Threat actors from the Dark Pink threat organization have continued targeting institutions throughout 2023 and show no signs of easing up. Dark Pink is a relatively new threat group that began its mission in mid-2021, mostly exploiting organizations within the Asia-Pacific region. Often times, Dark Pink actors will utilize the same tactics and techniques in their attacks; from deployment of new custom exploitation tools to distribution of numerous spear-phishing campaigns at one time. In their recent attacks, Dark Pink appear to have expanded their target list to include government, military, and non-profit organizations in Brunei, Belgium, and Thailand. Since the beginning of 2023, the group has successfully carried out two (2) attacks bringing their current total up to thirteen (13). From these newly observed attacks, security researchers have indicated changes in the groups tactics and payload delivery including the utilization of Microsoft Excel add-ins as a persistence mechanism for the “TelePowerBot”, a custom malware developed by the group. Another addition Dark Pink actors have utilized in recent attacks involves the deployment of a service named Webhook which provides threat actors with a means of exfiltrating data from the victim over the HTTP protocol. Based on this information, Dark Pink remains a very active threat organization and does not appear to be slowing their movements. CTIX continues to monitor threat actor activity worldwide and will provide additional updates accordingly.