PLATINUM Hacking Group Returns, Using Steganography to Fly Under Security Radar

Kaspersky researchers have uncovered a highly sophisticated cyberespionage campaign aimed at stealing information from South Asian diplomatic, government and military entities. The campaign lasted almost six years and had ties to other recent attacks detected in the region. Further investigation led researchers to conclude that the attacker behind it is the PLATINUM group – a cyberespionage actor that was thought to be no longer active. For their activity to remain unseen for such a long time, the group encoded information using a technique called steganography.

Security researchers have long warned about the dangers of steganography in threat campaigns. Steganography is the practice of transferring data in a concealed format, which disguises the very fact that data is being sent at all. This allows cyberespionage actors to remain in an infected system for a very long time without arousing any suspicion. This was the method used by the PLATINUM group, a cyberthreat collective acting against governments and related organizations in South and Southeast Asia, whose last known activity was reported in 2017.

In the case of the newly discovered PLATINUM operation, the malware commands were embedded in the HTML-code of a website. The ‘tab’ and ‘space bar’ keys on a keyboard do not change how HTML-code is reflected on a webpage, so the threat actors encoded the commands in a specific sequence of these two keys. As a result, the commands were almost impossible to detect in network traffic, as the malware merely appeared to access an unsuspicious website that was unnoticeable in overall traffic.

To detect the malware, Kaspersky researchers had to check programs that were capable of uploading files to a device. Among them, the experts noticed one program that acted strangely; for instance, it accessed the public cloud service Dropbox for administration, and was programmed to work only at certain times. The researchers later realized this was done to hide the malware activity among processes operating during normal working hours, when its behavior wouldn’t arouse suspicion. In fact, the downloader was exfiltrating and uploading data and files to and from the infected device.

“Throughout its known existence, PLATINUM’s campaigns have been elaborate and thoroughly crafted,” said Alexey Shulmin, security researcher at Kaspersky. “The malware used in this attack is no exception – apart from the steganography, it had other features that allowed it to fly and operate under the radar for a long time. For example, it could transfer commands not only from the command center, but also from one infected machine to another. In this way, they could reach devices that were part of the same infrastructure as the attacked devices, but which were not connected to the internet. Seeing threat actors like PLATINUM implementing steganography is a sign that advanced persistent threats are increasing the sophistication of their methods significantly to go undetected, and security vendors should keep this in mind when developing their security soultions.”

To reduce the risk of falling victim to sophisticated cyberespionage operations, Kaspersky recommends taking the following measures:

• Implement security awareness training for staff, explaining how to recognize and avoid potentially malicious applications or files. For example, employees should not download and launch any apps or programs from untrusted or unknown sources.
• For endpoint level detection, investigation and timely remediation of incidents, implement EDR solutions such as Kaspersky Endpoint Detection and Response.
• In addition to adopting essential endpoint protection, implement a corporate-grade security solution that detects advanced threats on the network level at an early stage, such as Kaspersky Anti Targeted Attack Platform.
• Provide your SOC team with access to the latest Threat Intelligence, to keep up to date with the new and emerging tools, techniques and tactics used by threat actors.

Read the full report on Securelist.com.

About Kaspersky

Kaspersky is a global cybersecurity company founded in 1997. Kaspersky’s deep threat intelligence and security expertise is constantly transforming into innovative security solutions and services to protect businesses, critical infrastructure, governments and consumers around the globe. The company’s comprehensive security portfolio includes leading endpoint protection and a number of specialized security solutions and services to fight sophisticated and evolving digital threats. Over 400 million users are protected by Kaspersky technologies and we help 270,000 corporate clients protect what matters most to them. Learn more at usa.kaspersky.com.