A cyberespionage group has targeted government agencies and big-name corporations throughout Asia since at least 2020, using the notorious ProxyShell vulnerabilities in Microsoft Exchange to gain initial access.
According to ESET, the crew it has dubbed as Worok may be associated with TA428, a similar group thought to be backed by China, that has been around since 2019.
Threat intelligence researchers with the cybersecurity software vendor saw activity from a range of advanced persistent threat (APT) groups in early 2021, after the disclosure of the ProxyShell (CVE-2021-34523)
vulnerability, and one of those groups showed some similarities to TA428, such as common activity times, targeted verticals, and the use of ShadowPad, a backdoor used in a number of espionage campaigns.
However, other tools used by the group differed from those employed by TA428, a Chinese state-sponsored gang known for targeting organizations in East Asia and Russia and which also is referred to as Colorful Panda.
"We consider that the links are not strong enough to consider Worok to be the same group as TA428, but the two groups might share tools and have common interests," Thibaut Passilly, a malware researcher at ESET, wrote in a
report Tuesday. "We decided to create a cluster and named it Worok."
The researchers then linked other attacks to Worok through the use of variants of the same tools, concluding that the group has been around since late 2020 and is still active now.
Worok's toolset includes CLRLoad, a C++ loader; PowHeartBeat, PowerShell backdoor; and PNGLoad, a C# .NET loader that uses steganography – concealing a message in another message – to extract hidden malicious payloads from PNG files.
"Considering the targets' profiles and the tools we've seen deployed against these victims, we think Worok's main objective is to steal information," Passilly wrote.
In late 2020, the group targeted a telecommunications company in East Asia, a bank in Central Asia, and a Southeastern Asia company in the maritime industry. There also was a government entity in the Middle East and a private company in southern Africa.
There then was a pause in Worok's activity from May 2021 to January before it returned with attacks on an energy company in Central Asia and a public sector entity in Southeast Asia.