What tactics and techniques does PLATINUM use?

How PLATINUM Typically Operates

PLATINUM is best understood as a targeted espionage actor rather than a noisy smash-and-grab group. Its playbook centres on initial access through phishing, follow-on execution from weaponised attachments, and custom malware that supports persistence, command-and-control, and stealth. The operational pattern matters because the same intrusion chain can look like routine user activity unless defenders correlate email, endpoint, and remote-access signals.

That mix of social engineering and malware is consistent with a broader phishing-and-execution model seen across intrusion sets. For defenders, the most useful question is not just whether a message arrived, but whether a user action led to script launch, unusual child processes, or a new remote-access foothold that did not exist before.

PLATINUM’s long-dwell behaviour also means the actor may stage access quietly before expanding laterally or reusing trusted tools. A MITRE ATT&CK Enterprise Matrix is useful here because it helps map those observed behaviours to intrusion tactics such as execution, persistence, privilege escalation, and lateral movement.

What Defenders Should Look For in the Kill Chain

The most relevant telemetry usually appears in three places: email delivery and user interaction, endpoint execution, and remote access. Email filtering only goes so far if the attachment is opened and then launches scripts, macros, archive contents, or other secondary payloads. Endpoint monitoring should focus on process ancestry, script interpreters, suspicious living-off-the-land activity, and any change in beaconing or outbound connections after the initial click.

Unusual remote access is especially important because stealthy operators often blend into administrative workflows. Watch for logons from unfamiliar geographies, atypical timing, new remote tools, service-account misuse, and access patterns that do not match the user’s normal role. If those signals line up with recent phishing, treat the event as a likely intrusion path rather than an isolated email issue.

Defenders who want a structured way to reason about the email side of the intrusion chain can use NHIMG’s Top 10 Phishing Techniques, which covers the main lure and delivery patterns that attackers use to turn a message into execution.

Why PLATINUM’s Tradecraft Is Hard to Contain

The combination of social engineering, custom tooling, and stealth creates a detection problem, not just a prevention problem. If the organisation only blocks obvious malware or obvious phishing domains, PLATINUM-style activity can still succeed through benign-looking attachments, delayed execution, and remote-control mechanisms that resemble legitimate administration. That makes early detection dependent on layered controls and correlation, not a single gateway check.

When an intrusion actor is built for persistence, containment is also harder because the compromise may already include multiple access paths. One phished mailbox, one executed attachment, and one foothold on a host can be enough to support follow-on access even if the original lure is removed. That is why defenders should assume post-compromise activity may continue after the initial payload is contained.

Failure mechanism: A phishing message gains initial execution, then malware or script activity creates durable access that blends into normal user or admin traffic, allowing the actor to retain persistence while evading simple indicator-based blocking.

Impact: The organisation can lose visibility into the true entry point, miss secondary access paths, and face prolonged espionage activity even after the initial email is quarantined.

Practitioner Guidance

What to prioritise: Correlate mailbox telemetry, endpoint process lineage, and remote-access logs around the same user and time window. If those signals do not line up, you may be looking at separate events; if they do, treat them as one intrusion chain.

What to verify: Confirm whether the attachment or link triggered script execution, whether any new persistence mechanism was created, and whether the remote session originated from an expected device, account, and location. Verification should focus on whether the actor moved from delivery to execution to access, not just whether malware signatures fired.

Practitioner takeaway: The key judgement is to treat PLATINUM as a chain of access, execution, and persistence, because the earliest signal is often only the start of a longer espionage operation.

Related resources from NHI Mgmt Group

• Guide: Threat Actor Groups Guide
• What tactics and techniques do Lazarus crypto heists use?
• What tactics and techniques does APT29 use?
• What tactics and techniques does Conti use?
• What tactics and techniques does BlackCat (ALPHV) use?