Worok
- First seen
- 2020-01-01 00:00:00
- Origin
- CN
- Primary motivation
- espionage
- Sophistication
- advanced
- Resource level
- government
- Actor type
- Espionage
- Profile updated
- 2026-07-07 12:04:27
Targeted industries: government-and-public-sector technology-and-telecommunications
Targeted regions: country_code:kz country_code:uz country_code:tj
Context
Worok is a cyber espionage group, mostly targeting Central Asia. The group toolset includes a C++ loader named CLRLoad, a PowerShell backdoor named PowHeartBeat, and a C# loader named PNGLoad.
Reports & references
- ESET — Worok Big Picture (report)