Attackers Abuse Intel Chip Management Feature to Load Malware

By Marcos Colon

Cyber criminals in Southeast Asia are taking advantage of a feature found in Intel chips to load malware and ultimately compromise machines.

New research published by Microsoft on the Platinum APT group covers the evolution of the group’s file-transfer tool which uses the Intel Active Management Technology (AMT) Serial-over-LAN (SOL) channel for communication, according to a Microsoft blog post.

“This channel works independently of the operating system (OS), rendering any communication over it invisible to firewall and network monitoring applications running on the host device,” the post reads. “Until this incident, no malware had been discovered misusing the AMT SOL feature for communication.”

Thus far, the tool has only been seen impacting a handful of organizations in Southeast Asia. Platinum customizes their tools based on the network architecture of the organizations they target.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.