DarkHotel
threat actorKRalso known as
Other names and identifiers for this entity.
ATT&CK
DUBNIUM · Darkhotel · Zigzag Hail
MISP
APT-C-06 · ATK52 · DUBNIUM · DarkHotel · Fallout Team · Karba · Luder · Nemim · Nemin · Pioneer · SIG25 · Shadow Crane · T-APT-02 · TUNGSTEN BRIDGE · Tapaoux · Zigzag Hail
Kaspersky described DarkHotel in a 2014 report as: '... DarkHotel drives its campaigns by spear-phishing targets with highly advanced Flash zero-day exploits that effectively evade the latest Windows and Adobe defenses, and yet they also imprecisely spread among large numbers of vague targets with peer-to-peer spreading tactics. Moreover, this crews most unusual characteristic is that for several years the Darkhotel APT has maintained a capability to use hotel networks to follow and hit selected targets as they travel around the world.'
resolved ATT&CK groups
Threat groups associated with this.
techniques used (24)
ATT&CK techniques this enables or maps to.
references
External citations — patches, advisories, analysis.
- https://securelist.com/blog/research/71713/darkhotels-attacks-in-2015/
- https://blogs.technet.microsoft.com/mmpc/2016/06/09/reverse-engineering-dubnium-2
- https://securelist.com/blog/research/66779/the-darkhotel-apt/
- https://securelist.com/the-darkhotel-apt/66779/
- https://web.archive.org/web/20160104165148/http://drops.wooyun.org/tips/11726
- https://labs.bitdefender.com/wp-content/uploads/downloads/inexsmar-an-unusual-darkhotel-campaign/
- https://www.cfr.org/interactive/cyber-operations/darkhotel
- https://www.securityweek.com/darkhotel-apt-uses-new-methods-target-politicians