Full Report
APT Dark Pink is back with 5 victims in new countries.
Analysis Summary
# Threat Actor: Dark Pink
## Attribution & Identity
* **Actor Name:** Dark Pink
* **Aliases:** Saaiwc Group (by some researchers)
* **Known Associations:** An APT group primarily focused on espionage in the Asia-Pacific (APAC) region, though expanding its footprint. The group is characterized by its use of custom malware and unique delivery mechanisms.
## Activity Summary
Dark Pink has resurfaced with new campaigns targeting organizations in countries previously outside its usual scope. The group remains highly active, specializing in long-term espionage operations. The recent activity shows a refinement of their custom toolset and a continued reliance on spear-phishing and DLL side-loading to gain initial access.
## Tactics, Techniques & Procedures
* **Initial Access:** Highly targeted spear-phishing emails containing malicious attachments or links to ZIP archives hosted on legitimate services like GitHub.
* **Execution:**
* Use of **DLL Side-Loading** (T1574.002) using legitimate executables (e.g., Windows Defender’s `ConfigSecurityPolicy.exe` or `dism.exe`) to load malicious payloads.
* PowerShell scripting for environment reconnaissance and persistence.
* **Persistence:**
* Creation of scheduled tasks.
* Use of shortcut (.LNK) files to trigger infection chains when users browse folders.
* Lateral movement via SMB shares and removable drives, placing hidden "system.bat" and "dism" directories in shared folders.
* **Evasion:**
* Setting file attributes to Hidden and System (+s +h) to conceal malicious directories and scripts.
* Use of `.gif` extensions for encoded ZIP archives to bypass basic security filters.
* **Exfiltration:** Custom tools designed to steal documents, browser data, and record audio/screenshots.
## Targeting
* **Sectors:** Government, Military, Education, and Non-Governmental Organizations (NGOs).
* **Geography:** Primarily Southeast Asia (Vietnam, Malaysia, Indonesia, Thailand) and recently expanding to countries in Europe and Africa (as suggested by the "5 victims in new countries" context).
* **Victims:** Five specific (though unnamed in this snippet) victims across new geographical regions.
## Tools & Infrastructure
* **Malware Families:**
* **KamiKakaBot:** A .NET-based tool used for information theft and command execution.
* **Cucky/Cuckoo:** A custom browser credential stealer.
* **TelePowerBot:** A PowerShell-based backdoor that uses Telegram for Command and Control (C2).
* **Infrastructure:**
* **C2:** Telegram (used for command reception and data exfiltration).
* **Hosting:** GitHub (used to host malicious payloads).
* **Defanged URLs:**
* `https[:]//github[.]com/peterlyly/zxcv/raw/main/xxx[.]gif`
## Implications
Dark Pink represents a sophisticated and persistent threat to sovereign interests and high-value data. Their expansion into new territories suggests a broadening of their strategic mandate or a shift in the geopolitical priorities of their sponsors. Their ability to remain undetected using "living-off-the-land" techniques and legitimate cloud services (GitHub/Telegram) makes them a difficult target for traditional signature-based defenses.
## Mitigations
* **Email Security:** Implement advanced threat protection to scan for ZIP files containing LNK files or disguised DLLs.
* **Endpoint Monitoring:** Monitor for suspicious executions of legitimate system tools (like `dism.exe` or `ConfigSecurityPolicy.exe`) from non-standard paths or when spawning PowerShell.
* **Access Control:** Audit and restrict SMB share permissions. Disable AutoRun/AutoPlay and monitor for the creation of hidden `.lnk` or `.bat` files on network drives.
* **Network Filtering:** Block or closely monitor traffic to Telegram API domains if not required for business operations, as these are frequently used for C2.
* **Application Whitelisting:** Use AppLocker or Windows Defender Application Control (WDAC) to prevent unauthorized DLLs from being loaded by trusted binaries.