Cabinet Division of Pakistan has issued a warning about a new cyber threat targeting Asian governments and military institutions. The group, known as Dark Pink, is believed to be an Advanced Persistent Threat (APT) group operational since mid-2021.
Dark Pink utilizes sophisticated tactics to gain unauthorized access to systems. These include phishing emails designed to trick recipients into clicking malicious links or opening infected attachments. The group also uses infected USB drives to exploit vulnerabilities and spread malware, along with exploiting weaknesses in Dynamic Link Libraries (DLLs) to compromise systems.
To protect against these attacks, the Cabinet Division urges government officials to practice good cybersecurity hygiene. This includes being cautious with emails by not opening suspicious emails, links, or attachments, and utilizing anti-virus scanners before downloading attachments. Regularly updating all applications and operating systems on both mobile devices and computers is crucial.
Additionally, using strong, unique passwords for each account and avoiding using the same password across multiple platforms is essential. Enabling multi-factor authentication whenever possible adds an extra layer of security. Government officials should also be mindful of their online activity, avoiding sharing personal details and credentials with untrusted sources. Finally, practicing safe browsing habits like always typing website URLs directly into the address bar instead of clicking on links and opting for websites secured with HTTPS encryption is recommended.
The advisory also provides recommendations for IT administrators within government organizations. Implementing system hardening by restricting user access and permissions to minimize potential vulnerabilities is a crucial step. Blocking unauthorized USB drives and other storage media is another preventative measure. Closely monitoring network traffic for suspicious behavior, including file transfers, login attempts, and unusual system activity, is essential for early detection of potential threats.
Utilizing robust security solutions such as anti-virus software, firewalls, and intrusion detection/prevention systems (IDS/IPS) is highly recommended. Additionally, maintaining separate offline local area networks (LAN) from internet-connected networks and limiting internet access to authorized users and applications can further enhance security. Verifying software downloads through digital code-signing verification and enforcing strong access controls through multi-factor authentication for critical systems and administrator accounts are important steps.
Regularly backing up critical data and enforcing password rotation for administrator accounts, along with ensuring timely application of security patches and updates for all operating systems, software, and equipment, are all essential measures to mitigate cyber threats.
By following these recommendations, government institutions and military setups can significantly reduce their risk of falling victim to cyberattacks by Dark Pink and other APT groups.