🇻🇳

DarkPink

APT Group ETDA ✓

Also Known As 2 names

Saaiwc Group Saaiwc

Target Countries

No target country recorded

Sectors Targeted

No targeted sector recorded

Details

Origin 🇻🇳 VN

Last Updated 03 Feb 2026

Related Zero-Days

No zero-day CVE linked to this actor

Known Names 2 entries

Dark Pink Group-IB

Saaiwc Group Anheng Hunting Labs

Observed Target Countries 9

Based on ETDA data — countries highlighted in red

Belgium Bosnia and Herzegovina Brunei Cambodia Indonesia Malaysia Philippines Thailand Vietnam

Description

(Group-IB) Group-IB, one of the global cybersecurity leaders, has today published its findings into Dark Pink, an ongoing advanced persistent threat (APT) campaign launched against high-profile targets in Cambodia, Indonesia, Malaysia, Philippines, Vietnam, and Bosnia and Herzegovina that we believe, with moderate confidence, was launched by a new threat actor. To date, Group-IB’s Threat Intelligence has been able to attribute seven successful attacks to this particular group from June-December 2022, with targets including military bodies, government ministries and agencies, and religious and non-profit organizations, although the list of victims could be significantly longer. Group-IB also noted one unsuccessful attack on a European state development body based in Vietnam.

Tools Used 7

Ctealer Cucky KamiKakaBot PowerSploit TelePowerBot ZMsg Living off the Land

Operations 1

2023-02 Dark Pink APT Group Strikes Government Entities in South Asian Countries https://blog.eclecticiq.com/dark-pink-apt-group-strikes-government-entities-in-south-asian-countries

Reports & References 2

https://www.group-ib.com/media-center/press-releases/dark-pink-apt/ https://www.group-ib.com/blog/dark-pink-episode-2/

ETDA Profile

Dark Pink

Origin

[Unknown]

First Seen 2022

Motivation

Information theft and espionage

View on ETDA APT Groups ↗