with a full-featured PowerShell backdoor dubbed ‘PowHeartBeat’ in 2022.
Written in C++, CLRLoad would simply fetch a C# loader named ‘PNGLoad’, which relies on steganography to extract payloads hidden within PNG files. ESET believes that the PowHeartBeat backdoor has been used to launch PNGLoad in more recent attacks.
PowHeartBeat would send a request to its command and control (C&C) server in an infinite loop, waiting for instructions. Based on the received reply, it can run commands, upload or download files, fetch file information, manipulate files, harvest system information, or update its configuration.
“Worok is a cyberespionage group that develops its own tools, as well as leveraging existing tools, to compromise its targets. Stealing information from their victims is what we believe the operators are after because they focus on high-profile entities in Asia and Africa, targeting various sectors, both private and public, but with a specific emphasis on government entities,” ESET notes.
Related: Microsoft: Multiple Iranian Groups Conducted Cyberattack on Albanian Government
Related: Chinese Cyberspies Use Supply Chain Attack to Deliver Windows, macOS Malware
Related: North Korea’s Lazarus Targets Energy Firms With Three RATs