Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · PLATINUM · Unknown · misp-galaxy + mitre-attack · refreshed 2026-10-06

PLATINUM

  • TwoForOne
  • G0068
  • ATK33

MITRE G0068 ↗

PLATINUM — ATT&CK rosePL

attack rose · 11 techniques across 7 tactics

Last 30 days

last seen 21 d ago
dispatches2
victim1
CVEs seen0

What changed

ledger · newest first
  1. —todaynew CVE3 new CVEs: CVE-2013-7331, CVE-2015-2545, CVE-2015-2546
  2. —21 d agoresurfacedback on the wire — nothing in the previous 30 days

Analyst brief

misp-galaxy + mitre-attack

PLATINUM has been targeting its victims since at least as early as 2009, and may have been active for several years prior. Its activities are distinctly different not only from those typically seen in untargeted attacks, but from many targeted attacks as well. A large share of targeted attacks can be characterized as opportunistic: the activity group changes its target profiles and attack geographies based on geopolitical seasons, and may attack institutions all over the world.

Like many such groups, PLATINUM seeks to steal sensitive intellectual property related to government interests, but its range of preferred targets is consistently limited to specific governmental organizations, defense institutes, intelligence agencies, diplomatic institutions, and telecommunication providers in South and Southeast Asia. The group’s persistent use of spear phishing tactics (phishing attempts aimed at specific individuals) and access to previously undiscovered zero-day exploits have made it a highly resilient threat.

Observed targets (as stated by the sources)

0 countries · 5 sectors

assessed originnot stated by sourcesobserved targets · 0

sectors · 5

  • Defense
  • Government, Administration
  • Diplomacy
  • Intelligence
  • Telecoms

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

11 techniques · 7 of 15 tactics

  1. Initial access

    2 techniques

  2. Execution

    1 technique

  3. Privilege escalation

    1 technique

  4. Stealth

    2 techniques

  5. Credential access

    1 technique

  6. Collection

    2 techniques

  7. Command and control

    2 techniques

select a technique

Arsenal

3 malware
Malware
Malware · 3ATT&CK
JPINS0201 ↗
DipsindS0200 ↗
adbupdS0202 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs PLATINUM is cited as exploiting

none on KEV
  1. CVE-2015-25462026-10-17
    1. “The DLL exploited another previously unknown vulnerability (designated CVE-2015-2546) in the Windows kernel, which enabled it to elevate privileges for the Word executable and subsequently install a backdoor through the application.6 Researching this attack and the malware used therein led Microsoft to discover other instances of PLATINUM attacking users in India around August 2015.”

      cited as exploiting · source: download.microsoft.com ↗ · 2026-10-17

    2. “The DLL exploited another previously unknown vulnerability (designated CVE-2015-2546) in the Windows kernel, which enabled it to elevate privileges for the Word executable and subsequently install a backdoor through the application.6 Researching this attack and the malware used therein led Microsoft to discover other instances of PLATINUM attacking users in India around August 2015.”

      cited as exploiting · source: download.microsoft.com ↗ · 2026-10-17

  2. CVE-2013-73312026-10-17
    1. “Figure 6. Malicious Word 2003 files used by PLATINUM to deliver CVE-2013-7331”

      cited as exploiting · source: download.microsoft.com ↗ · 2026-10-17

    2. “Figure 6. Malicious Word 2003 files used by PLATINUM to deliver CVE-2013-7331”

      cited as exploiting · source: download.microsoft.com ↗ · 2026-10-17

  3. CVE-2015-25452026-10-17
    1. “For example, one zero-day vulnerability exploit (CVE-2015-2545) used by PLATINUM was addressed immediately in September 2015.”

      cited as exploiting · source: download.microsoft.com ↗ · 2026-10-17

    2. “For example, one zero-day vulnerability exploit (CVE-2015-2545) used by PLATINUM was addressed immediately in September 2015.”

      cited as exploiting · source: download.microsoft.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Primary-source reports

via APTnotes · linked, never re-hosted
  1. 2017PLATINUM continues to evolve, find ways to maintain invisibilityMicrosoft ↗
  2. 2016PLATINUM Targeted attacks in South and Southeast AsiaMicrosoft ↗

Take it with you

keyless · no signup

References

5 sources
  1. 1.download.microsoft.com/download/2/2/5/225BFE3E-E1DE-4F5B-A77B-71200928D209/Pl…
  2. 2.blogs.technet.microsoft.com/mmpc/2016/04/26/digging-deep-for-platinum
  3. 3.attack.mitre.org/groups/G0068
  4. 4.attack.mitre.org/groups/G0068
  5. 5.download.microsoft.com/download/2/2/5/225BFE3E-E1DE-4F5B-A77B-71200928D209/Pl…

Track PLATINUM on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.