{"id":29212,"date":"2023-01-11T07:06:41","date_gmt":"2023-01-11T07:06:41","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2023\/01\/11\/dark-pink-hacking-group-targets-government-and-military-in-southeast-asia\/"},"modified":"2023-01-11T07:06:41","modified_gmt":"2023-01-11T07:06:41","slug":"dark-pink-hacking-group-targets-government-and-military-in-southeast-asia","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2023\/01\/11\/dark-pink-hacking-group-targets-government-and-military-in-southeast-asia\/","title":{"rendered":"‘Dark Pink’ hacking group targets government and military in Southeast Asia"},"content":{"rendered":"

<\/a>\n
<\/p>\n

\n

Cybersecurity services company Group-IB Global Pvt. Ltd.<\/a>\u00a0today published a report on a new advanced persistent threat campaign targeting countries in Southeast Asia and Eastern Europe for apparent espionage purposes.<\/p>\n

Dubbed \u201cDark Pink,\u201d the APT is believed to be a new threat actor. Dark Pink has been found to be targeting\u00a0military bodies, government ministries and agencies, and religious and nonprofit organizations in Cambodia, Indonesia, Malaysia, Philippines, Vietnam and Bosnia and Herzegovina.<\/p>\n

Group-IB\u2019s Threat Intelligence researchers have linked seven successful attacks to the group, along with one unsuccessful attack on a European state development body based in Vietnam.<\/p>\n

Dark Pink is using spear-phishing emails to target victims for corporate espionage with an almost-entirely custom toolkit. The group\u2019s tools attempt to exfiltrate files, microphone audio and messenger data from infected devices and networks.<\/p>\n

To date, the researchers have been unable to attribute this campaign, which leverages custom tools and some rarely-seen tactics and techniques, to any known threat actor. As a result, Group-IB believes that Dark Pink\u2019s campaign in the second half of 2022 is the activity of an entirely new group, which has also been termed Saaiwc Group by Chinese cybersecurity researchers.<\/p>\n

While the Group-IB researchers have been unable to attribute the campaign, the signs point to a state-sponsored actor, given the targets include branches of\u00a0the military, government ministries and related agencies. Successful Dark Pink attacks include\u00a0a branch of the Philippines military in September, a Malaysian military branch in October and government organizations\u00a0in Bosnia and Herzegovina and Cambodia.<\/p>\n

Along with a custom toolkit, Dark Pink was found to be issuing commands to infected computers to download malicious files from GitHub. The researchers note that surprisingly, the threat actors have been using the same GitHub account for the entire duration of their campaign, which is seen as a sign that they have been able to operate without detection for a significant period of time.<\/p>\n

The group\u2019s spear-phishing campaign, however, is nothing new: fake job applications. The researchers found that the group posed as a job seeker applying for a position as a public relations and communications intern, mentioning that they found the vacancy on a jobseeker site. The spear-phishing emails contain a link to a site that prompts the victim to download a malicious DLL file.<\/p>\n

Group-IB has gone public with the details in line with its zero-tolerance policy for cybercrime, which includes proactive notifications to all potential and confirmed targets of Dark Pink. Group-IB researchers are continuing to uncover and analyze all the details behind this particular APT campaign.<\/p>\n

Image: Rawpixel<\/a><\/h5>\n
\n
\n

Show your support for our mission by joining our Cube Club and Cube Event Community of experts. Join the community that includes Amazon Web Services and Amazon.com CEO Andy Jassy, Dell Technologies founder and CEO Michael Dell, Intel CEO Pat Gelsinger and many more luminaries and experts.<\/span><\/h3>\n<\/div><\/div>\n