S0201: JPIN

JPIN matters because ATT&CK describes it as a custom Windows backdoor associated with PLATINUM, with relationships spanning discovery, command execution, command-and-control over file and mail protocols, obfuscation, process injection, keylogging, BITS abuse, file deletion, permission changes, and security-tool discovery or impairment. For leaders, the decision value is not just the malware name; it is whether Windows endpoint, network, and identity telemetry can prove what a backdoor learned, what it executed, what it transferred, and whether defenses were weakened.

Executive priority

Prioritize JPIN as a validation case for Windows endpoint resilience and incident readiness. The linked behaviors touch credential risk, security tooling trust, egress control, and evidence preservation. Executives should ask whether the organization can detect suspicious discovery and command execution, investigate possible credential capture, control file/mail protocol egress, and produce audit-ready evidence showing that endpoint controls and logs remain intact during a suspected backdoor intrusion.

Technical view

SOC and IR teams should map coverage around the related ATT&CK techniques rather than relying on a JPIN-specific signature, because ATT&CK provides no official detection text. Validate telemetry for Windows command shell activity, registry queries, service/process/user/group/system/file discovery, BITS job creation or modification, process injection indicators, file deletion, Windows permission changes, ingress tool transfer, and command-and-control over file transfer or mail protocols. Treat the PLATINUM relationship as historical ATT&CK context, not as proof of current activity in a local environment.

Likely telemetry

Windows endpoint process creation and command-line logs, especially cmd.exe and administrative discovery utilities
Registry query activity and registry access telemetry
Service, process, user, local group, system information, and file/directory enumeration events
BITS job creation, modification, transfer, and execution-related events
Endpoint memory, handle, module, or behavioral telemetry relevant to process injection

Detection direction

Build behavior-based detections around unusual clustering of discovery actions on Windows hosts, especially when followed by command shell use, file transfer, BITS activity, or file deletion.
Tune detections for dual-use administrative commands carefully; false positives are likely where help desk, software deployment, or inventory tooling performs similar discovery.
Validate visibility into BITS because it is a documented related technique and can blend with legitimate background transfer activity.
Review egress monitoring for file transfer and mail protocols; focus on unusual destinations, uncommon client processes, abnormal timing, or hosts that do not normally send such traffic.
Correlate security software discovery, tool disabling or modification, process injection, and permission changes as higher-risk combinations because they can indicate attempts to reduce defensive visibility.

Mitigation priorities

Start with evidence durability: centralize Windows endpoint, security tool, BITS, file, registry, and network logs so local deletion does not erase the investigation trail.
Harden Windows endpoints with least privilege, controlled administrative tool usage, and monitoring for permission changes to sensitive files and directories.
Restrict and monitor unnecessary outbound file transfer and mail protocol use from endpoints that do not require it for business operations.
Protect security tooling from tampering by monitoring service state, configuration changes, update failures, and unexpected termination of defensive processes.
Review credential-risk controls because keylogging is a related behavior; prioritize privileged users, administrative workstations, and systems handling sensitive access.

Additional notes and limits

ATT&CK identifies JPIN as a custom-built backdoor family used by PLATINUM and notes a possible code-base relationship with Dipsind. The object is Windows-platform malware, while several related techniques have broader platform listings; this take applies the relationships to JPIN conservatively in a Windows defense context.

Official detection guidance is not provided, and the malware object has no specified tactics. This summary is derived from the supplied ATT&CK description, external references, and relationships only. Local prevalence, exploitation status, customer exposure, and detection coverage require environment-specific evidence.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

JPIN

JPIN is a custom-built backdoor family used by PLATINUM. Evidence suggests developers of JPIN and Dipsind code bases were related in some way. [1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques20 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1685	Disable or Modify Tools	JPIN can lower security settings by changing Registry keys.[1]
Enterprise	T1222.001	Windows PermissionsSub-technique	JPIN can use the command-line utility cacls.exe to change file permissions.[1]
Enterprise	T1059.003	Windows Command ShellSub-technique	JPIN can use the command-line utility cacls.exe to change file permissions.[1]
Enterprise	T1069.001	Local GroupsSub-technique	JPIN can obtain the permissions of the victim user.[1]
Enterprise	T1016	System Network Configuration Discovery	JPIN can obtain network information, including DNS, IP, and proxies.[1]
Enterprise	T1057	Process Discovery	JPIN can list running processes.[1]
Enterprise	T1070.004	File DeletionSub-technique	JPIN's installer/uninstaller component deletes itself if it encounters a version of Windows earlier than Windows XP or identifies security-related processes running.[1]
Enterprise	T1012	Query Registry	JPIN can enumerate Registry keys.[1]
Enterprise	T1197	BITS Jobs	A JPIN variant downloads the backdoor payload via the BITS service.[1]
Enterprise	T1071.003	Mail ProtocolsSub-technique	JPIN can send email over SMTP.[1]
Enterprise	T1083	File and Directory Discovery	JPIN can enumerate drives and their types. It can also change file permissions using cacls.exe.[1]
Enterprise	T1055	Process Injection	JPIN can inject content into lsass.exe to load a module.[1]
Enterprise	T1105	Ingress Tool Transfer	JPIN can download files and upgrade itself.[1]
Enterprise	T1056.001	KeyloggingSub-technique	JPIN contains a custom keylogger.[1]
Enterprise	T1033	System Owner/User Discovery	JPIN can obtain the victim user name.[1]
Enterprise	T1071.002	File Transfer ProtocolsSub-technique	JPIN can communicate over FTP.[1]
Enterprise	T1518.001	Security Software DiscoverySub-technique	JPIN checks for the presence of certain security-related processes and deletes its installer/uninstaller component if it identifies any of them.[1]
Enterprise	T1082	System Information Discovery	JPIN can obtain system information such as OS version and disk space.[1]
Enterprise	T1027	Obfuscated Files or Information	A JPIN uses a encrypted and compressed payload that is disguised as a bitmap within the resource section of the installer.[1]
Enterprise	T1007	System Service Discovery	JPIN can list running services.[1]

