Introduction
PLATINUM is an activity group that has targeted victims since at least 2009. The group has focused on targets associated with governments and related organizations in South and Southeast Asia. Microsoft PLATINUM April 2016
Activities and Tactics
Targeted Sectors: Defense, Government, Administration, Diplomacy, Intelligence, Telecoms
Country of Origin: 🏳️ Singapore
First Seen: 2016
Last Activity: 2017
Notable Campaigns
- 2017
- 2017 Mid
- 2019-11
- During recent analysis we discovered Platinum using a new backdoor that we call Titanium (named after a password to one of the self-executable archives). Titanium is the final result of a sequence of dropping
- Hellsing
- In the middle of 2017
- Kaspersky Lab experts discovered a new malicious threat that is believed to be related to the famous PLATINUM APT group
- Microsoft has come across an evolution of PLATINUM’s file-transfer tool
- Operation “EasternRoppels”
- Since the 2016 publication
- downloading and installing stages.
- https://aavar.org/avar2018/index.php/the-easternroppels-operation-platinum-group-is-back/
- https://securelist.com/platinum-is-back/91135/
- https://securelist.com/titanium-the-platinum-group-strikes-again/94961/
- https://www.microsoft.com/security/blog/2017/06/07/platinum-continues-to-evolve-find-ways-to-maintain-invisibility
- no malware had been discovered misusing the AMT SOL feature for communication.
- one that uses the Intel Active Management Technology (AMT) Serial-over-LAN (SOL) channel for communication. This channel works independently of the operating system (OS)
- rendering any communication over it invisible to firewall and network monitoring applications running on the host device. Until this incident
- which had been widely regarded as inactive. They named the campaign ‘EasternRoppels’.
Tactics, Techniques, and Procedures (TTPs)
- T1189 Drive-by Compromise
- T1105 Ingress Tool Transfer
- T1204.002 Malicious File
- T1068 Exploitation for Privilege Escalation
- T1056.004 Credential API Hooking
- T1056.001 Keylogging
- T1003.001 LSASS Memory
- T1095 Non-Application Layer Protocol
- T1055 Process Injection
- T1566.001 Spearphishing Attachment
- T1036 Masquerading
ATT&CK technique IDs (denormalized)
Notable Indicators of Compromise (IOCs)
No atomic indicators are listed in this profile. The APTnotes snapshot indexes 2 public reports that may contain IOCs; see Source Attribution for dataset links.
Malware and Tools
- Xploit
- GraphicBooting
- Hotpatching techniques:
- CVE-2015-2545:
- AMT Feature FW evasion:
- AMTsol:
- DvDupdate.dll:
- JPIN:
- Living off the Land:
- RedPepper:
- RedSalt:
- Titanium:
- adbupd:
- psinstrc.ps1:
MITRE ATT&CK Software
Attribution and Evidence
Country of Origin: Singapore Additional attribution information pending cataloguing.
References
[1] mitre-attack [3] Microsoft PLATINUM April 2016 Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.