Rewterz Threat Alert – Dark Pink APT Threat Actor Group – Active IOCs

Severity

High

Analysis Summary

Dark Pink is an Advanced Persistent Threat (APT) group that has been identified and tracked by a Threat Intelligence platform. The group has been found to have launched at least seven successful attacks between June and December of 2022, and is believed to be targeting government agencies and military bodies in the APAC region (Cambodia, Indonesia, Malaysia, Philippines, and Vietnam), and one organization in Europe (Bosnia and Herzegovina). 

DarkPink APT timeline

Researchers provided more details on the group’s tactics, techniques, and procedures, which involve the use of USB drives to spread malware and steal information. 

The primary vector of attack used by Dark Pink is targeted spear-phishing emails, where the threat actors pose as job applicants. The group’s activities include stealing confidential information, exfiltrating data from messengers, and capturing audio from the infected device microphone. This group’s operations have been known to be sophisticated and well-co-ordinated, with a wide range of tools being used to exploit victims

To protect against DarkPink and other APT groups, organizations should implement a robust cybersecurity posture, including regularly patching systems and software, using anti-virus and intrusion detection/prevention systems, and providing security awareness training for employees. In addition, organizations should implement strong access controls, limit the amount of sensitive information that is stored on systems and networks, and regularly monitor their networks for signs of compromise.

Impact

• Confidential Information Theft
• Documents Exfiltration
• Audio Capturing

Indicators of Compromise

MD5

• 836184b7387b212f8b7f064d5e60f587
• 0f50af41edb7e3456cba4dd05b805da1

SHA-256

• 205f6808ab05ff3932ee799f37c227a7a950e07ea97f51d206e0563c83592e60
• 163a421dcc6d6f809c42dd8205dfe1b1d6bdda7bce1d2a40d4a1e6ea9336cb08

SHA-1

• fcefbe984fa0e343ec51cb22b6119014a6b1ee36
• 57e22fc0a69a532bfd5ada2aa8aec2e71af3cec7

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
• Emails from unknown senders should always be treated with caution.
• Never trust or open links and attachments received from unknown sources/senders.
• Patch and upgrade any platforms and software timely and make it into a standard security policy. Prioritize patching known exploited vulnerabilities and zero-days.
• Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets
• Implement strong access controls, limit the amount of sensitive information that is stored on systems and networks