KRKorea (Republic of)confidence: 50G0012
DarkHotelDarkHotel
Also known as: DUBNIUM · Fallout Team · Karba · Luder · Nemim · Nemin · Tapaoux · Pioneer · Shadow Crane · APT-C-06 · SIG25 · TUNGSTEN BRIDGE · T-APT-02 · G0012 · ATK52 · Zigzag Hail · DarkHotel
Origin
KR
Known aliases
17
Target sectors
1
Attribution
State-sponsored
Profile
Kaspersky described DarkHotel in a 2014 report as: '... DarkHotel drives its campaigns by spear-phishing targets with highly advanced Flash zero-day exploits that effectively evade the latest Windows and Adobe defenses, and yet they also imprecisely spread among large numbers of vague targets with peer-to-peer spreading tactics. Moreover, this crews most unusual characteristic is that for several years the Darkhotel APT has maintained a capability to use hotel networks to follow and hit selected targets as they travel around the world.'
Aliases· 17
DUBNIUMFallout TeamKarbaLuderNemimNeminTapaouxPioneerShadow CraneAPT-C-06SIG25TUNGSTEN BRIDGET-APT-02ATK52Zigzag HailDarkHotel
Target sectors· 1
Private sector
Known victims· 5
- Japan
- Russia
- Taiwan
- South Korea
- China
MITRE ATT&CK Group crosswalk
References
- https://securelist.com/blog/research/71713/darkhotels-attacks-in-2015/
- https://blogs.technet.microsoft.com/mmpc/2016/06/09/reverse-engineering-dubnium-2
- https://securelist.com/blog/research/66779/the-darkhotel-apt/
- https://securelist.com/the-darkhotel-apt/66779/
- https://web.archive.org/web/20160104165148/http://drops.wooyun.org/tips/11726
- https://labs.bitdefender.com/wp-content/uploads/downloads/inexsmar-an-unusual-darkhotel-campaign/
- https://www.cfr.org/interactive/cyber-operations/darkhotel
- https://www.securityweek.com/darkhotel-apt-uses-new-methods-target-politicians
Related by meaning· 6
Nearest entities by semantic similarity across the cs-graph corpus.