Dark Pink APT Group Compromised 13 Organizations in 9 Countries

A Singapore-based cybersecurity firm, Group-IB, has released a new report on Dark Pink, an APT group. 

The report emphases that Dark Pink has successfully targeted 13 organizations across 9 countries, highlighting the extent of their malicious activities.

Throughout 2023, the notorious hacking group Dark Pink APT has maintained a high activity level.

Their focus has been on infiltrating various organizations in Indonesia, Brunei, and Vietnam

These targeted countries have experienced ongoing attention from the group, underscoring their persistent presence and intentions.

Here below, we have mentioned all the organizations that are targeted:-

  • Government organizations
  • Military organizations
  • Education organizations

5 New Organization Compromised by Dark Pink

Having operated since mid-2021, the threat group has predominantly focused on targeting organizations in the Asia-Pacific region. 

However, their activities were brought to light in January 2023 through a comprehensive report by Group-IB.

Researchers have made significant findings in their recent analysis of previous threat actor activities.

They have uncovered additional security breaches affecting an educational institute in Belgium and a military organization in Thailand.

In a recent development, Group-IB experts have identified 5 additional victims targeted by Dark Pink, expanding the group’s list of victims.

Dark Pink Group Attack by Country

This discovery has revealed that the geographical reach of Dark Pink’s operations extends beyond initial estimations, indicating a broader impact than previously anticipated.

Ongoing analysis confirms the persistent activity of the Dark Pink group, evidenced by their recent attacks. 

In January, they targeted a government ministry in Brunei, and as recently as April 2023, they launched an attack on a government agency in Indonesia.

Group-IB researchers have successfully linked three additional attacks from 2022 to this specific APT group.

While this attribution strengthens the evidence connecting the group to a wider range of malicious activities.

Initial Access Vector

Dark Pink attacks persistently rely on spear-phishing emails as their primary and initial access vector, as observed by Group-IB researchers. 

In their January 2023 blog, the researchers highlighted that the group employs a highly customized toolkit to extract files and messenger data from compromised devices and networks.

Recent findings by Group-IB experts indicate that the Dark Pink APT group has significantly updated its custom tools. 

These modifications aim to alter the functionalities of the tools, enabling the group to evade detection by cybersecurity systems’ defense mechanisms. 

The group’s customized KamiKakaBot module, stored on infected devices, is now split into two parts:- 

  • One for device control
  • The other one is for stealing sensitive data

What makes this intriguing is that both parts of the module are responsive to commands from threat actors via Telegram.

The Threat Intelligence unit of Group-IB found Dark Pink’s new GitHub account, created shortly after the APT group’s first public exposure in January.

Threat actors can use their control over infected machines to command downloads from this specific GitHub account. 

Moreover, from January 9 to April 11, 2023, the researchers at Group-IB discovered 12 commits made to this newly identified account.

The group’s recent attacks involve exfiltrating stolen data via an HTTP protocol using a Webhook service, leveraging an MS Excel add-in to ensure TelePowerBot’s persistence. 

Not only that even, but Group-IB also issued proactive warnings to all confirmed and potential victims of Dark Pink attacks, aligning with their zero-tolerance policy on cybercrime.

Shut Down Phishing Attacks with Device Posture Security – Download Free E-Book

Guru baran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

IT and security Leaders Feel Ill-Equipped to Handle Emerging Threats: New Survey

A comprehensive survey conducted by Keeper Security, in partnership with TrendCandy Research, has shed light on the growing concerns within…

3 hours ago

How to Analyse .NET Malware? – Reverse Engineering Snake Keylogger

Utilizing sandbox analysis for behavioral, network, and process examination provides a foundation for reverse engineering .NET malware.  The write-up outlines…

4 hours ago

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting the growing, widespread use and potential…

17 hours ago

C2A Security’s EVSec Risk Management and Automation Platform Gains Automotive Industry Favor as Companies Pursue Regulatory Compliance

In 2023, C2A Security added multiple OEMs and Tier 1s to its portfolio of customers, successful evaluations, and partnerships such…

18 hours ago

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and education. The latest update, Wireshark 4.2.4,…

21 hours ago

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered platform designed to redefine how we…

21 hours ago