DARK PINK

Dark Pink (aka Saaiwc Group) is a Southeast Asia-linked advanced persistent threat (APT) group active since at least mid-2021group-ib.comsocradar.io. Focused on espionage, Dark Pink has targeted military, government, and religious organizations across Asia-Pacific (Vietnam, Malaysia, Philippines, Cambodia, Indonesia, Brunei, Thailand) and even Europe (e.g. Bosnia and an EU-based agency in Vietnam)group-ib.comgroup-ib.com. The group’s operations are characterized by stealth and custom tooling designed to steal sensitive data (documents, credentials, even microphone audio and messenger data)group-ib.comsocradar.io. Dark Pink employs a novel toolkit – notably the TelePowerBot PowerShell backdoor and KamiKakaBot .NET malware – alongside proprietary stealers Cucky and Ctealer, rather than off-the-shelf malwaregroup-ib.comgroup-ib.com. They utilize unconventional techniques rarely seen in the wild, such as DLL side-loading and malicious file association hijacking, to gain initial access and persistencegroup-ib.comgroup-ib.com. All known attacks have leveraged spear-phishing emails (often masquerading as job applicants) with malicious ISO attachments to infiltrate targetsgroup-ib.com. As of 2023, Dark Pink remains active and evolving – expanding its victimology to new countries and refining its tools to evade detection