Dark Pink APT Campaigns Through the Lens of AIDE Telemetry

In the lead-up to APNIC60, where Chief Technical Officer Leslie Daigle will give a keynote address, we’re publishing a series of articles that address regionally meaningful threats beyond the well-documented Chinese-origin attacks. We present four distinct Asia-linked campaigns based on attacks seen directly in AIDE or confirmed by matching public reports. Each case offers a different lens on the threat landscape—ranging from geopolitical motivations to financial disruption and targeted espionage. Our goal is to provide context, elevate regional perspectives, and set the stage for deeper discussion during the keynote. This is the fourth and final article in the series; we previously examined Pakistani-based APT36 as well as North Korean-based Kimsuky and RedTail.

Introduction

‘Dark Pink’ is the label used in public reporting since 2022, first outlined by Group-IB, to describe a cluster of activity targeting government, defense, and education organizations in the Asia Pacific region, particularly in Southeast Asia (including Cambodia, Indonesia, Malaysia, the Philippines, and Vietnam). External researchers have characterized this activity as cyber-espionage, noting tradecraft consistent with long-term strategic access campaigns. CrowdStrike has also linked Dark Pink to a previously tracked cluster known as Ocean Buffalo, which it assesses as Vietnam-originated and initially focused on domestic surveillance before expanding outward. These assessments are based on external analysis rather than direct confirmation by our research.

AIDE, GCA’s distributed honeypot network with over 200 sensors across 55 countries, provides a unique vantage point to validate and expand on these findings. We analyzed AIDE data collected between April 2022 and May 2024 and identified 129 sessions matching Indicators of Compromise (IoCs). These observations confirm Dark Pink’s operational surge in Asia Pacific during 2022 while also revealing how the campaign leveraged global infrastructure and extended its reach into Europe and North America.

Campaign Activity Over Time

AIDE data confirms that Dark Pink was most active between August and November 2022, with a peak of 52 attacks in late November. In total, 118 attacks were recorded during this four-month window.

This timeline directly correlates with Group-IB’s public reporting (January 2023), which described Dark Pink as “most active in the second half of 2022” and confirmed incidents in September, October, November, and December. The alignment between AIDE detections and open-source intelligence validates the authenticity of the infrastructure captured.

After 2022, activity declined sharply but persisted at a lower level, with smaller clusters in May 2023 (6 attacks), January 2024 (1), and May 2024 (1). External reporting  also documented a marked decline in DarkPink operations through 2023, though the group maintained limited sustained activity.

Infrastructure and Tradecraft

Cloud and Hosting Platforms

AIDE data shows Dark Pink relying heavily on globally distributed cloud and hosting providers, with a concentration of activity across Europe, Asia Pacific, and North America. This mirrors reporting by EclecticIQ Research, which also documented extensive cloud infrastructure use.

ASN Enrichment Insights

Using PeeringDB enrichment, AIDE was able to classify Dark Pink’s infrastructure into three major provider types:

• About half of the sessions originated from cloud and hosting providers,
• About half from consumer ISPs (Cable/DSL),
• And a smaller share from network service providers (NSPs).

This mix shows that Dark Pink does not rely on a single infrastructure source but instead opportunistically abuses both commercial cloud platforms and residential broadband networks. For network operators, this highlights the importance of collaborative visibility into unwanted traffic that crosses traditional service boundaries.

Technical Findings

Command-and-Control Channels

The group abused legitimate webhook services (online tools typically used to pass data between applications) as a channel for communicating with infected systems. In AIDE data, we confirmed three distinct webhook.site endpoints, consistent with Group-IB’s reporting that Dark Pink leveraged similar services during its operations.

Dual Protocols

Attacks were almost evenly split: Telnet (51%) and SSH (49%). This dual approach, visible in AIDE data, is consistent with external reporting that emphasized Dark Pink’s adaptability across both legacy and modern systems.

Credential Attacks

AIDE observed credential-based activity, including attempts with usernames such as powershell. These behaviors align with broader credential intrusion patterns. External reporting has also associated Dark Pink with credential access techniques such as harvesting from password stores.

Malware

Analysis of Dark Pink attacks found that 36.8% were flagged by VirusTotal, underscoring the group’s use of highly evasive tooling. Public reporting notes that Dark Pink has continued to evolve its operations and toolset, although detailed functionality such as dedicated backdoor implants or shell-based trojans remains undescribed outside of observed malicious indicators.

