Tuesday, June 18, 2024

Dark Pink APT Group Compromised 13 Organizations in 9 Countries

A Singapore-based cybersecurity firm, Group-IB, has released a new report on Dark Pink, an APT group. 

The report emphases that Dark Pink has successfully targeted 13 organizations across 9 countries, highlighting the extent of their malicious activities.

Throughout 2023, the notorious hacking group Dark Pink APT has maintained a high activity level.

Their focus has been on infiltrating various organizations in Indonesia, Brunei, and Vietnam

These targeted countries have experienced ongoing attention from the group, underscoring their persistent presence and intentions.

Here below, we have mentioned all the organizations that are targeted:-

  • Government organizations
  • Military organizations
  • Education organizations

5 New Organization Compromised by Dark Pink

Having operated since mid-2021, the threat group has predominantly focused on targeting organizations in the Asia-Pacific region. 

However, their activities were brought to light in January 2023 through a comprehensive report by Group-IB.

Researchers have made significant findings in their recent analysis of previous threat actor activities.

They have uncovered additional security breaches affecting an educational institute in Belgium and a military organization in Thailand.

In a recent development, Group-IB experts have identified 5 additional victims targeted by Dark Pink, expanding the group’s list of victims.

Dark Pink Group Attack by Country

This discovery has revealed that the geographical reach of Dark Pink’s operations extends beyond initial estimations, indicating a broader impact than previously anticipated.

Ongoing analysis confirms the persistent activity of the Dark Pink group, evidenced by their recent attacks. 

In January, they targeted a government ministry in Brunei, and as recently as April 2023, they launched an attack on a government agency in Indonesia.

Group-IB researchers have successfully linked three additional attacks from 2022 to this specific APT group.

While this attribution strengthens the evidence connecting the group to a wider range of malicious activities.

Initial Access Vector

Dark Pink attacks persistently rely on spear-phishing emails as their primary and initial access vector, as observed by Group-IB researchers. 

In their January 2023 blog, the researchers highlighted that the group employs a highly customized toolkit to extract files and messenger data from compromised devices and networks.

Recent findings by Group-IB experts indicate that the Dark Pink APT group has significantly updated its custom tools. 

These modifications aim to alter the functionalities of the tools, enabling the group to evade detection by cybersecurity systems’ defense mechanisms. 

The group’s customized KamiKakaBot module, stored on infected devices, is now split into two parts:- 

  • One for device control
  • The other one is for stealing sensitive data

What makes this intriguing is that both parts of the module are responsive to commands from threat actors via Telegram.

The Threat Intelligence unit of Group-IB found Dark Pink’s new GitHub account, created shortly after the APT group’s first public exposure in January.

Threat actors can use their control over infected machines to command downloads from this specific GitHub account. 

Moreover, from January 9 to April 11, 2023, the researchers at Group-IB discovered 12 commits made to this newly identified account.

The group’s recent attacks involve exfiltrating stolen data via an HTTP protocol using a Webhook service, leveraging an MS Excel add-in to ensure TelePowerBot’s persistence. 

Not only that even, but Group-IB also issued proactive warnings to all confirmed and potential victims of Dark Pink attacks, aligning with their zero-tolerance policy on cybercrime.

Shut Down Phishing Attacks with Device Posture Security – Download Free E-Book


Latest articles

Singapore Police Arrested Two Individuals Involved in Hacking Android Devices

The Singapore Police Force (SPF) has arrested two men, aged 26 and 47, for...

CISA Conducts First-Ever Tabletop Exercise Focused on AI Cyber Incident Response

On June 13, 2024, the Cybersecurity and Infrastructure Security Agency (CISA) made history by...

Europol Taken Down 13 Websites Linked to Terrorist Operations

Europol and law enforcement agencies from ten countries have taken down 13 websites linked...

New ARM ‘TIKTAG’ Attack Impacts Google Chrome, Linux Systems

Memory corruption lets attackers hijack control flow, execute code, elevate privileges, and leak data.ARM's...

Operation Celestial Force Employing Android And Windows Malware To Attack Indian Users

A Pakistani threat actor group, Cosmic Leopard, has been conducting a multi-year cyber espionage...

Hunt3r Kill3rs Group claims they Infiltrated Schneider Electric Systems in Germany

The notorious cybercriminal group Hunt3r Kill3rs has claimed responsibility for infiltrating Schneider Electric's systems...

Hackers Employing New Techniques To Attack Docker API

Attackers behind Spinning YARN launched a new cryptojacking campaign targeting publicly exposed Docker Engine...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles