New APT Dark Pink Hits Asia-Pacific, Europe With Spear Phishing Tactics

A brand new superior persistent menace (APT) group dubbed ‘Darkish Pink’ by Group-IB (and ‘Saaiwc Group’ by Chinese language cybersecurity researchers) has been noticed concentrating on numerous entities throughout Asia-Pacific and Europe, primarily with spear phishing methods.

In accordance with a brand new advisory printed by Group-IB earlier immediately, Darkish Pink started operations as early as mid-2021, though the group’s exercise sharply elevated in mid-to-late 2022.

“To this point, [we have] uncovered seven confirmed assaults by Darkish Pink,” reads the technical write-up. “The majority of the assaults had been carried out towards international locations within the APAC area, though the menace actors unfold their wings and focused one European governmental ministry.”

Extra particularly, Group-IB recognized two army entities within the Philippines and Malaysia, a non secular group in Vietnam, and authorities companies in Cambodia, Indonesia and Bosnia and Herzegovina.

The safety consultants additionally noticed an unsuccessful assault on a Vietnam-based European state improvement company.

“Group-IB’s early analysis into Darkish Pink has revealed that these menace actors are leveraging a brand new set of techniques, methods, and procedures not often utilized by beforehand identified APT teams,” reads the advisory.

These embrace a customized toolkit that includes TelePowerBot, KamiKakaBot and Cucky and Ctealer info stealers. Additional, Darkish Pink may also infect USB units connected to compromised computer systems.

“Darkish Pink menace actors make the most of two core methods: DLL Facet-Loading and executing malicious content material triggered by a file kind affiliation […] The latter of those techniques is one not often seen utilized within the wild by menace actors,” Group-IB defined.

The safety staff additionally added that menace actors had created a set of PowerShell scripts for communications between victims and menace actors’ infrastructure and used Telegram API for all communication between them and contaminated infrastructure.

“The menace actors behind Darkish Pink had been ready, with the help of their customized toolkit, to breach the defenses of governmental and army our bodies in a variety of nations within the APAC and European areas,” Group-IB wrote.

“Darkish Pink’s marketing campaign as soon as once more underlines the huge risks that spear-phishing campaigns pose for organizations, as even extremely superior menace actors use this vector to achieve entry to networks, and we suggest that organizations proceed to teach their personnel on the way to detect these types of emails.”

Extra details about spear phishing and comparable assaults may be discovered in a latest evaluation by cybersecurity blogger Farwa Sajjad.