PLATINUM - G0068

Created: 2018-04-18T17:59:24.739Z

Modified: 2021-04-22T00:39:49.529Z

Contributors: Ryan Becwar

Aliases

PLATINUM

Description

PLATINUM is an activity group that has targeted victims since at least 2009. The group has focused on targets associated with governments and related organizations in South and Southeast Asia. (Citation: Microsoft PLATINUM April 2016)

Techniques Used

PLATINUM has renamed rar.exe to avoid detection.(Citation: Twitter ItsReallyNick Platinum Masquerade)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

PLATINUM has transferred files using the Intel® Active Management Technology (AMT) Serial-over-LAN (SOL) channel.(Citation: Microsoft PLATINUM June 2017)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Network|T1056.001|Keylogging|

PLATINUM has used several different keyloggers.(Citation: Microsoft PLATINUM April 2016)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS,SaaS|T1189|Drive-by Compromise|

PLATINUM has sometimes used drive-by attacks against vulnerable browser plugins.(Citation: Microsoft PLATINUM April 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1055|Process Injection|

PLATINUM has used various methods of process injection including hot patching.(Citation: Microsoft PLATINUM April 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1068|Exploitation for Privilege Escalation|

PLATINUM has leveraged a zero-day vulnerability to escalate privileges.(Citation: Microsoft PLATINUM April 2016)|
|mitre-attack|enterprise-attack|Windows|T1003.001|LSASS Memory|