According to Microsoft, a group by the name of PLATINUM has made use of Intel's Active Management Technology (AMT) - available on Intel's vPro processors and chipsets - to simply bypass the Windows Firewall entirely. Essentially, the group has a file transfer tool, which at its core uses the Serial-over-LAN (SOL) channel from within AMT for communication purposes. Since this channel is independent of the operating system, it allows for any communication through it to be " invisible to firewall and network monitoring applications running on the host device."
What needs to be said is that SOL, which "exposes a virtual serial device with a chipset-provided channel over TCP" is not enabled by default, and requires administrative privileges to actually run on the target workstations. Since the provisioning of such a channel is bound by the use of user credentials - username and password - the Redmond giant speculates that PLATINUM "might have obtained compromised credentials from victim networks".
The reason why AMT needs such low-level access has a lot to do with its actual function. The technology allows someone to remotely install operating systems on machines that don't have any, allows for the power cycling of devices, and thus provides a so-called "IP-based KVM solution" - where KVM is for keyboard, video and mouse - to accomplish the aforementioned tasks.
