DarkHotel — Threat Actors — SecurityStudies.info

Profile

Also known as: APT-C-06, ATK52, DUBNIUM, Fallout Team, G0012, Karba, Luder, Nemim, Nemin, Pioneer, Shadow Crane, SIG25, T-APT-02, Tapaoux, TUNGSTEN BRIDGE, Zigzag Hail

Kaspersky described DarkHotel in a 2014 report as: '... DarkHotel drives its campaigns by spear-phishing targets with highly advanced Flash zero-day exploits that effectively evade the latest Windows and Adobe defenses, and yet they also imprecisely spread among large numbers of vague targets with peer-to-peer spreading tactics. Moreover, this crews most unusual characteristic is that for several years the Darkhotel APT has maintained a capability to use hotel networks to follow and hit selected targets as they travel around the world.'

ATT&CK techniques · 24

Initial Access

T1091Replication Through Removable Media T1189Drive-by Compromise T1566.001Spearphishing Attachment

Execution

T1059.003Windows Command Shell T1203Exploitation for Client Execution T1204.002Malicious File

Persistence

T1547.001Registry Run Keys / Startup Folder

Stealth

T1027.013Encrypted/Encoded File T1036.005Match Legitimate Resource Name or Location T1140Deobfuscate/Decode Files or Information T1497Virtualization/Sandbox Evasion T1497.001System Checks T1497.002User Activity Based Checks

Defense Impairment

T1553.002Code Signing

Credential Access

T1056.001Keylogging

Discovery

T1016System Network Configuration Discovery T1057Process Discovery T1082System Information Discovery T1083File and Directory Discovery T1124System Time Discovery T1518.001Security Software Discovery

Lateral Movement

T1080Taint Shared Content

Command and Control

T1105Ingress Tool Transfer T1573.001Symmetric Cryptography

Incidents attributed

No incident in the register is attributed to this actor.

In the news

No Asia-Pacific article names this actor yet.

csrftoken	CSRF protection — prevents cross-site request forgery attacks	1 year	Essential
sessionid	Session management — keeps authenticated users logged in	14 days	Essential