Behavioral Patterns

AIDE’s session data captured not just the initial connections but also what Dark Pink did once access was gained. These behaviors align closely with external reporting and provide clear signals defenders can monitor for.

AIDE data reveal a systematic attack chain, closely aligned with MITRE ATT&CK tactics and techniques:

1. Credential Access – brute force attempts (e.g., powershell, admin, 123456).
2. Shell Establishment – gaining interactive access via SSH/Telnet.
3. System Reconnaissance – commands like uname, df, cat /proc/cpuinfo to gather OS and hardware details.
4. Command-and-Control Beaconing – outbound callbacks to webhook endpoints.
5. Payload Staging and Execution – downloads via wget/curl, followed by chmod 777 and execution.
6. Persistence – adding SSH keys or resetting passwords (chpasswd).
7. Cleanup – clearing histories (history -c).

This structured chain provides network operators and security teams with multiple opportunities to detect malicious activity, especially around anomalous PowerShell usage, suspicious file downloads, and SSH key changes.

Geographic Footprint

While open-source reporting indicates that Dark Pink initially targeted organizations in the Asia Pacific region, researchers have also noted its expansion into Europe. AIDE data reflects this by showing that the majority of observed sessions were staged through infrastructure in Europe (47 percent), followed by Asia Pacific (33 percent) and the United States (19 percent). This suggests that even if the campaign had Asia Pacific origins, its operations drew heavily on global infrastructure, with a particular reliance on European hosting, to reach victims across multiple regions.

Conclusion

AIDE telemetry confirms and enriches public reporting on Dark Pink. The campaign’s late-2022 surge, heavy use of cloud and ISP infrastructure, and credential-driven intrusions illustrate the persistence and adaptability typical of highly resourced threat actors. While attribution remains complex, the broader lesson is clear: Dark Pink demonstrates how legitimate services can be abused for command-and-control, how weak credentials remain a common entry point, and how staging infrastructure spans regions far beyond the initial area of targeting.

More broadly, AIDE highlights that the Internet is burdened by unwanted traffic that affects everyone. Reducing this traffic cannot be solved by organizations acting alone or by blocking in isolation. What is needed is collaboration across network operators, providers, and the wider security community to share data, build collective visibility, and act on common signals.

Collaborative Steps

To reduce the impact of campaigns like Dark Pink, network operators and security teams should consider:

• Expanding visibility into unwanted traffic by sharing telemetry that helps identify abnormal sessions and automated intrusion attempts.
• Strengthening credential defenses by monitoring for brute-force behavior, enforcing strong authentication, and flagging anomalous account usage.
• Detecting misuse of legitimate services by alerting on unusual webhook callbacks, scripted downloads, and persistence attempts.

Through collective effort on these fronts, the community can limit the impact of campaigns like Dark Pink and strengthen defenses against the next wave of intrusion activity.

If you would like to learn more about AIDE or contribute to its community, please contact us.

References

• The Hacker News. Dark Pink APT Group Targets Governments and Military in APAC Region. The Hacker News. https://thehackernews.com/2023/01/dark-pink-apt-group-targets-governments.html
• EclecticIQ. Dark Pink APT Group Strikes Government Entities in South Asian Countries. EclecticIQ Threat Research Blog. https://blog.eclecticiq.com/dark-pink-apt-group-strikes-government-entities-in-south-asian-countries
• Group-IB. Dark Pink: New APT Group Targets Military and Government Entities in Asia-Pacific. Group-IB Threat Intelligence Blog. https://www.group-ib.com/blog/dark-pink-apt/
• Group-IB. Dark Pink – Episode 2: Continued Operations and Updated Toolset. Group-IB Threat Intelligence Blog. https://www.group-ib.com/blog/dark-pink-episode-2/
• SOCRadar. APT Profile: Dark Pink. SOCRadar Threat Intelligence Blog. https://socradar.io/apt-profile-dark-pink-apt-group/
• SecureBlink. Dark Pink APT: An Evolving Threat Group After Law Enforcement Agencies. SecureBlink Threat Research. https://www.secureblink.com/threat-research/dark-pink-apt-an-evolving-threat-group-after-law-enforcement-agencies
• Southeast Asia Globe. Dark Pink and Ocean Buffalo: Hacker Groups Pushing Cyber Espionage in Southeast Asia. Southeast Asia Globe. https://southeastasiaglobe.com/dark-pink-and-ocean-buffalo-hacker-groups-pushing-cyber-espionage-in-sea/