Darkhotel is a suspected South Korean threat group that has targeted victims primarily in East Asia since at least 2004. The group's name is based on cyber espionage operations conducted via hotel Internet networks against traveling executives and other select guests. Darkhotel has also conducted spearphishing campaigns and infected victims through peer-to-peer and file sharing networks.123
- Kaspersky Darkhotel
- Securelist Darkhotel Aug 2015
- Microsoft Digital Defense FY20 Sept 2020
断言与引用
每条断言来自写入方；provenance 是写入方声称，不是本目录的复核结论。有效期按引用年份读取。
| predicate | object | 有效期 | 置信 | 证据 |
|---|---|---|---|---|
| also_known_as | Darkhotel | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | DUBNIUM | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Zigzag Hail | — → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1518.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1497.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.013 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1573.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1080 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1082 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1056.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1057 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1140 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1189 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1091 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1497 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1497.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1124 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1553.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1083 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1547.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1203 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
技术使用
| ATT&CK | 技术 | platforms |
|---|---|---|
| T1016 | System Network Configuration Discovery | — |
| T1027.013 | Encrypted/Encoded File | — |
| T1036.005 | Match Legitimate Resource Name or Location | — |
| T1056.001 | Keylogging | — |
| T1057 | Process Discovery | — |
| T1059.003 | Windows Command Shell | — |
| T1080 | Taint Shared Content | — |
| T1082 | System Information Discovery | — |
| T1083 | File and Directory Discovery | — |
| T1091 | Replication Through Removable Media | — |
| T1105 | Ingress Tool Transfer | — |
| T1124 | System Time Discovery | — |
| T1140 | Deobfuscate/Decode Files or Information | — |
| T1189 | Drive-by Compromise | — |
| T1203 | Exploitation for Client Execution | — |
| T1204.002 | Malicious File | — |
| T1497 | Virtualization/Sandbox Evasion | — |
| T1497.001 | System Checks | — |
| T1497.002 | User Activity Based Checks | — |
| T1518.001 | Security Software Discovery | — |
| T1547.001 | Registry Run Keys / Startup Folder | — |
| T1553.002 | Code Signing | — |
| T1566.001 | Spearphishing Attachment | — |
| T1573.001 | Symmetric Cryptography | — |
别名
Darkhotel · DUBNIUM · Zigzag Hail
读取与复核
记录自动入库·未人工复核。置信度是写入方给出的 0–100 值，置信带按 ≥80 / 50–79 / <50 划为高 / 中 / 低；四条信任轴（合成、生命周期、置信带、佐证源数）分开呈现，不合并为单一信任分。