WorokWorok

Worok is a Chinese-attributed threat actor catalogued by MISP-Galaxy (MISP-Galaxy v341). Operational targeting focuses on the Government and Energy Company sectors. Documented victim organisations include East Asia, Central Asia, Southeast Asia and 2 other named victims. Original record: Worok is a cyber espionage group, mostly targeting Central Asia. The group toolset includes a C++ loader named CLRLoad, a PowerShell backdoor named PowHeartBeat, and a C# loader named PNGLoad.