Associated objects

Groups, software, and campaigns

G0068: PLATINUM

PLATINUM is an activity group that has targeted victims since at least 2009. The group has focused on targets associated with governments and related organizations in South and Southeast Asia. [1]

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 19.1
Object version: 1.1
Created: Apr 18, 2018, 17:59 UTC (UTC+00:00)
Modified: Apr 25, 2025, 14:44 UTC (UTC+00:00)
Raw hash: 6b6faed376a315c7...

Imported snapshots across ATT&CK releases(1)

Release	Bundle imported	Object version	Modified	Status	Raw hash
19.1	Jul 14, 2026, 09:14 UTC (UTC+00:00)	1.1	Apr 25, 2025, 14:44 UTC (UTC+00:00)	Current bundle	`6b6faed376a3…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
Microsoft PLATINUM April 2016
Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
Open source URL
[2]
JPIN
(Citation: Microsoft PLATINUM April 2016)
[3]
JPIN
(Citation: Microsoft PLATINUM April 2016)
[4]
JPIN
(Citation: Microsoft PLATINUM April 2016)
[5]
Microsoft PLATINUM April 2016
Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
Open source URL
[6]
Microsoft PLATINUM April 2016
Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
Open source URL
[7]
mitre-attackS0201
Open source URL
[8]
mitre-attackS0201
Open source URL
[9]
mitre-attackS0201
Open source URL
[10]
Microsoft PLATINUM April 2016
Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
Open source URL
[11]
Microsoft PLATINUM April 2016
Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
Open source URL
[12]
Microsoft PLATINUM April 2016
Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
Open source URL
[13]
Microsoft PLATINUM April 2016
Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
Open source URL
[14]
Microsoft PLATINUM April 2016
Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
Open source URL
[15]
Microsoft PLATINUM April 2016
Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
Open source URL
[16]
Microsoft PLATINUM April 2016
Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
Open source URL
[17]
Microsoft PLATINUM April 2016
Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
Open source URL
[18]
Microsoft PLATINUM April 2016
Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
Open source URL
[19]
Microsoft PLATINUM April 2016
Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
Open source URL
[20]
Microsoft PLATINUM April 2016
Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
Open source URL
[21]
Microsoft PLATINUM April 2016
Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
Open source URL
[22]
Microsoft PLATINUM April 2016
Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
Open source URL
[23]
Microsoft PLATINUM April 2016
Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
Open source URL
[24]
Microsoft PLATINUM April 2016
Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
Open source URL
[25]
Microsoft PLATINUM April 2016
Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
Open source URL
[26]
Microsoft PLATINUM April 2016
Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
Open source URL
[27]
Microsoft PLATINUM April 2016
Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
Open source URL
[28]
Microsoft PLATINUM April 2016
Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
Open source URL
[29]
Microsoft PLATINUM April 2016
Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
Open source URL
[30]
Microsoft PLATINUM April 2016
Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
Open source URL
[31]
Microsoft PLATINUM April 2016
Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
Open source URL
[32]
Microsoft PLATINUM April 2016
Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
Open source URL
[33]
Microsoft PLATINUM April 2016
Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
Open source URL
[34]
Microsoft PLATINUM April 2016
Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
Open source URL
[35]
Microsoft PLATINUM April 2016
Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
Open source URL
[36]
Microsoft PLATINUM April 2016
Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
Open source URL
[37]
Microsoft PLATINUM April 2016
Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
Open source URL
[38]
Microsoft PLATINUM April 2016
Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
Open source URL
[39]
Microsoft PLATINUM April 2016
Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
Open source URL
[40]
Microsoft PLATINUM April 2016
Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
Open source URL
[41]
Microsoft PLATINUM April 2016
Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
Open source URL
[42]
Microsoft PLATINUM April 2016
Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
Open source URL
[43]
Microsoft PLATINUM April 2016
Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
Open source URL
[44]
Microsoft PLATINUM April 2016
Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
Open source URL
[45]
Microsoft PLATINUM April 2016
Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
Open source URL
[46]
Microsoft PLATINUM April 2016
Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
Open source URL
[47]
Microsoft PLATINUM April 2016
Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
Open source URL
[48]
Microsoft PLATINUM April 2016
Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
Open source URL
[49]
Microsoft PLATINUM April 2016
Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
Open source URL
[50]
Microsoft PLATINUM April 2016
Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use