New cyberespionage group surfaces following attacks on mostly Asian targets

Active since 2020, the cyberespionage group has targeted a range or mostly Asian public and private entities.

A previously unknown cyberespionage group has been using undocumented tools to go after high-profile Asian companies and local governments, researchers with cybersecurity firm ESET said Tuesday.

The researchers dubbed the cyberespionage group “Worok” and say it’s been active since at least 2020, when it targeted an East Asia telecom, a Central Asia bank, Southeast Asian maritime firm, among other public and private targets.

A “significant break in observed operations” took place between May 2021 and January 2022, the researchers said, but since then the group has homed in on a Central Asian energy company and a public sector entity in Southeast Asia.

The group’s activity is just the latest example of rampant cyberespionage activity targeting regional entities throughout Asia and Australia. In late August, joint research from Proofpoint and PwC Threat Intelligence exposed a Chinese effort to gather information on global heavy industry manufacturers and other targets associated with activity in the South China sea. Russian defense entities have also been targeted by Chinese hackers in recent months, particularly in the wake of the Russian invasion of Ukraine.

According to ESET, the group employs at least three customized tools: C++ loader, a PowerShell backdoor and a loader that uses steganography to create payloads to execute.

The researchers did not attribute the activity to a particular nation. They said the group may share tools and have common interests with TA428, which multiple independent security research teams have connected to China.

“Worok is a cyberespionage group that develops its own tools, as well as leveraging existing tools, to compromise its targets,” the researchers said. “Stealing information from their victims is what we believe the operators are after because they focus on high-profile entities in Asia and Africa, targeting various sectors, both private and public, but with a specific emphasis on government entities.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure