LiveActive security incident?Get immediate response
MITRE ATT&CK® Group

G0068: PLATINUM

PLATINUM is an activity group that has targeted victims since at least 2009. The group has focused on targets associated with governments and related organizations in South and Southeast Asia. [1]

EnterpriseG0068GroupObject v1.3Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

PLATINUM matters because ATT&CK links the group to long-running, targeted activity against government and related organizations in South and Southeast Asia, with associated Windows backdoors and behaviors that emphasize initial access, credential capture, stealth, privilege escalation, and command-and-control. For leaders, the decision value is not to assume exposure everywhere, but to validate whether high-value users, government-facing programs, regional operations, and Windows endpoint estates have evidence-quality controls for phishing, drive-by exposure, credential theft, and backdoor activity.

Executive priority

Prioritize this object where the organization has South or Southeast Asia government relationships, regional operations, sensitive public-sector data, or Windows-heavy environments supporting critical business functions. Ask whether the SOC can prove coverage for credential access against LSASS, keylogging/API credential capture, suspicious tool transfer, masquerading, process injection, and non-standard network communications. This is also useful for audit and resilience discussions because the ATT&CK relationships map to control areas such as email security, endpoint logging, privileged access hardening, vulnerability management, and incident response evidence preservation.

Technical view

ATT&CK does not provide group-level detection text or platforms for PLATINUM, so defenders should validate coverage through the related software and techniques. Relationships identify Dipsind, JPIN, and adbupd as Windows backdoors associated with PLATINUM, and techniques include spearphishing attachment, malicious file execution, drive-by compromise, LSASS memory access, keylogging, credential API hooking, process injection, masquerading, exploitation for privilege escalation, ingress tool transfer, and non-application-layer command-and-control. SOC and IR teams should test whether endpoint, identity, email, web, and network telemetry can connect an initial access event to follow-on credential access, stealth, tool transfer, and C2 indicators without relying on a single alert type.

Likely telemetry

  • Email security logs for targeted attachments and user delivery context
  • Endpoint process creation, module load, memory access, and injection-related telemetry
  • Windows security events and endpoint alerts relevant to LSASS access and privileged process activity
  • File creation, rename, path, metadata, and execution records for masquerading and malicious files
  • Browser, proxy, DNS, and web gateway logs for drive-by compromise investigation

Detection direction

  • Do not treat the group name alone as a detection strategy; validate detections against the related behaviors and software relationships.
  • Tune for sequences: suspicious attachment or drive-by exposure followed by malicious file execution, tool transfer, credential access, process injection, masquerading, or unusual C2.
  • For LSASS memory access, distinguish legitimate administrative/security tooling from unexpected access by unusual processes, recently dropped binaries, or user-writable paths.
  • For keylogging and credential API hooking, confirm endpoint telemetry is capable of seeing suspicious hooks, input capture behavior, or related malware detections; these behaviors may be low-noise but also telemetry-dependent.
  • For masquerading, compare process names, paths, signatures, parent-child relationships, and expected administrative patterns rather than matching names only.

Mitigation priorities

  • Harden initial access first: email attachment controls, user execution safeguards, browser/web controls, and security awareness for targeted malicious files.
  • Reduce credential theft impact through privileged access minimization, LSASS protection where appropriate, credential hygiene, and monitoring of high-value accounts.
  • Maintain vulnerability management for operating systems and exposed software because ATT&CK links the group to exploitation for privilege escalation.
  • Strengthen endpoint prevention and visibility for process injection, suspicious memory access, masquerading, and unauthorized tool transfer.
  • Limit and monitor outbound communications, especially unusual protocols or destinations, and ensure network telemetry supports incident reconstruction.
Additional notes and limits

The supplied ATT&CK object identifies PLATINUM as an activity group active since at least 2009 and focused on governments and related organizations in South and Southeast Asia, citing Microsoft’s April 2016 report. The strongest relationship-driven context is the use of three Windows backdoor families and multiple techniques spanning initial access, execution, credential access, stealth, privilege escalation, and command-and-control. Use this object primarily to guide defensive validation and intelligence-led hunting, not as a standalone basis for attribution.

Official group-level detection, tactics, and platforms are not provided. Related software platforms point to Windows, while related techniques include several multi-platform entries; therefore local platform relevance must be determined from the environment. The supplied fields do not support claims of current activity, active exploitation, customer exposure, or guaranteed detection coverage.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

PLATINUM

PLATINUM is an activity group that has targeted victims since at least 2009. The group has focused on targets associated with governments and related organizations in South and Southeast Asia. [1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

11 rows
DomainIDNameRelationship / procedure
EnterpriseT1189Drive-by Compromise

PLATINUM has sometimes used drive-by attacks against vulnerable browser plugins.[1]

EnterpriseT1105Ingress Tool Transfer

PLATINUM has transferred files using the Intel® Active Management Technology (AMT) Serial-over-LAN (SOL) channel.[2]

EnterpriseT1204.002Malicious FileSub-technique

PLATINUM has attempted to get users to open malicious files by sending spearphishing emails with attachments to victims.[1]

EnterpriseT1068Exploitation for Privilege Escalation

PLATINUM has leveraged a zero-day vulnerability to escalate privileges.[1]

EnterpriseT1056.004Credential API HookingSub-technique

PLATINUM is capable of using Windows hook interfaces for information gathering such as credential access.[1]

EnterpriseT1056.001KeyloggingSub-technique

PLATINUM has used several different keyloggers.[1]

EnterpriseT1003.001LSASS MemorySub-technique

PLATINUM has used keyloggers that are also capable of dumping credentials.[1]

EnterpriseT1095Non-Application Layer Protocol

PLATINUM has used the Intel® Active Management Technology (AMT) Serial-over-LAN (SOL) channel for command and control.[2]

EnterpriseT1055Process Injection

PLATINUM has used various methods of process injection including hot patching.[1]

EnterpriseT1566.001Spearphishing AttachmentSub-technique

PLATINUM has sent spearphishing emails with attachments to victims as its primary initial access vector.[1]

EnterpriseT1036Masquerading

PLATINUM has renamed rar.exe to avoid detection.[3]

Associated objects

Groups, software, and campaigns

Relationship explorer

All related ATT&CK context

uses · TechniqueT1189: Drive-by CompromiseEnterpriseuses · MalwareS0201: JPINEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1204.002: Malicious FileEnterpriseuses · TechniqueT1068: Exploitation for Privilege EscalationEnterpriseuses · TechniqueT1056.004: Credential API HookingEnterpriseuses · MalwareS0200: DipsindEnterpriseuses · TechniqueT1056.001: KeyloggingEnterpriseuses · TechniqueT1003.001: LSASS MemoryEnterpriseuses · TechniqueT1095: Non-Application Layer ProtocolEnterpriseuses · TechniqueT1055: Process InjectionEnterpriseuses · TechniqueT1566.001: Spearphishing AttachmentEnterpriseuses · MalwareS0202: adbupdEnterpriseuses · TechniqueT1036: MasqueradingEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.3
Created
Modified
Raw hash
73adbb21b1f54dcd...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.3Current bundle73adbb21b1f5…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Microsoft PLATINUM April 2016

    Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.

    Open source URL
  2. [2]
    Microsoft PLATINUM June 2017

    Kaplan, D, et al. (2017, June 7). PLATINUM continues to evolve, find ways to maintain invisibility. Retrieved February 19, 2018.

    Open source URL
  3. [3]
    Twitter ItsReallyNick Platinum Masquerade

    Carr, N.. (2018, October 25). Nick Carr Status Update. Retrieved September 12, 2024.

    Open source URL
  4. [4]
    Microsoft PLATINUM April 2016

    Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.

    Open source URL
  5. [5]
    Microsoft PLATINUM April 2016

    Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.

    Open source URL
  6. [6]
    PLATINUM

    (Citation: Microsoft PLATINUM April 2016)

  7. [7]
    PLATINUM

    (Citation: Microsoft PLATINUM April 2016)

  8. [8]
    PLATINUM

    (Citation: Microsoft PLATINUM April 2016)

  9. [9]
    mitre-attackG0068
    Open source URL
  10. [10]
    mitre-attackG0068
    Open source URL
  11. [11]
    mitre-attackG0068
    Open source URL
  12. [12]
    Microsoft PLATINUM April 2016

    Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.

    Open source URL
  13. [13]
    Microsoft PLATINUM April 2016

    Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.

    Open source URL
  14. [14]
    Microsoft PLATINUM April 2016

    Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.

    Open source URL
  15. [15]
    Microsoft PLATINUM April 2016

    Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.

    Open source URL
  16. [16]
    Microsoft PLATINUM June 2017

    Kaplan, D, et al. (2017, June 7). PLATINUM continues to evolve, find ways to maintain invisibility. Retrieved February 19, 2018.

    Open source URL
  17. [17]
    Microsoft PLATINUM April 2016

    Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.

    Open source URL
  18. [18]
    Microsoft PLATINUM April 2016

    Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.

    Open source URL
  19. [19]
    Microsoft PLATINUM April 2016

    Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.

    Open source URL
  20. [20]
    Microsoft PLATINUM April 2016

    Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.

    Open source URL
  21. [21]
    Microsoft PLATINUM April 2016

    Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.

    Open source URL
  22. [22]
    Microsoft PLATINUM April 2016

    Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.

    Open source URL
  23. [23]
    Microsoft PLATINUM April 2016

    Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.

    Open source URL
  24. [24]
    Microsoft PLATINUM April 2016

    Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.

    Open source URL
  25. [25]
    Microsoft PLATINUM April 2016

    Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.

    Open source URL
  26. [26]
    Microsoft PLATINUM April 2016

    Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.

    Open source URL
  27. [27]
    Microsoft PLATINUM April 2016

    Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.

    Open source URL
  28. [28]
    Microsoft PLATINUM April 2016

    Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.

    Open source URL
  29. [29]
    Microsoft PLATINUM June 2017

    Kaplan, D, et al. (2017, June 7). PLATINUM continues to evolve, find ways to maintain invisibility. Retrieved February 19, 2018.

    Open source URL
  30. [30]
    Microsoft PLATINUM June 2017

    Kaplan, D, et al. (2017, June 7). PLATINUM continues to evolve, find ways to maintain invisibility. Retrieved February 19, 2018.

    Open source URL
  31. [31]
    Microsoft PLATINUM April 2016

    Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.

    Open source URL
  32. [32]
    Microsoft PLATINUM April 2016

    Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.

    Open source URL
  33. [33]
    Microsoft PLATINUM April 2016

    Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.

    Open source URL
  34. [34]
    Microsoft PLATINUM April 2016

    Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use