Dark
Aliases: Dark.IoT
- First seen
- 2021-08-10 00:00:00
- Malware type
- botnet, worm
- Last IoC activity
- 2026-06-18 02:13:05
- Profile updated
- 2026-07-07 14:24:03
Targeted industries: energy-and-utilities technology-and-telecommunications
Context
Mirai variant exploiting CVE-2021-20090 and CVE2021-35395 for spreading.
Detection coverage
- 3 YARA rules
Used by threat actors
- SolarWinds Compromise (campaign)
Exploited vulnerabilities
- CVE-2021-20090 (vulnerability)
- CVE-2022-26134 (vulnerability)
Detection rules
- SEKOIA_Apt_Darkpink_Kamikakabot_Strings (yara-rule)
- SEKOIA_Apt_Dark_Pink_Pdb_Path (yara-rule)
- SEKOIA_Apt_Darkpink_Loader_Decryptionroutine (yara-rule)
Reports & references
- malpedia.caad.fkie.fraunhofer.de — Elf.Dark (report)
- radware.com — Alert Realtek Sdk (report)
- radware.com — Alert Dark Omigod (report)
- twitter.com — 1440052837820428298 (report)
- lacework.com — Kinsing Dark Iot Botnet Among Threats Targeting Cve 2022 26134 (report)
- blogs.juniper.net — Attacks Continue Against Realtek Vulnerabilities (report)