Platinum

Researchers at Symantec have observed a new malware campaign they believe to have been conducted by the Platinum APT group. The campaign leverages an obfuscation technique known as steganography, in order to evade detection. This campaign, referred to as EasternRoppels, was first observed in 2012, and has generally targeted South and Southeast Asian countries. However, the updated obfuscation techniques used in this attack could very easily be expanded to other campaigns. These obfuscation techniques could potentially prevent security products from alerting appropriately, as they are highly complex.

Recommendations

• Enable the Cyber Attack Chatter rule to monitor for any related chatter or traffic on social and dark web channels
• Ensure all antivirus definitions are up to date
• Monitor your organization's outbound network traffic and take action if suspicious or malicious domains are contacted

Details

Platinum is an APT group first reported on by Microsoft in 2016. The group is known for utilizing novel obfuscation techniques and has previously been observed using Windows hotpatches to cover their tracks. In this recent campaign, Platinum is using a multistage attack, with the obfuscation present in the secondary stage. The first stage leverages Windows Management Instrumentation, or WMI, to execute a Powershell downloader and drop a second Powershell backdoor. This backdoor serves to fingerprint the victim machine. Concurrently, a secondary piece of malware has been observed, and is believed to be the secondary stage of this attack. It is this secondary stage that Symantec has determined to be related to the Platinum group.

After some initial checks, the main backdoor utilized by the secondary stage connects to the command and control server. The HTML response of the server would initially seem to suggest that the server is down, however, this is actually a clever obfuscation trick. Within the HTML of the C2 landing page, the attackers have used permutation of HTML attributes to encode hidden data. The backdoor collects this data, and decrypts it using an encryption key that is also embedded within the HTML of the original landing page. The encryption key is hidden using a technique that attaches white space to the end of lines in a particular pattern. This method of hiding data within other data is called steganography. Decrypting this information reveals a file containing commands from the attacker.