DarkPinkThreat actor
- Saaiwc
DarkPink is an APT group that has been active since mid-2021, primarily targeting government, military, and non-profit organizations in Southeast Asia and Europe. The group employs spear phishing techniques, utilizing ISO images and malicious PDF files to deliver custom Trojan programs like TelePowerBot and KamiKakaBot for information theft.From MISP Galaxy
Last reported 3 years ago, by Group-IB2 reports
ATT&CK techniques
6 of 46 · each with the sentence it comes from- T1053.005Scheduled Task
“Scheduled task name:”
- T1546Event Triggered Execution
“…eat actors utilize two core techniques: DLL Side-Loading and executing malicious content triggered by a file type association (Event Triggered Execution: Change Default File Association).”
- T1548.002Bypass User Account Control
“During their attacks, the threat actors used an already known technique to bypass User Account Control (UAC) to alter the settings in Windows Defender.”
- T1555.003Credentials from Web Browsers
“Additionally, Dark Pink APT utilizes the self-made stealers Ctealer and Cucky to steal victim credentials from web browsers.”
- T1005Data from Local System
“T1005”
- T1010Application Window Discovery
“T1010”
What the reports say
2 reports, newest first · the exact sentence from each-
Dark Pink. Episode 2“…e techniques and tools used by a new APT (Advanced Persistent Threat) group codenamed Dark Pink by Group-IB (also tracked under the name Saaiwc Group).”
-
Dark Pink“The APT group has also been termed Saaiwc Group by Chinese cybersecurity researchers.”
Indicators in its reports
named in the reports above- hxxps://api.telegram[.]org/bot$token/sendDocumentin 2 reports
- lolbas-project.github[.]ioin 1 report
- hxxps://github[.]com/peterlylyin 1 report
- hxxps://raw.githubusercontent[.]com/efimovah/abcd/main/ccc.gifin 1 report
Copy these 4 indicators · defanged
Thanks — we review every report.