H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[JPIN](https://attack.mitre.org/software/S0201) is a custom-built backdoor family used by [PLATINUM](https://attack.mitre.org/groups/G0068). Evidence suggests developers of [JPIN](https://attack.mitre.org/software/S0201) and [Dipsind](https://attack.mitre.org/software/S0200) code bases were related in some way. (Citation: Microsoft PLATINUM April 2016)

Labels

malware

21 recorded

Relationships

uses

to BITS Jobs

Technique

uses

to Disable or Modify Tools

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to File Transfer Protocols

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Keylogging

Technique

uses

to Local Groups

Technique

uses

to Mail Protocols

Technique

uses

to Obfuscated Files or Information

Technique

uses

to Process Discovery

Technique

uses

to Process Injection

Technique

uses

to Query Registry

Technique

uses

to Security Software Discovery

Technique

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to System Service Discovery

Technique

uses

to Windows Command Shell

Technique

uses

to Windows Permissions

Technique

uses

from PLATINUM

Group

3 external

References

mitre-attack

S0201

open

JPIN

—

Microsoft PLATINUM April 2016

https://download.microsoft.com/download/2/2/5/225BFE3E-E1DE-4F5B-A77B-71200928D209/Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf

open