- Category
- State · Attributed to a state or working for one.
- Origin
- China(high confidence)
- Sponsor
- China
- Motivation
- Espionage; Information theft and espionage
- Seen
- 2020
- Sources
- 7 sources carry it
- Identifier
- GINC-APT-0261 · worok
ChinaWhat it is
Worok is a cyber espionage group, mostly targeting Central Asia. The group toolset includes a C++ loader named CLRLoad, a PowerShell backdoor named PowHeartBeat, and a C# loader named PNGLoad.
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Targets
- Countries
- Botswana, Cambodia, Central Asia, China, East Asia, Indonesia, Iran, Iraq, Japan, Kazakhstan, Kyrgyzstan, Laos, Lebanon, Malaysia, Mongolia, Myanmar, Namibia, North Korea, Oman, Philippines, Saudi Arabia, Singapore, South Africa, South Korea, Southeast Asia, Southern Africa, Syria, Tajikistan, Thailand, The Middle East, Turkmenistan, Türkiye, United Arab Emirates, Uzbekistan, Vietnam, Yemen
- Sectors
- Energy, Energy Company, Financial, Government, Telecommunications
Tools
The tools and malware families the sources tie to it.
- Backdoor.Oldrea
- CLRLoad
- CVE-2021-34523
- Cyber Eye RAT
- CyberGate
- EarthWorm
- Mimikatz
- PNGLoad
- POWERSOURCE
- POWERSTATS
- PowHeartBeat
- Power Loader
- PowerDuke
- PowerRAT
- Proxy Shell
- nbtscan
- reGeorg
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de