Darkhotel is a suspected South Korean threat group that has targeted victims primarily in East Asia since at least 2004. The group's name is based on cyber espionage operations conducted via hotel Internet networks against traveling executives and other select guests. Darkhotel has also conducted spearphishing campaigns and infected victims through peer-to-peer and file sharing networks.123
- Kaspersky Darkhotel
- Securelist Darkhotel Aug 2015
- Microsoft Digital Defense FY20 Sept 2020
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| also_known_as | Darkhotel | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | DUBNIUM | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Zigzag Hail | — → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1518.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1497.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.013 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1573.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1080 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1082 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1056.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1057 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1140 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1189 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1091 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1497 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1497.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1124 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1553.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1083 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1547.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1203 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1016 | System Network Configuration Discovery | — |
| T1027.013 | Encrypted/Encoded File | — |
| T1036.005 | Match Legitimate Resource Name or Location | — |
| T1056.001 | Keylogging | — |
| T1057 | Process Discovery | — |
| T1059.003 | Windows Command Shell | — |
| T1080 | Taint Shared Content | — |
| T1082 | System Information Discovery | — |
| T1083 | File and Directory Discovery | — |
| T1091 | Replication Through Removable Media | — |
| T1105 | Ingress Tool Transfer | — |
| T1124 | System Time Discovery | — |
| T1140 | Deobfuscate/Decode Files or Information | — |
| T1189 | Drive-by Compromise | — |
| T1203 | Exploitation for Client Execution | — |
| T1204.002 | Malicious File | — |
| T1497 | Virtualization/Sandbox Evasion | — |
| T1497.001 | System Checks | — |
| T1497.002 | User Activity Based Checks | — |
| T1518.001 | Security Software Discovery | — |
| T1547.001 | Registry Run Keys / Startup Folder | — |
| T1553.002 | Code Signing | — |
| T1566.001 | Spearphishing Attachment | — |
| T1573.001 | Symmetric Cryptography | — |
Aliases
Darkhotel · DUBNIUM · Zigzag Hail
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.