PLATINUM is back – hacking group uses steganography to fly under security radar

Kaspersky researchers have uncovered a highly sophisticated cyberespionage campaign aimed at stealing information from South Asian diplomatic, government and military entities. The campaign lasted almost six years and had ties to other recent attacks detected in the region. Further investigation into the tools and methods used in the campaign led researchers to the conclusion that the attacker behind it is the PLATINUM group – a cyberespionage actor that they thought had gone. For the activity to remain unseen for such a long time, the group encoded its information using a technique called steganography, which conceals the fact that there is any information there at all.

Steganography is the practice of transferring data in a concealed format where the very fact that data is being sent is disguised. In this way it differs from cryptography, which only conceals the data. By using steganography, cyberespionage actors can remain in an infected system for a very long time without arousing any suspicion. This was the method used by the PLATINUM group, a cyber threat collective acting against governments and related organizations in South and Southeast Asia, whose last known activity had been reported back in 2017.
In the case of the newly discovered PLATINUM operation, the malware commands were embedded in the HTML-code of a website. The ‘tab’ and ‘space bar’ keys on a keyboard do not change how HTML-code is reflected on a web-page, so the threat actors encoded the commands in a specific sequence of these two keys. As a result, the commands were almost impossible to detect in the network traffic, as the malware merely appeared to access an unsuspicious website that was unnoticeable in the overall traffic.

To detect the malware, researchers had to check programs that were capable of uploading files to the device. Among them, the experts noticed one that acted strangely – for instance, it accessed the public cloud service Dropbox for administration and was programmed to work only at certain times. The researchers later realized this was done to hide the malware activity among processes operating during normal working hours, when its behavior wouldn’t arouse suspicion. In fact the downloader was exfiltrating and uploading data and files to and from the infected device.

To reduce the risk of falling victim to sophisticated cyberespionage operations, Kaspersky recommends taking the following measures:
-Implement security awareness training for staff explaining how to recognize and avoid potentially malicious applications or files. For example, employees should not download and launch any apps or programs from untrusted or unknown sources.
For endpoint level detection, investigation and timely remediation of incidents, implement EDR solutions such as Kaspersky Endpoint Detection and Response.

-In addition to adopting essential endpoint protection, implement a corporate-grade security solution that detects advanced threats on the network level at an early stage, such as Kaspersky Anti Targeted Attack Platform.