PLATINUM

Also known as TwoForOne, G0068, ATK33

0mentions, 7 days

0mentions, 30 days

nonelast mentioned

PLATINUM has been targeting its victims since at least as early as 2009, and may have been active for several years prior. Its activities are distinctly different not only from those typically seen in untargeted attacks, but from many targeted attacks as well. A large share of targeted attacks can be characterized as opportunistic: the activity group changes its target profiles and attack geographies based on geopolitical seasons, and may attack institutions all over the world. Like many such groups, PLATINUM seeks to steal sensitive intellectual property related to government interests, but its range of preferred targets is consistently limited to specific governmental organizations, defense institutes, intelligence agencies, diplomatic institutions, and telecommunication providers in South and Southeast Asia. The group’s persistent use of spear phishing tactics (phishing attempts aimed at specific individuals) and access to previously undiscovered zero-day exploits have made it a highly resilient threat.

CVEs in recent coverage

No CVEs named alongside this actor in the last 90 days.

Recent victims

No leak-site posts on record for this group.

ATT&CK techniques

T1003.001 LSASS Memory T1036 Masquerading T1055 Process Injection T1056.001 Keylogging T1056.004 Credential API Hooking T1068 Exploitation for Privilege Escalation T1095 Non-Application Layer Protocol T1105 Ingress Tool Transfer T1189 Drive-by Compromise T1204.002 Malicious File T1566.001 Spearphishing Attachment

Recent activity

No posts or advisories have named this actor recently.

References

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.