Worok
Worok is a China-attributed nation-state APT group with an espionage motive, tracked by Brandefense. It targets 4 sectors, including Government and Finance, in 30 countries, including Indonesia and China. It uses 2 MITRE ATT&CK techniques.
- Origin
- China
- Techniques
- 2
- Exploited CVEs
- No CVE data
- First seen
- Sep 8, 2022
- Last seen
- Nov 15, 2022
- Record updated
Who They Target.
About Worok.
These attacks were conducted by a previously unknown espionage group that we have named Worok and that has been active since at least 2020. Worok’s toolset includes a C++ loader CLRLoad, a PowerShell backdoor PowHeartBeat, and a C# loader PNGLoad that uses steganography to extract hidden malicious payloads from PNG files. Activity times and toolset indicate possible ties with {{TA428}}, but we make this assessment with low confidence.
Last updated Sep 11, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.