Dark Pink APT Group Deploys KamiKakaBot Against South Asian Entities

The menace actor acknowledged as Dark Pink has been involved with deployments of the KamiKakaBot malware versus several governing administration entities in ASEAN (Association of Southeast Asian Nations) international locations.

Menace researchers at EclecticIQ reviewed the conclusions in a weblog publish released last week, detailing the noticed attacks took spot in February.

“In this new marketing campaign, the romantic relationship concerning Europe and ASEAN nations is incredibly probable staying exploited in the sort of social engineering lures from armed service and authorities entities in Southeast Asian nations,” the report explained. 

“Although scientists lack the conclusive evidence required to attribute the nationality of this team, the objectives of the attackers and some of the designs counsel that the Dark Pink group could quite possibly be a Chinese APT team.”

The team added that the malicious campaigns were almost identical to those previously uncovered by Team-IB.

“In January 2023, the danger actors utilized ISO visuals to provide KamiKakaBot, which was executed applying a DLL side-loading system,” reads the EclecticIQ write-up. “The primary variation in the February marketing campaign is that the malware’s obfuscation regime has enhanced to better evade anti-malware steps.”

Go through a lot more on that campaign here: New APT Dark Pink Hits Asia-Pacific, Europe With Spear Phishing Tactics

The KamiKakaBot malware, sent by means of phishing e-mail all through Dark Pink’s most up-to-date attacks, aims to steal qualifications, searching history and cookies from browsers like Chrome, Edge and Firefox. The malware also features distant code execution (RCE) capabilities.

“Developers of KamiKakaBot utilize a variety of evasion tactics to stay undetected whilst executing destructive steps on infected devices,” EclecticIQ wrote. “For instance, they use living-off-the-land binaries (LOLBINs) […] to run the KamiKakaBot malware on victims’ devices.”

They also utilized respectable web expert services as a Command and Regulate (C2) server, specially Telegram, to even more hide their malicious intentions.

To shield techniques from Dark Pink and related threats, EclecticIQ endorses businesses use secure DLL search manner, disable mounting ISO photographs by means of team plan and disable browser password conserving also through group plan, as nicely as deploy the highest stage of defense on firewalls and endpoints.

The company’s advisory will come weeks immediately after knowledge from Proofpoint advised phone attacks and multi-factor authentication (MFA) bypass approaches have been driving phishing attacks upward in 2022.

Some elements of this short article are sourced from:
www.infosecurity-magazine.com