PLATINUM

Executive Summary

PLATINUM, also known as TwoForOne or DeadlyKiss, is a long-active cyber threat actor primarily involved in espionage activities targeting government, defense, and telecommunications sectors in Southeast Asia since at least 2016. Known for their use of sophisticated tactics including spear-phishing and credential harvesting, PLATINUM has demonstrated persistence and technical proficiency in compromising high-value targets.

Goals & Targeting

PLATINUM's primary strategic objective appears to be espionage, with a focus on collecting sensitive information from government and defense sectors in Southeast Asia. Their targeting of telecommunications companies may indicate an interest in surveillance capabilities or strategic infrastructure. The group's sustained activity over years suggests a long-term commitment to gathering intelligence for either diplomatic or military advantage, possibly in support of a nation-state agenda. victims are typically high-value targets within critical national infrastructure sectors.

PLATINUM is an advanced persistent threat (APT) group that has been active in the cyber espionage landscape since at least 2016. The group has primarily targeted government entities, defense organizations, and telecommunications companies across Southeast Asia, with a particular focus on Singapore and nearby regions. Despite their elusive nature, PLATINUM is known to employ a range ofTTPs (tactics, techniques, and procedures) including spear-phishing campaigns, malware deployment, and lateral movement within networks. The group's activities are characterized by a focus on data exfiltration and intelligence gathering, often leveraging custom tools and tailored attacks to achieve their objectives. While the exact origins of PLATINUM remain unclear, their consistent targeting of regional governments suggests a possible state-sponsored or state-aligned motivation.

Key Capabilities

• Spear-phishing attacks using malicious Office documents
• Credential harvesting via keylogging and API hooking
• Process injection for malware persistence
• Use of custom tools like adbupd and JPIN
• Ingress tool transfer for lateral movement

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

PLATINUM's campaigns are characterized by a prolonged period of activity and a focus on maintaining persistence within targeted networks. The group is known to deploy custom tools like adbupd and JPIN, which suggest a high level of technical proficiency. Their use of Spearphishing Attachment (T1566.001) indicates an initial access vector through malicious emails with attachments. Campaigns have been observed targeting Southeast Asian governments, defense contractors, and telecommunications firms. Notable past operations include the Hellsing campaign, which utilized a range of TTPs including keylogging and credential harvesting.

IOC Patterns

• Spearphishing campaigns using malicious Office documents
• Malicious processes leveraging process injection techniques
• Use of custom tools like adbupd and JPIN
• Network traffic indicative of C2 communication over non-standard protocols

Recommended Actions

• Implement strict email filtering to detect and block spear-phishing attempts
• Monitor for unusual process activity indicating potential process injection attacks
• Conduct regular network monitoring for known malicious file hashes associated with PLATINUM campaigns
• Enforce least privilege principles to mitigate the risk of lateral movement within networks

Suggested Tags