Dark Pink is an Advanced Persistent Threat (APT) group that has been identified and tracked by a Threat Intelligence platform. The group has been found to have launched at least seven successful attacks between June and December of 2022, and is believed to be targeting government agencies and military bodies in the APAC region (Cambodia, Indonesia, Malaysia, Philippines, and Vietnam), and one organization in Europe (Bosnia and Herzegovina).
DarkPink APT timeline
Researchers provided more details on the group’s tactics, techniques, and procedures, which involve the use of USB drives to spread malware and steal information.
The primary vector of attack used by Dark Pink is targeted spear-phishing emails, where the threat actors pose as job applicants. The group’s activities include stealing confidential information, exfiltrating data from messengers, and capturing audio from the infected device microphone. This group’s operations have been known to be sophisticated and well-co-ordinated, with a wide range of tools being used to exploit victims
To protect against DarkPink and other APT groups, organizations should implement a robust cybersecurity posture, including regularly patching systems and software, using anti-virus and intrusion detection/prevention systems, and providing security awareness training for employees. In addition, organizations should implement strong access controls, limit the amount of sensitive information that is stored on systems and networks, and regularly monitor their networks for signs of compromise.