PLATINUM

Adversaries may hook into Windows application programming interface (API) functions and Linux system functions to collect user credentials. Malicious

Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversar

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external ad

Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new ac

Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to ope

Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masqueradin

Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The l

Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a met

Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a sp

Dipsind is a malware family of backdoors that appear to be used exclusively by [PLATINUM](https://attack.mi

JPIN is a custom-built backdoor family used by PLATINUM. Evidence

adbupd is a backdoor used by PLATINUM that is similar to [Dipsind]