DarkPink

Executive Summary

DarkPink (Saaiwc) is an advanced threat active since mid‑2021 that specializes in spear‑phishing delivery of custom trojans such as TelePowerBot and KamiKakaBot to government, military and related organizations across Southeast Asia and Europe. The group leverages public cloud services for command‑and‑control, exfiltration, and persistence while exploiting known vulnerabilities (e.g., CVE-2023‑38831) and maintaining a low profile through DLL side‑loading and scheduled tasks.

Goals & Targeting

The actor’s strategic aims are centered on financial gain through ransomware or data exfiltration while preserving operational stealth. DarkPink deliberately targets nation‑state, defense, non‑profit, and critical infrastructure entities in the Asia‑Pacific and European regions, thereby maximizing political leverage and value of compromised data. Their persistent use of cloud platforms and third‑party web services indicates a focus on obscuring signal paths and scaling operations without raising immediate alarms.

Key Capabilities

• Deployment of custom trojan malware (TelePowerBot, KamiKakaBot) via spear‑phishing with ISO images or PDFs
• Use of phishing & social engineering including spam overload tactics to compromise help‑desk accounts
• Exploitation of public-facing vulnerabilities such as CVE-2023‑38831 for privilege escalation and persistence
• Persistence through DLL side‑loading and scheduled tasks
• Leveraging compromised cloud accounts (Dropbox, OneDrive, AWS S3) for staging, exfiltration, and uploader functionality
• Abuse of third‑party web services (Google, GitHub, Twitter, SendGrid) as command‑and‑control or infrastructure
• Installation of backdoored container images (AWS AMI, GCP image, Azure Image, Docker registry) for persistent foothold
• Multiple kill‑chain stages covering initial access to exfiltration with stealthy operations

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

DarkPink’s campaigns usually commence with a sophisticated phishing push, distributing ISO or PDF attachments that infect the target. The group then pivots to exploitation of known CVE‑2023‑38831 and other weak points to solidify persistence via DLL side‑loading and scheduled tasks. They frequently move data through compromised cloud storage accounts and funnel exfiltration traffic over public services such as Google Drive or GitHub, enabling rapid dissemination while maintaining low detection risk. The actor has demonstrated flexibility in using both on‑premise infrastructure and cloud‑based backdoors, indicating high operational tempo and adaptability.

IOC Patterns

• Public cloud service domains for C2 and exfiltration (Google Drive, GitHub, Dropbox)
• Malicious PDF/ISO file hashes delivered via spear‑phishing
• Suspicious executable files such as cmd.exe, explorer.exe, user32.dll, system.bat
• Temporary domain names used for command & control or data staging (e.g., TEMP.Veles)

Recommended Actions

• Implement strict outbound monitoring for traffic to third‑party services and alert on anomalous API calls to Google, GitHub, and Twitter.
• Enforce multi‑factor authentication for all help‑desk and remote support accounts to mitigate spam overload phishing.
• Patch systems promptly against CVE-2023‑38831 and other known vulnerabilities to block exploitation vectors.
• Monitor Windows event logs for DLL side‑loading and scheduled task creation indicative of persistence installation.
• Segment and secure cloud storage accounts; enforce least‑privilege access policies on Dropbox, OneDrive, and AWS S3.
• Deploy endpoint detection that flags the execution of custom trojans (TelePowerBot, KamiKakaBot) and obfuscated binaries.
• Conduct phishing awareness training focused on ISO/payload attachments and suspicious email domains.

Suggested Tags