iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Worok is the name ESET gave to a cyber-espionage cluster first described in 2022. Its observed tool chain included the CLRLoad loader, the PowHeartBeat PowerShell backdoor and the PNGLoad .NET loader, which extracted an encrypted PowerShell script from low-order bits in PNG image pixels. ESET did not establish the operators’ identity, and its later reporting revised both the tool picture and some campaign attributions.
What is Worok?
ESET named the cluster after a mutex string found in a loader sample. Researchers noted similarities with the China-linked group TA428, but said those similarities were not strong enough to identify Worok as TA428. The name therefore describes a tracked activity cluster, not a confirmed organization or nationality. ESET’s later reporting characterized Worok as China-aligned; that remains ESET’s assessment, not a publicly proven identity.
ESET researcher Thibaut Passilly, credited with discovering Worok, said: “We believe the malware operators are after information from their victims because they focus on high-profile entities in Asia and Africa, targeting various sectors, both private and public, but with a specific emphasis on government entities.” This is an analyst assessment of motive, not a statement from the operators. (ESET, September 6, 2022)
Recommended Free Tools
Where and when ESET observed activity
ESET said its telemetry showed activity beginning in late 2020, a gap in observed operations from May 2021 through January 2022, and a return in February 2022. The examples below are individual observations, not a complete victim list or a prevalence count.
#1 Best Overall
| Period | Examples ESET reported | What the evidence means |
|---|---|---|
| Late 2020 | Telecommunications company in East Asia; bank in Central Asia; maritime company in Southeast Asia; government entity in the Middle East; private company in southern Africa | Examples from ESET telemetry, not a comprehensive target inventory |
| May 2021–January 2022 | No Worok activity observed by ESET in that interval | An observation gap, not proof that operations stopped everywhere |
| February 2022 | Energy company in Central Asia and a public-sector entity in Southeast Asia | Activity was again visible in ESET telemetry |
| October 2024–March 2025 | Targets reported in Mongolia, Kyrgyzstan, Türkiye, Taiwan and Thailand, including government, public-sector and private organizations; UK academic institutions; Cambodian government institutions | Later reporting expanded the geographic and tool picture |
The later target and tool updates come from ESET’s APT Activity Report covering October 2024 through March 2025. They should not be read back into every infection described in the 2022 analysis.
How the initially disclosed intrusion chain worked
ESET could not determine most initial-access methods. In some 2021 and 2022 cases it saw exploitation of ProxyShell, a group of Microsoft Exchange vulnerabilities, followed typically by uploading a webshell for persistence. Before deploying custom malware, operators used publicly available reconnaissance and post-compromise tools including Mimikatz, EarthWorm, ReGeorg and NBTscan. This was a pattern in observed cases, not a universal sequence.
CLRLoad: the 2021 first stage
CLRLoad is a C++ loader that loads a .NET Common Language Runtime assembly from a file path. ESET observed both 32-bit and 64-bit builds. Some file paths pointed into directories belonging to legitimate software, a placement choice that could make a malicious file look less unusual during a superficial review. ESET identified CLRLoad as the first-stage tool in its 2021 observations.
Free tools Windows power users keep installed
One-click scans. No signup required.
PowHeartBeat: the mostly 2022 launcher
In most of the 2022 cases ESET examined, PowHeartBeat replaced CLRLoad as the means of launching PNGLoad. It is an obfuscated PowerShell backdoor whose layers used base64 encoding, Triple DES encryption and gzip compression. ESET observed HTTP or ICMP communication with command-and-control infrastructure. The replacement reflects the cases ESET saw; it does not show that every Worok intrusion abandoned CLRLoad.
Rank #3
PNGLoad: a loader that reads data from pixels
PNGLoad is a 64-bit .NET executable and second-stage loader. Its documented behavior was:
- Search for PNG files.
- Read the least-significant bits of pixel color and alpha values.
- Check whether the resulting buffer contains embedded content.
- Apply a multiple-byte XOR key.
- Decompress the data.
- Execute the resulting PowerShell script.
