Dark Pink

Group-IB describes “Dark Pink,” a newly identified APT conducting targeted espionage across APAC (and one European target) from mid‑2021 through late 2022. The actors used tailored spear‑phishing with ISO attachments, DLL side‑loading and an uncommon Event Triggered Execution (file association) technique to deploy custom tools (TelePowerBot, KamiKakaBot) and steal data via Telegram, Dropbox and email; they also deployed stealers (Cucky, Ctealer), recorded microphone audio, and propagated via USB and network shares. The report provides technical analysis, kill chains, IOCs (hashes, registry keys, paths, exfiltration emails) and defensive recommendations.