New Dark Pink APT Group Targets Government and Military in Asia Pacific
Reading Time: 2 minutesA new APT group known as Dark Pink is targeting government and military bodies in the Asia-Pacific region.
A new APT group named Dark Pink has been targeting military and government bodies within numerous Asia-Pacific nations to extract valuable documentation.
Dark Pink APT Group Takes Aim at Military and Government
A slew of advanced persistent threat (APT) attacks was found to be launched by a group known as Dark Pink between June and December 2022. The attacks were launched against several countries in the Asia-Pacific, including Cambodia, Vietnam, Malaysia, Indonesia, and the Philippines. One European country, Bosnia and Herzegovina, was also targeted.
The Dark Pink attacks were first discovered by Albert Priego, a Group-IB malware analyst. In a Group-IB blog post regarding the incidents, it was stated that the malicious Dark Pink operators are ‘leveraging a new set of tactics, techniques, and procedures rarely utilized by previously known APT groups.’ Going into further detail, Group-IB wrote of a custom toolkit featuring four different infostealers: TelePowerBot, KamiKakaBot, Cucky, and Ctealer.
These infostealers are being used by Dark Pink to extract valuable documents stored within government and military networks.
The initial vector of Dark Pink’s attacks was said to be spear phishing campaigns, wherein the operators would impersonate job applicants. Group-IB also noted that Dark Pink has the ability to infect the USB devices connected to compromised computers. On top of this, Dark Pink can access the messengers installed on the infected computers.
Group-IB shared an infographic on the Dark Pink attacks on its Twitter page, as shown below.
While most of the attacks took place in Vietnam (with one being unsuccessful), a total of five additional attacks also took place in other nations.
Dark Pink’s Operators Are Currently Unknown
At the time of writing, the operators behind Dark Pink remain unknown. However, Group-IB did state in the aforementioned post that ‘a mixture of nation-state threat actors from China, North Korea, Iran, and Pakistan’ have been tied to APT attacks in Asia-Pacific countries. But it was noted that it seems Dark Pink came about as early as mid-2021, with a surge in activity arising in mid-2022.
Group-IB also noted that the aim of such attacks is often to commit espionage, rather than to benefit financially.
The Dark Pink APT Group Remains Active
In its blog post, Group-IB informed readers that, at the time of writing (January 11, 2023), the Dark Pink APT group remains active. As the attacks did not end until late 2022, Group-IB is still investigating the issue and determining its scope.
The company hopes to uncover the operators of these attacks, and stated in its blog post that the preliminary research conducted on the incident should ‘go a long way to raising awareness of the new TTPs utilized by this threat actor and help organizations to take the relevant steps to protect themselves from a potentially devastating APT attack’.
APT Groups Pose a Huge Security Threat
Advanced persistent threat (APT) groups pose a huge risk to organizations around the world. As cybercrime methods continue to increase in their sophistication, there’s no knowing what kind of attack APT groups will launch next, and what consequences it will have on the target.
Reference: https://www.makeuseof.com/new-dark-pink-group-targrets-asia-pacific-government-military/
Ref: makeuseof
MediaDownloader.net -> Free Online Video Downloader, Download Any Video From YouTube, VK, Vimeo, Twitter, Twitch, Tumblr, Tiktok, Telegram, TED, Streamable, Soundcloud, Snapchat, Share, Rumble, Reddit, PuhuTV, Pinterest, Periscope, Ok.ru, MxTakatak, Mixcloud, Mashable, LinkedIn, Likee, Kwai, Izlesene, Instagram, Imgur, IMDB, Ifunny, Gaana, Flickr, Febspot, Facebook, ESPN, Douyin, Dailymotion, Buzzfeed, BluTV, Blogger, Bitchute, Bilibili, Bandcamp, Akıllı, 9GAG