Rewterz Threat Alert – Dark Pink APT Threat Actor Group – Active IOCs

Severity

High

Analysis Summary

Dark Pink is an Advanced Persistent Threat (APT) group that has been identified and tracked by a Threat Intelligence platform. The group has been found to have launched at least seven successful attacks between June and December of 2022, and is believed to be targeting government agencies and military bodies in the APAC region (Cambodia, Indonesia, Malaysia, Philippines, and Vietnam), and one organization in Europe (Bosnia and Herzegovina). 

DarkPink APT timeline

Researchers provided more details on the group’s tactics, techniques, and procedures, which involve the use of USB drives to spread malware and steal information. 

The primary vector of attack used by Dark Pink is targeted spear-phishing emails, where the threat actors pose as job applicants. The group’s activities include stealing confidential information, exfiltrating data from messengers, and capturing audio from the infected device microphone. This group’s operations have been known to be sophisticated and well-co-ordinated, with a wide range of tools being used to exploit victims

To protect against DarkPink and other APT groups, organizations should implement a robust cybersecurity posture, including regularly patching systems and software, using anti-virus and intrusion detection/prevention systems, and providing security awareness training for employees. In addition, organizations should implement strong access controls, limit the amount of sensitive information that is stored on systems and networks, and regularly monitor their networks for signs of compromise.

Impact

• Confidential Information Theft
• Documents Exfiltration
• Audio Capturing 

Indicators of Compromise

MD5

• 89a4f399366346357dac8dea06b9974b

SHA-256

• d8dfebe48a8c8a0636441bad0211c08af151138535ca289fffab51f0b030977d

SHA-1

• 72c16a295d0e3c97bc8c534dc58cd967a8eb393f

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
• Emails from unknown senders should always be treated with caution.
• Never trust or open ” links and attachments received from unknown sources/senders.
• Patch and upgrade any platforms and software timely and make it into a standard security policy. Prioritize patching known exploited vulnerabilities and zero-days.
• Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets
• Implement strong access controls, limit the amount of sensitive information that is stored on systems and networks