Platinum APT’s new Titanium backdoor mimics popular PC software to stay hidden

guest · Nov 8, 2019

Platinum APT’s new Titanium backdoor mimics popular PC software to stay hidden
The group uses encryption, fileless technologies, and mimicry to stay under the radar
November 8, 2019
https://www.zdnet.com/article/plati...or-mimics-popular-pc-software-to-stay-hidden/

The Platinum advanced persistent threat (APT) cyberattack group has developed a new backdoor with interesting concealment techniques.
Platinum has been tracked since 2012 and generally targets government, military, and political targets across the APAC region.

Now, the APT appears to have added a new backdoor, dubbed Titanium, to its arsenal.
Named after a password to one of its archives, Titanium "hides at every step by mimicking common software" including protection-related, sound driver software, and video creation tools, according to Kaspersky researchers.

Each example found involved the use of an exploit for executing code as a system-level user and shellcode to download an additional downloader. Platinum targets winlogon.exe but Kaspersky does not know how the injection occurs.
Click to expand...

Kaspersky is unaware of any active campaigns, at present.

"The Titanium APT has a very complicated infiltration scheme. It involves numerous steps and requires good coordination between all of them. In addition, none of the files in the file system can be detected as malicious due to the use of encryption and fileless technologies," the researchers say. "One other feature that makes detection harder is the mimicking of well-known software."
Click to expand...

Kaspersky: Titanium: the Platinum group strikes again

Log in or Sign up

Platinum APT’s new Titanium backdoor mimics popular PC software to stay hidden

guest Guest

Log in or Sign up

Platinum APT’s new Titanium backdoor mimics popular PC software to stay hidden

guest Guest

Useful Searches