This is steganographic extraction: data is placed in small, hard-to-notice changes to image pixels. It does not mean that ordinary PNG images are malicious. The risk comes from the combination of a specialized loader, a deliberately prepared image and the surrounding execution chain.
ESET said it had not obtained a sample of the PNG file used with PNGLoad and had not retrieved the final payloads described in its original analysis. Consequently, the report documents the loader’s extraction logic without proving the exact contents of the carrier image or the final scripts in those cases. (ESET’s 2022 technical account)
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →What changed in ESET’s later reporting
ESET’s report for October 2024–March 2025 described a broader, overlapping espionage arsenal rather than one fixed malware chain.
Additional tools and campaigns
- HDMan/EAGERBEE and PhantomNet: tools ESET associated with Worok activity and used when discussing overlap among campaigns.
- Sonifake: a toolset ESET said was used by multiple groups, making tool overlap an attribution complication.
- XMLDoor: reported in an attack on academic institutions in the United Kingdom.
- GoFighting: an updated backdoor used against Cambodian government institutions; the update introduced Dropbox-based network communication.
Attribution revisions
After reviewing earlier public reporting, ESET newly attributed several campaigns to Worok with medium confidence, including activity previously linked to LuckyMouse, TA428 and other clusters. Shared tools such as PhantomNet and HDMan/EAGERBEE help explain why analysts’ labels differ. A shared implant can indicate common development, access to the same toolset or cooperation; by itself it does not prove a single command structure.
ESET agreed with a joint Worok and BackdoorDiplomacy attribution for Operation Crimson Palace and said coordination was possible. ESET also noted that its own telemetry did not show shared targeting. “Joint attribution,” possible coordination and proven organizational identity are separate claims.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What is established—and what remains unknown
| Question | Supported conclusion | Limit |
|---|---|---|
| Is Worok a confirmed named organization? | No. It is ESET’s cluster name, taken from a mutex string. | Operators’ identity and structure are not established publicly. |
| Is Worok the same as TA428? | ESET saw similarities. | The similarities were not strong enough for ESET to identify the groups as the same. |
| Did every victim receive PNGLoad? | PNGLoad was a documented second-stage loader in the initial chain. | ESET’s observations do not show that every infection used it or the same sequence. |
| Was the final payload recovered? | The loader’s extraction process was analyzed. | ESET said it had not obtained the carrier PNG sample or final payloads in its original analysis. |
| How did victims initially become compromised? | ProxyShell exploitation was seen in some cases. | Most initial-access methods were unknown to ESET. |
| What is the motive? | ESET believes information collection is the likely objective, given the high-profile and government-heavy targeting. | This is an attributed assessment, not a proven operator declaration. |
Practical defensive implications
The Philippines National CERT advised organizations discussing Worok to monitor systems and devices, keep software—especially public-facing software—patched, make regular encrypted backups and build employee security awareness. Those measures reduce exposure and improve recovery; they are not a guarantee against a capable espionage operation. (Philippines National CERT advisory, September 7, 2022)
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11- Prioritize patching and review of internet-facing Microsoft Exchange and other public services, because ProxyShell exploitation appeared in some observed cases.
- Retain PowerShell, HTTP and ICMP telemetry where policy and privacy requirements allow, so heavily obfuscated scripts and unusual command-and-control behavior can be investigated.
- Review webshell creation, unexpected loaders in legitimate software directories, and suspicious execution of scripts associated with image-processing paths.
- Keep encrypted, tested backups and an incident-response plan; a backup that has not been restored in a test is not a demonstrated recovery capability.
- Treat a PNG file as one possible carrier in a specific loader chain, not as evidence that PNG images generally are dangerous.
Bottom line
Worok is best understood as an ESET-tracked espionage cluster whose early public profile combined an uncertain entry path, public reconnaissance utilities and custom loaders. The notable PNGLoad technique hid a PowerShell script in low-order image-pixel bits, while CLRLoad and PowHeartBeat represented different first-stage approaches in ESET’s 2021 and 2022 observations. ESET’s later reporting broadened the toolset and revised some attributions with medium confidence, but it still does not establish one universal infection chain or a proven operator identity.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
