Full Report
4 malicious campaigns, 13 confirmed victims, and a new wave of Cobalt Strike infections
Analysis Summary
Based on the technical report provided, here is the structured summary of the threat actor activity.
# Threat Actor: DarkPink (APT-F-27 / Saaiwc)
## Attribution & Identity
* **Actor Identification:** DarkPink (identified by Group-IB)
* **Aliases:** APT-F-27, Saaiwc Group.
* **Associations:** An Asia-Pacific-based threat actor, first identified as a distinct entity following a wave of highly targeted attacks in late 2022 and 2023.
## Activity Summary
The actor has conducted at least **four distinct malicious campaigns** resulting in **13 confirmed victims**. The recent wave of activity is characterized by a sophisticated infection chain leading to the deployment of **Cobalt Strike** beacons, often leveraging cloud infrastructure for evasion.
## Tactics, Techniques & Procedures
* **Initial Access:** Spear-phishing emails containing malicious attachments (often ISO files or ZIP archives).
* **Execution:** Use of DLL Side-Loading to execute malicious payloads while appearing as legitimate processes.
* **Evasion:**
* Abuse of legitimate cloud services (e.g., Cloudflare Workers) to tunnel C2 traffic.
* Use of signed binaries to load malicious DLLs.
* Malleable C2 profiles to mimic legitimate jQuery traffic.
* **Post-Exploitation:** Deployment of Cobalt Strike for lateral movement and data exfiltration.
* **Persistence:** Use of scheduled tasks or registry modifications to maintain access.
**MITRE ATT&CK IDs:**
* **T1566.001:** Phishing: Spearphishing Attachment
* **T1574.002:** Hijack Execution Flow: DLL Side-Loading
* **T1071.001:** Application Layer Protocol: Web Protocols (HTTP/S)
* **T1059.005:** Command and Scripting Interpreter: Visual Basic
* **T1027:** Obfuscated Files or Information
## Targeting
* **Sectors:** Primarily Government, Military, and Non-Profit organizations.
* **Geography:** Strong focus on the **APAC (Asia-Pacific)** region, including Vietnam, Malaysia, Indonesia, and the Philippines.
* **Victims:** 13 confirmed organizations (specifically government agencies and religious entities).
## Tools & Infrastructure
* **Malware Families:**
* **Cobalt Strike:** Used for command and control.
* **TelePowerBot:** A specialized backdoor using Telegram for C2.
* **KamiKakaBot:** A .NET-based information stealer and downloader.
* **Infrastructure:**
* **C2 IPs:** `185.250.150[.]22`, `45.147.229[.]236`
* **Domains/URLs:**
* `mute-pond-371d.zalocdn.workers[.]dev`
* `https[:]//mute-pond-371d.zalocdn.workers[.]dev/jquery-3.2.2.min.js`
* **Artifacts:** Malleable C2 profiles disguised as `jquery-3.3.1.min.js`.
## Implications
DarkPink represents a high-tier persistent threat. Their ability to successfully breach government and military targets using custom-built tools and cloud-evasion techniques suggests a well-resourced actor. The transition to using Cloudflare Workers for C2 infrastructure makes detection significantly harder for organizations that do not perform deep packet inspection or TLS decryption on outbound cloud traffic.
## Mitigations
* **Network Security:** Implement strict monitoring and inspection of traffic to known cloud worker domains (e.g., `*.workers.dev`).
* **Endpoint Protection:** Deploy EDR solutions to detect DLL side-loading patterns, particularly those originating from common productivity software or signed binaries in unusual paths.
* **Email Security:** Block ISO, VHD, and LNK files at the email gateway if they are not required for business operations.
* **Identity Management:** Enforce Multi-Factor Authentication (MFA) to prevent the actor from utilizing stolen credentials gained via their infostealer bots (KamiKakaBot).