An emerging cyber-espionage threat group is making waves by targeting high profile organizations and local governments throughout Asia. Tracked as Worok, this threat group has been traced back to exploiting several organizations when ProxyShell (CVE-2021-34523) was first disclosed. Some attack tactics, techniques, and procedures (TTPs) aligned closely with another threat group TA428; this included the time of attack, targeted verticals, and the use of the ShadowPad Chinese malware. Back in 2020, Worok was attributed to compromising a telecommunications company, a local bank, and a maritime company throughout Asia alongside a government entity in the Middle East and a private company out of southern Africa. After a brief hiatus, Worok has begun to compromise assets once again. So far this year, Worok has reportedly targeted an energy company in Central Asia and a public sector organization in Southeast Asia. Malware utilized by the group in these recent attacks includes the PowHeartBeat PowerShell backdoor, PNGLoad steganographic loader, and the CLRLoad assembly loader. These tools working in tandem allow for threat actors to send arbitrary commands via command-and-control (C2) and continue espionage operations on the compromised company. CTIX continues to track threat actor activity worldwide and will continue to provide updates accordingly.