DarkPink

Reports per quarter

Techniques seen in the last two years

• T1027.006 1 report
• T1036.007 1 report
• T1059.001 1 report
• T1102.002 1 report
• T1127.001 1 report
• T1140 1 report
• T1204 1 report
• T1547 1 report
• T1547.004 1 report
• T1555.003 1 report

Counts come from technique IDs in the actor's report text.

CVEs named in reports

• CVE-2021-44207 KEV
• CVE-2021-44228 KEV ransomware
• CVE-2022-41040 KEV ransomware
• CVE-2022-41082 KEV ransomware
• CVE-2022-41328 KEV
• CVE-2022-42475 KEV ransomware
• CVE-2022-49475
• CVE-2023-36025 KEV
• CVE-2023-38831 KEV ransomware
• CVE-2024-21412 KEV ransomware

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

1. 6 April 2026

   Dark Pink APT Group Strikes Government Entities in South Asian Countries

   date ORKL added it fromORKL

   Archived copy on ORKL Detailsfor Dark Pink APT Group Strikes Government Entities in South Asian Countries

2. 18 March 2024

   Securonix Threat Research Security Advisory: Analysis of New DEEP#GOSU Attack Campaign Likely Associated with North Korean Kimsuky Targeting Victims with Stealthy Malware

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor Securonix Threat Research Security Advisory: Analysis of New DEEP#GOSU Attack Campaign Likely Associated with North Korean Kimsuky Targeting Victims with Stealthy Malware

3. 16 February 2024

   CVE-2024-21412_ Water Hydra Targets Traders with Microsoft Defender SmartScreen Zero-Day

   file creation date fromORKL

   The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor CVE-2024-21412_ Water Hydra Targets Traders with Microsoft Defender SmartScreen Zero-Day

4. 13 February 2024

   CVE-2024-21412: Water Hydra Targets Traders with Microsoft Defender SmartScreen Zero-Day

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor CVE-2024-21412: Water Hydra Targets Traders with Microsoft Defender SmartScreen Zero-Day

5. 12 January 2024

   Dark Pink APT unleashes malware for deeper and more sinister intrusions in the Asia-Pacific and Europe _ Group-IB Blog

   file creation date fromORKL

   The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Dark Pink APT unleashes malware for deeper and more sinister intrusions in the Asia-Pacific and Europe _ Group-IB Blog

6. 10 November 2023

   The New APT Group DarkCasino and the Global Surge in WinRAR 0-Day Exploits - NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks.

   Malpedia library date NSFOCUS fromORKLCCS '25 data

   Archived copy on ORKL Detailsfor The New APT Group DarkCasino and the Global Surge in WinRAR 0-Day Exploits - NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks.

7. 7 September 2023

   My Tea’s not cold. An overview of China’s cyber threat

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor My Tea’s not cold. An overview of China’s cyber threat

8. 31 May 2023

   Latest techniques of the Dark Pink APT | Group-IB Blog

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor Latest techniques of the Dark Pink APT | Group-IB Blog

9. 11 January 2023

   Dark Pink: New APT group targets governmental, military organizations in APAC, Europe | Group-IB

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor Dark Pink: New APT group targets governmental, military organizations in APAC, Europe | Group-IB

10. 11 January 2023

    Dark Pink - New APT hitting Asia-Pacific, Europe that goes deeper and darker

    date in the title fromORKL

    The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Dark Pink - New APT hitting Asia-Pacific, Europe that goes deeper and darker

Newest first. Details opens the report in Explore.