New Worok cyber-espionage group targets governments, high-profile firms

guest · Sep 6, 2022

By Sergiu Gatlan @serghei - September 6, 2022

A newly discovered cyber-espionage group has been hacking governments and high-profile companies in Asia since at least 2020 using a combination of custom and existing malicious tools.

The threat group, tracked as Worok by ESET security researchers who first spotted it, has also attacked targets from Africa and the Middle East.
Click to expand...

To date, Worok has been linked to attacks against telecommunications, banking, maritime, and energy companies, as well as military, government, and public sector entities.

While there have been no sightings until February 2022, ESET once again linked the group with new attacks against an energy company in Central Asia and a public sector entity in Southeast Asia.

"We believe the malware operators are after information from their victims because they focus on high-profile entities in Asia and Africa, targeting various sectors, both private and public, but with a specific emphasis on government entities," ESET malware researcher Thibaut Passilly said.
Click to expand...

Even though the group used ProxyShell exploits to gain initial access to its victims' networks, the initial access vector remains unknown for most of its breaches.

"In such cases, typically webshells have been uploaded after exploiting these vulnerabilities, in order to provide persistence in the victim's network. Then the operators used various implants to gain further capabilities," Passilly added.
Click to expand...

PowHeartBeat comes with a wide range of capabilities, including file manipulation and command or process execution, as well as uploading or downloading files to and from victims' devices.

"Activity times and toolset indicate possible ties with TA428, but we make this assessment with low confidence," Passilly concluded.
Click to expand...

ESET: Worok: The big picture

By Thibaut Passilly - September 6, 2022
Focused mostly on Asia, this new cyberespionage group uses undocumented tools, including steganographically extracting PowerShell payloads from PNG files
ESET researchers recently found targeted attacks that used undocumented tools against various high-profile companies and local governments mostly in Asia. These attacks were conducted by a previously unknown espionage group that we have named Worok and that has been active since at least 2020. Worok’s toolset includes a C++ loader CLRLoad, a PowerShell backdoor PowHeartBeat, and a C# loader PNGLoad that uses steganography to extract hidden malicious payloads from PNG files.
Click to expand...

guest · Nov 11, 2022

Worok hackers hide new malware in PNGs using steganography
By Bill Toulas @billtoulas - November 10, 2022

A threat group tracked as 'Worok' hides malware within PNG images to infect victims' machines with information-stealing malware without raising alarms.

This has been confirmed by researchers at Avast, who built upon the findings of ESET, the first to spot and report on Worok's activity in early September 2022.
ESET warned that Worok targeted high-profile victims, including government entities in the Middle East, Southeast Asia, and South Africa, but their visibility into the group's attack chain was limited.
Click to expand...

Avast's report is based on additional artifacts the company captured from Worok attacks, confirming ESET's assumptions about the nature of the PNG files and adding new information on the type of malware payloads and the data exfiltration method.
Hiding payload in PNGs
Steganography is concealing code inside image files that appear normal when opened in an image viewer.

In the case of Worok, Avast says the threat actors used a technique called "least significant bit (LSB) encoding," which embeds small chunks of the malicious code in the least important bits of the image's pixels.
Click to expand...

Avast: PNG Steganography Hides Backdoor

November 10, 2022
The researchers from ESET described two execution chains and how victims’ computers are compromised. The initial compromise is unknown, but the next stages are described in detail, including describing how the final payload is loaded and extracted via steganography from PNG files. However, the final payload has not been recovered yet. Detailed information about Worok, chains, and backdoor commands can be found in the ESET’s article Worok: The big picture.

Our analysis aims to extend the current knowledge of ESET research. We have captured additional artifacts related to Worok at the end of the execution chain. The PNG files captured by our telemetry confirm that the purpose of the final payload embedded in these is data stealing. What is noteworthy is data collection from victims’ machines using DropBox repository, as well as attackers using DropBox API for communication with the final stage.
Click to expand...

Rasheed187 · Nov 12, 2022

mood said: ↑

Worok hackers hide new malware in PNGs using steganography
By Bill Toulas @billtoulas - November 10, 2022

Avast: PNG Steganography Hides Backdoor
Click to expand...

Wow, this is a bit too complex for me. But from what I understood, eventually malware will still need to be packaged into some executable file like .dll or .exe, so it's not like a PNG file itself can infect the system.

Log in or Sign up

New Worok cyber-espionage group targets governments, high-profile firms

guest Guest

guest Guest

Rasheed187 Registered Member

Log in or Sign up

New Worok cyber-espionage group targets governments, high-profile firms

guest Guest

guest Guest

Rasheed187 Registered Member

Useful Searches