Dark Pink APT Group Compromised 13 Organizations in 9 Countries

A Singapore-based cybersecurity firm, Group-IB, has released a new report on Dark Pink, an APT group. 

The report emphases that Dark Pink has successfully targeted 13 organizations across 9 countries, highlighting the extent of their malicious activities.

Throughout 2023, the notorious hacking group Dark Pink APT has maintained a high activity level.

Their focus has been on infiltrating various organizations in Indonesia, Brunei, and Vietnam. 

These targeted countries have experienced ongoing attention from the group, underscoring their persistent presence and intentions.

Here below, we have mentioned all the organizations that are targeted:-

• Government organizations
• Military organizations
• Education organizations

5 New Organization Compromised by Dark Pink

Having operated since mid-2021, the threat group has predominantly focused on targeting organizations in the Asia-Pacific region. 

However, their activities were brought to light in January 2023 through a comprehensive report by Group-IB.

Researchers have made significant findings in their recent analysis of previous threat actor activities.

They have uncovered additional security breaches affecting an educational institute in Belgium and a military organization in Thailand.

In a recent development, Group-IB experts have identified 5 additional victims targeted by Dark Pink, expanding the group’s list of victims.

This discovery has revealed that the geographical reach of Dark Pink’s operations extends beyond initial estimations, indicating a broader impact than previously anticipated.

Ongoing analysis confirms the persistent activity of the Dark Pink group, evidenced by their recent attacks. 

In January, they targeted a government ministry in Brunei, and as recently as April 2023, they launched an attack on a government agency in Indonesia.

Group-IB researchers have successfully linked three additional attacks from 2022 to this specific APT group.

While this attribution strengthens the evidence connecting the group to a wider range of malicious activities.

Initial Access Vector

Dark Pink attacks persistently rely on spear-phishing emails as their primary and initial access vector, as observed by Group-IB researchers. 

In their January 2023 blog, the researchers highlighted that the group employs a highly customized toolkit to extract files and messenger data from compromised devices and networks.

Recent findings by Group-IB experts indicate that the Dark Pink APT group has significantly updated its custom tools. 

These modifications aim to alter the functionalities of the tools, enabling the group to evade detection by cybersecurity systems’ defense mechanisms. 

The group’s customized KamiKakaBot module, stored on infected devices, is now split into two parts:- 

• One for device control
• The other one is for stealing sensitive data

What makes this intriguing is that both parts of the module are responsive to commands from threat actors via Telegram.

The Threat Intelligence unit of Group-IB found Dark Pink’s new GitHub account, created shortly after the APT group’s first public exposure in January.

Threat actors can use their control over infected machines to command downloads from this specific GitHub account. 

Moreover, from January 9 to April 11, 2023, the researchers at Group-IB discovered 12 commits made to this newly identified account.

The group’s recent attacks involve exfiltrating stolen data via an HTTP protocol using a Webhook service, leveraging an MS Excel add-in to ensure TelePowerBot’s persistence. 

Not only that even, but Group-IB also issued proactive warnings to all confirmed and potential victims of Dark Pink attacks, aligning with their zero-tolerance policy on cybercrime.

Shut Down Phishing Attacks with Device Posture Security – Download Free E-Book