PLATINUM
PLATINUM is a cyber-espionage threat group first observed by Microsoft in 2009. Microsoft assessed it as a highly sophisticated and well-funded group consistent with nation-state cyber-intelligence operations. The group has historically focused on South and Southeast Asia / the APAC region, targeting governmental organizations, defense institutes, intelligence agencies, telecommunication providers, ISPs, and other government agencies. Many observed targets were in Malaysia. Known aliases in the provided content are Fallow Squall, Gingersnap, Parasite, Platinum, and Rubyvine. PLATINUM commonly uses spearphishing emails with malicious attachments as an initial access vector to get users to open malicious files. The group has used zero-day vulnerabilities for privilege escalation. It has used process injection, including hot patching, and Microsoft reported this as a novel malicious use of the Windows hotpatching mechanism to cloak backdoors on compromised systems after obtaining administrative privileges. Microsoft also reported that PLATINUM abused Intel Active Management Technology (AMT) Serial-over-LAN (SOL) as a covert file-transfer channel to conceal communications from host firewalls and endpoint security tools; this was described as abuse of a legitimate administrative feature rather than exploitation of an AMT vulnerability. The group has used custom backdoors, keyloggers, and data stealers. A notable PLATINUM backdoor is Titanium, a custom multi-stage trojan/backdoor used in campaigns targeting organizations in South and Southeast Asia. Reported Titanium tradecraft included a multi-stage infection chain with exploit execution, shellcode, downloaders, password-protected self-extracting archives, PowerShell scripts, wrapper DLLs, BITS, WMI, COM hijacking, service installation, and scheduled-task persistence. Titanium concealed itself by impersonating legitimate software, decrypted and memory-loaded its final payload, and communicated with command-and-control infrastructure using encrypted traffic with commands hidden steganographically in PNG files. Reported Titanium capabilities included file theft, file deployment and deletion, command execution, configuration updates, and an interactive console mode.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
40 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
3 malware families attributed to this actor across reporting.
Associated vulnerabilities
2 CVEs this actor has used in observed campaigns. 2 of them exploited in the wild.
This detection identifies instances where Windows Explorer.exe spawns PowerShell or cmd.exe processes, particularly focusing on executions initiated by LNK files. This behavior is associated with the ZDI-CAN-25373 Windows shortcut zero-day vulnerability, where specially crafted LNK files are used to trigger malicious code execution through cmd.exe or powershell.exe. This technique has been actively exploited by multiple APT groups in targeted attacks through both HTTP and SMB delivery methods.
CVE-2015-2545 is a vulnerability discovered in 2015 and corrected with Microsoft’s update MS15-099... enables an attacker to execute arbitrary code using a specially crafted EPS image file... exploited in the wild in August 2015... used in targeted attack by the Platinum group.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Listed in the detection annotations as a threat actor associated with exploitation for privilege escalation.
Listed as a threat actor associated with the observed use of QEMU and the -nographic flag to install a rogue Linux virtual machine for persistence and initial access.
Referenced as a threat actor associated with the privilege escalation technique T1068 in the detection annotation.
Listed as a threat actor associated with the malicious file execution technique detected by this analytic.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.