Skip to content

Darkhotel

Darkhotel is a suspected South Korean threat group that has targeted victims primarily in East Asia since at least 2004. The group's name is based on cyber espionage operations conducted via hotel Internet networks against traveling executives and other select guests. Darkhotel has also conducted spearphishing campaigns and infected victims through peer-to-peer and file sharing networks.

ATT&CK ID: G0012
Origin: South Korea
Weather family: Hail
Techniques: 22
Tools: 0

Also tracked as DUBNIUM · Zigzag Hail

Vulnerabilities it has exploited

CVE-2015-8651 Adobe Flash PlayerUnscored · exploited in the wild

Techniques

Initial Access

Replication Through Removable Media Drive-by Compromise Phishing

Execution

Command and Scripting Interpreter Exploitation for Client Execution User Execution

Persistence

Boot or Logon Autostart Execution

Privilege Escalation

Boot or Logon Autostart Execution

Stealth

Obfuscated Files or Information Masquerading Deobfuscate/Decode Files or Information Virtualization/Sandbox Evasion

Defense Impairment

Subvert Trust Controls

Credential Access

Discovery

System Network Configuration Discovery Process Discovery System Information Discovery File and Directory Discovery System Time Discovery Virtualization/Sandbox Evasion Software Discovery

Lateral Movement

Taint Shared Content Replication Through Removable Media

Collection

Command and Control

Ingress Tool Transfer Encrypted Channel

MITRE ATT&CK All threat actors