Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Worok · Nation-state · assessed origin China · misp-galaxy · refreshed 2026-10-06

Worok

state sponsor · China

sigil · no ATT&CK coverage stated

What changed

ledger · newest first
  1. 2026-10-18todaynew CVE1 new CVE: CVE-2021-34523

Analyst brief

misp-galaxy

Worok is a cyber espionage group, mostly targeting Central Asia. The group toolset includes a C++ loader named CLRLoad, a PowerShell backdoor named PowHeartBeat, and a C# loader named PNGLoad.

Observed targets (as stated by the sources)

0 countries · 2 sectors
Assessed origin: China

assessed origin · Chinaobserved targets · 0

sectors · 2

  • Government
  • Energy Company

also stated: East Asia, Central Asia, Southeast Asia, The Middle East, Southern Africa

as stated by MISP galaxy / ransomware.live — not inferred

CVEs Worok is cited as exploiting

none on KEV
  1. CVE-2021-345232026-10-17
    1. “During the ProxyShell ( CVE-2021-34523 ) vulnerability disclosure in early 2021, we observed activity from various APT groups . One exhibited characteristics common with TA428 :”

      cited as exploiting · named nearby · source: welivesecurity.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

1 source
  1. 1.welivesecurity.com/2022/09/06/worok-big-picture

Track Worok on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.