- Category
- State · Attributed to a state or working for one.
- Origin
- Singapore(medium confidence)contested
- Motivation
- Information theft and espionage
- Seen
- 2009–2026
- Status
- Active
- ATT&CK
- G0068 · 11 techniques
- Sources
- 11 sources carry it
- Identifier
- GINC-APT-0051 · platinum
SingaporeWhat it is
PLATINUM is an activity group that has targeted victims since at least 2009. The group has focused on targets associated with governments and related organizations in South and Southeast Asia.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- MITRE ATT&CK
- G0068
- Thales
- ATK33
- Operations
- Operation “EasternRoppels”
- Other names
- Fallow Squall, ATK 33, DeadlyKiss, GINGERSNAP, PARASITE, RUBYVINE, TwoForOne
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTChina
- MicrosoftSingapore
- ThreatActor.info (Malpedia et al.)Singapore · high
Targets
- Countries
- China, India, Indonesia, Malaysia, Singapore, Thailand, Vietnam
- Sectors
- Defense, Diplomacy, Financial, Government, Government, Administration, Intelligence, Telecommunications, Telecoms
Tools
The tools and malware families the sources tie to it.
- AMT Feature FW evasion
- AMTsol
- CVE-2015-2545
- Dipsind
- DvDupdate.dll
- GraphicBooting
- Hotpatching techniques
- JPIN
- Living off the Land
- RedPepper
- RedSalt
- Titanium
- Xploit
- adbupd
- psinstrc.ps1
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de