Microsoft has published its latest Security Intelligence Report (PDF), covering the last half of 2015. This time around, the company is highlighting the PLATINUM hacking group, a threat to organizations with high-value intellectual property. While the group has been around since 2009, their tactics and knack for evading detection make it tough to erect strong defenses.
“A large share of targeted attacks can be characterized as opportunistic: the activity group changes its target profiles and attack geographies based on geopolitical seasons, and may attack institutions all over the world,” stated the report. “Like many such groups, PLATINUM seeks to steal sensitive intellectual property related to government interests, but its range of preferred targets is consistently limited to specific governmental organizations, defense institutes, intelligence agencies, diplomatic institutions, and telecommunication providers in South and Southeast Asia.”
PLATINUM has a reputation for coordinating very targeted attacks, often resorting to spear-phishing their victims by emailing them using their private or non-work accounts, using this method to gain a foothold into corporate networks. Additionally, the shadowy group is known for using custom-developed tools that are updated frequently enough to stymie security researchers.
Further, PLATINUM uses self-deleting malware to avoid detection and uses zero-day exploits to slip through a network’s defenses. After successfully infecting an organization’s network, the group’s backdoor malware is often configured to transmit data during the victim’s working hours, making it appear as normal user traffic and reducing the likelihood that it triggers an alarm.
In short, PLATINUM is patient and persistent and has an advanced malware toolkit to gain access to corporate networks. Last year, the group used four zero-day exploits in two campaigns, said Microsoft.
“PLATINUM is an extremely difficult adversary for targeted organizations to defend against,” warned the report. “It possesses a wide range of technical exploitation capabilities, significant resources for researching or purchasing complicated zero-day exploits, the ability to sustain persistence across victim networks for years, and the manpower to develop and maintain a large number of tools to use within unique victim networks.”
Using data from Azure Active Directory, Microsoft’s cloud-based user identity platform, the company is also sounding the alarm on fraudulent login attempts. Account credentials are “sometimes compiled into massive lists of leaked and stolen passwords (some of these lists have been found with more than a billion passwords) that are sold, traded, and shared on the Internet,” according to the report. “Because password reuse across accounts is common, even a single leaked password can provide an attacker with access to every one of a user’s accounts.”
Microsoft’s account protection systems detect and block more than 10 million password-based attacks, claims the company. Often, those attacks involve attackers with valid user credentials. A large number of attacks targeting Microsoft’s consumer cloud services in the second half of 2015 hailed from Asia (49.1 percent), followed by South America (19.5 percent), Europe (14.2 percent) and North America (13.2 percent).