Tuesday, February 11, 2025
HomeCyber Security NewsDark Pink APT Group Compromised 13 Organizations in 9 Countries

Dark Pink APT Group Compromised 13 Organizations in 9 Countries

Published on

SIEM as a Service

Follow Us on Google News

A Singapore-based cybersecurity firm, Group-IB, has released a new report on Dark Pink, an APT group. 

The report emphases that Dark Pink has successfully targeted 13 organizations across 9 countries, highlighting the extent of their malicious activities.

Throughout 2023, the notorious hacking group Dark Pink APT has maintained a high activity level.

Their focus has been on infiltrating various organizations in Indonesia, Brunei, and Vietnam

These targeted countries have experienced ongoing attention from the group, underscoring their persistent presence and intentions.

Here below, we have mentioned all the organizations that are targeted:-

  • Government organizations
  • Military organizations
  • Education organizations

5 New Organization Compromised by Dark Pink

Having operated since mid-2021, the threat group has predominantly focused on targeting organizations in the Asia-Pacific region. 

However, their activities were brought to light in January 2023 through a comprehensive report by Group-IB.

Researchers have made significant findings in their recent analysis of previous threat actor activities.

They have uncovered additional security breaches affecting an educational institute in Belgium and a military organization in Thailand.

In a recent development, Group-IB experts have identified 5 additional victims targeted by Dark Pink, expanding the group’s list of victims.

Dark Pink Group Attack by Country

This discovery has revealed that the geographical reach of Dark Pink’s operations extends beyond initial estimations, indicating a broader impact than previously anticipated.

Ongoing analysis confirms the persistent activity of the Dark Pink group, evidenced by their recent attacks. 

In January, they targeted a government ministry in Brunei, and as recently as April 2023, they launched an attack on a government agency in Indonesia.

Group-IB researchers have successfully linked three additional attacks from 2022 to this specific APT group.

While this attribution strengthens the evidence connecting the group to a wider range of malicious activities.

Initial Access Vector

Dark Pink attacks persistently rely on spear-phishing emails as their primary and initial access vector, as observed by Group-IB researchers. 

In their January 2023 blog, the researchers highlighted that the group employs a highly customized toolkit to extract files and messenger data from compromised devices and networks.

Recent findings by Group-IB experts indicate that the Dark Pink APT group has significantly updated its custom tools. 

These modifications aim to alter the functionalities of the tools, enabling the group to evade detection by cybersecurity systems’ defense mechanisms. 

The group’s customized KamiKakaBot module, stored on infected devices, is now split into two parts:- 

  • One for device control
  • The other one is for stealing sensitive data

What makes this intriguing is that both parts of the module are responsive to commands from threat actors via Telegram.

The Threat Intelligence unit of Group-IB found Dark Pink’s new GitHub account, created shortly after the APT group’s first public exposure in January.

Threat actors can use their control over infected machines to command downloads from this specific GitHub account. 

Moreover, from January 9 to April 11, 2023, the researchers at Group-IB discovered 12 commits made to this newly identified account.

The group’s recent attacks involve exfiltrating stolen data via an HTTP protocol using a Webhook service, leveraging an MS Excel add-in to ensure TelePowerBot’s persistence. 

Not only that even, but Group-IB also issued proactive warnings to all confirmed and potential victims of Dark Pink attacks, aligning with their zero-tolerance policy on cybercrime.

Shut Down Phishing Attacks with Device Posture Security – Download Free E-Book

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

SHA256 Hash Calculation from Data Chunks

The SHA256 algorithm, a cryptographic hash function, is widely used for securing data integrity...

New Report of of 1M+ Malware Samples Show Application Layer Abused for Stealthy C2

A recent analysis of over one million malware samples by Picus Security has revealed...

Seven-Year-Old Linux Kernel Bug Opens Door to Remote Code Execution

Researchers have uncovered a critical vulnerability in the Linux kernel, dating back seven years,...

Ransomware Payments Plunge 35% as More Victims Refuse to Pay

In a significant shift within the ransomware landscape, global ransom payments plummeted by 35%...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

SHA256 Hash Calculation from Data Chunks

The SHA256 algorithm, a cryptographic hash function, is widely used for securing data integrity...

New Report of of 1M+ Malware Samples Show Application Layer Abused for Stealthy C2

A recent analysis of over one million malware samples by Picus Security has revealed...

Seven-Year-Old Linux Kernel Bug Opens Door to Remote Code Execution

Researchers have uncovered a critical vulnerability in the Linux kernel, dating back seven years,...