An emerging threat organization has shown their presence after targeting military and government organizations throughout Europe and the Asia-Pacific region. Tracked as Dark Pink, this organization has been reportedly active since mid-2021 and is currently not attributed to any other threat affiliates. Activity from Dark Pink actors significantly increased through the back half of 2022 and seven (7) cyber espionage related attacks have been uncovered so far. These espionage attacks targeted two (2) military clusters in Malaysia and the Philippines, a religious organization in Vietnam, and government agencies throughout the region. Tactics, techniques, and procedures (TTPs) observed thus far show that Dark Pink actors utilize social engineering tactics to deliver malicious payloads to victims. Through phishing correspondence(s) posing as an individual applying for an internship, threat actors embedded a hyperlink which brings the victim to a file sharing platform where malicious payloads are downloaded. Prior to infection, the downloaded file(s) communicated back to GitHub and downloaded further malicious scripts to further the infection. As it stands, the same GitHub repository was utilized throughout the cyberespionage attacks. Malicious payloads utilized by the group include “Ctealer”, “Cuck Stealer”, and “KamiKaKaBot”, which were used to infect and exfiltrate sensitive information, capturing audio recordings, and other data from messaging platforms. CTIX continues to monitor threat actor activity worldwide and will provide additional updates accordingly.