File · DarkPink · Unknown · misp-galaxy · refreshed 2026-10-06
DarkPink
- Saaiwc
sigil · no ATT&CK coverage stated
What changed
ledger · newest first- —todaynew CVE1 new CVE: CVE-2023-38831
Analyst brief
misp-galaxyDarkPink is an APT group that has been active since mid-2021, primarily targeting government, military, and non-profit organizations in Southeast Asia and Europe. The group employs spear phishing techniques, utilizing ISO images and malicious PDF files to deliver custom Trojan programs like TelePowerBot and KamiKakaBot for information theft. They have exploited vulnerabilities such as CVE-2023-38831 to enhance their attack processes and maintain persistence through DLL side-loading and scheduled tasks. DarkPink's operations are characterized by stealth and precision, making them a significant threat in the cyber landscape.
CVEs DarkPink is cited as exploiting
none on KEV- CVE-2023-388312026-10-17
“The APT group DarkPink has used the vulnerability CVE-2023-38831 to attack government targets in Vietnam and Malaysia.”
cited as exploiting · source: nsfocusglobal.com ↗ · 2026-10-17
Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.
Take it with you
keyless · no signupReferences
2 sourcesTrack DarkPink on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.