Dark Pink: New APT group targets governmental, military organizations in APAC, Europe

guest · Jan 11, 2023

By Ravie Lakshmanan - January 11, 2023

Government and military organizations in the Asia-Pacific region are being targeted by a previously unknown advanced persistent threat (APT) actor, per the latest research conducted by Albert Priego of Group-IB

Singapore-headquartered Group-IB, in a report shared with The Hacker News, said it's tracking the ongoing campaign under the name Dark Pink and attributed seven successful attacks to the adversarial collective between June and December 2022.
Click to expand...

The threat actor is estimated to have commenced its operations way back in mid-2021, although the attacks ramped up only a year later using a never-before-seen custom toolkit designed to plunder valuable information from compromised networks.

"Dark Pink APT's primary goals are to conduct corporate espionage, steal documents, capture the sound from the microphones of infected devices, and exfiltrate data from messengers," Group-IB researcher Andrey Polovinkin said, describing the activity as a "highly complex APT campaign launched by seasoned threat actors."
In addition to its sophisticated malware arsenal, the group has been observed leveraging spear-phishing emails to initiate its attacks as well as Telegram API for command-and-control (C2) communications.
Click to expand...

The Dark Pink campaign further stands out for employing multiple infection chains, wherein the phishing messages contain a link to a booby-trapped ISO image file to activate the malware deployment process. In one instance, the adversary posed as a candidate applying for a PR internship.
Click to expand...

Group-IB: Dark Pink - New APT hitting Asia-Pacific, Europe that goes deeper and darker

Andrey Polovinkin @AlbertPriego - January 11, 2023
Dark Pink is the name given by Group-IB to a new wave of APT attacks that has struck the APAC region. At the present time, Group-IB cannot attribute the campaign to any known threat actor, making it highly likely that Dark Pink is an entirely new APT group.

Bearing this in mind, we will refer to Dark Pink as an APT group throughout the entirety of this text. The name Dark Pink was coined by forming a hybrid of some of the email addresses used by the threat actors during data exfiltration. The APT group has also been termed Saaiwc Group by Chinese cybersecurity researchers.
Click to expand...

Log in or Sign up

Dark Pink: New APT group targets governmental, military organizations in APAC, Europe

guest Guest

Log in or Sign up

Dark Pink: New APT group targets governmental, military organizations in APAC, Europe

guest Guest

Useful Searches