Meet Worok, the cyber espionage group hiding malware within PNG image files

In a nutshell: Safety researchers have found out a new malware threat intended to abuse steganography methods. Worok appears to be a intricate cyber-espionage operation whose individual levels are even now in aspect a mystery. The operation’s final focus on, having said that, has been confirmed by two protection corporations.

Worok is applying multi-phase malware designed to steal data and compromise significant-profile victims, working with steganography tactics to conceal pieces of the closing payload in a plain PNG impression file. The novel malware was to start with learned by ESET in September.

The organization describes Worok as a new cyber espionage team that is using undocumented applications, like a steganography regimen made to extract a destructive payload from a simple PNG picture file. A duplicate of explained impression is revealed down below.

The Worok operators had been focusing on significant-profile victims like govt companies, with a particular concentration on the Center East, Southeast Asia and South Africa. ESET’s expertise into the threat’s assault chain was restricted, but a new evaluation from Avast is now supplying supplemental facts about this procedure.

Avast suggests Worok employs a complex multistage design to conceal its things to do. The technique utilised to breach networks is continue to unfamiliar after deployed, the 1st phase abuses DLL sideloading to execute the CLRLoader malware in memory. The CLRLoader module is then utilized to execute the next-phase DLL module (PNGLoader), which extracts distinct bytes hidden within PNG image data files. These bytes are used to assemble two executable information.

The steganography procedure applied by Worok is recognized as the very least important little bit encoding, which hides tiny portions of the malicious code in the “most affordable bits” within just precise pixels in the picture that can be recovered afterwards.

The to start with payload hidden with this approach is a PowerShell script for which neither ESET nor Avast have been equipped to get hold of a sample still. The second payload is a custom details-thieving and backdoor module named DropBoxControl, a schedule created in .Web C#, built to get remote commands from a compromised Dropbox account.

DropBoxControl can execute quite a few – and perhaps risky – actions, including the potential to operate the “cmd /c” command with supplied parameters, launch executable binary data files, down load facts from Dropbox to the infected (Windows) unit, delete data on the system, exfiltrate procedure info or information from a precise directory, and far more.

Even though analysts are continue to placing all the items collectively, the Avast investigation confirms that Worok is a tailor made operation built to steal knowledge, spy, and compromise large-level victims in particular regions of the earth.