Dark Pink. Episode 2
ID: da17d840-7155-5c37-9359-d6178c3883ed
STIX ID: report--da17d840-7155-5c37-9359-d6178c3883ed
Feed Name: Group-IB Blog
Threat Score
Group-IB's report analyzes the Dark Pink APT (Saaiwc Group), active since mid-2021 and continuing operations in 2023, detailing spear-phishing-based intrusions against government, military, non-profit and educational targets across APAC and Europe; it describes custom tools (KamiKakaBot, TelePowerBot), DLL sideloading and MSBuild execution, Excel add-in persistence, data-stealing from browsers, exfiltration via Telegram, webhook.site and a hosted server, and publishes IOCs and mitigation guidance.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.