🇨🇳

PLATINUM

APT Group Information theft and espionage ETDA ✓

Also Known As 3 names

ATK33 G0068 TwoForOne

Target Countries 13

Countries highlighted in red

China Cyprus Germany Indonesia India Mongolia Malaysia Singapore Thailand United States Bolivarian Republic of Venezuela Vietnam South Africa

Sectors Targeted

Financial Defense Computer Systems Design and Related Services 54151 Mining, Quarrying, and Oil and Gas Extraction 21 Computer Systems Design and Related Services 5415 Freight Transportation Arrangement 48851 Data Processing, Hosting, and Related Services 51821 Telecommunications Business Schools and Computer and Management Training 6114 Computer Systems Design Services 541512 Intelligence agencies Government

Details

Origin 🇨🇳 CN

Last Updated 01 Jun 2022

Malware Families 2

redsalt

amtsol

MITRE ATT&CK 18

T1003 T1003.001 T1036 T1055 T1056 T1056.001 T1056.004 T1059.001 T1068 T1071.001 T1082 T1095 T1105 T1189 T1204 T1204.002 T1566 T1566.001

Related Zero-Days

No zero-day CVE linked to this actor

Known Names 4 entries

Platinum Microsoft

TwoForOne FireEye

ATK 33 Thales

G0068 MITRE

Observed Target Countries 7

Based on ETDA data — countries highlighted in red

China India Indonesia Malaysia Singapore Thailand Vietnam

Description

(Microsoft) Platinum has been targeting its victims since at least as early as 2009, and may have been active for several years prior. Its activities are distinctly different not only from those typically seen in untargeted attacks, but from many targeted attacks as well. A large share of targeted attacks can be characterized as opportunistic: the activity group changes its target profiles and attack geographies based on geopolitical seasons, and may attack institutions all over the world. Like many such groups, Platinum seeks to steal sensitive intellectual property related to government interests, but its range of preferred targets is consistently limited to specific governmental organizations, defense institutes, intelligence agencies, diplomatic institutions, and telecommunication providers in South and Southeast Asia. The group’s persistent use of spear-phishing tactics (phishing attempts aimed at specific individuals) and access to previously undiscovered zero-day exploits have made it a highly resilient threat.

Tools Used 9

adbupd AMTsol DvDupdate.dll JPIN psinstrc.ps1 RedPepper RedSalt Titanium Living off the Land

Operations 3

2017 Since the 2016 publication, Microsoft has come across an evolution of PLATINUM’s file-transfer tool, one that uses the Intel Active Management Technology (AMT) Serial-over-LAN (SOL) channel for communication. This channel works independently of the operating system (OS), rendering any communication over it invisible to firewall and network monitoring applications running on the host device. Until this incident, no malware had been discovered misusing the AMT SOL feature for communication. https://www.microsoft.com/security/blog/2017/06/07/platinum-continues-to-evolve-find-ways-to-maintain-invisibility

2017 Mid Operation “EasternRoppels” In the middle of 2017, Kaspersky Lab experts discovered a new malicious threat that is believed to be related to the famous PLATINUM APT group, which had been widely regarded as inactive. They named the campaign ‘EasternRoppels’. https://aavar.org/avar2018/index.php/the-easternroppels-operation-platinum-group-is-back/ https://securelist.com/platinum-is-back/91135/

2019-11 During recent analysis we discovered Platinum using a new backdoor that we call Titanium (named after a password to one of the self-executable archives). Titanium is the final result of a sequence of dropping, downloading and installing stages. https://securelist.com/titanium-the-platinum-group-strikes-again/94961/

Reports & References 3

https://download.microsoft.com/download/2/2/5/225BFE3E-E1DE-4F5B-A77B-71200928D209/Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/twoforonefinal.pdf https://en.wikipedia.org/wiki/PLATINUM_(cybercrime_group)

ETDA Profile

Platinum

Origin

China

First Seen 2009

Motivation

Information theft and espionage

MITRE ATT&CK Groups

https://attack.mitre.org/groups/G0068/

View on ETDA APT Groups ↗