Loading threat actor…
DarkHotel is a long-running cyberespionage actor active since at least 2007, also known as APT-C-06, DUBNIUM, Fallout Team, Nemim, and Tapaoux. It is particularly associated with selective compromises of high-value travelers through hotel networks in the Asia-Pacific region. Targets include chief executives, senior managers, sales and marketing directors, research and development personnel, government officials, and military organizations. Its victims span electronics manufacturing, investment and private equity, pharmaceuticals, chemicals, cosmetics, automotive businesses, defense, law enforcement, and nongovernmental organizations. DarkHotel combines highly targeted intrusions with broader malware distribution through peer-to-peer networks. Its hotel operations use compromised networks to identify and infect selected guests, followed by removal of staging tools to conceal activity. Other initial-access methods include spearphishing with malicious archives, Windows shortcuts, and Office documents. The actor has used Flash and Internet Explorer zero-day exploits, including CVE-2018-8174 and CVE-2018-8373. Malicious Word documents have loaded exploit-bearing web pages through embedded Internet Explorer components. The group abuses stolen or cryptographically weak digital certificates to sign malware and uses RC4, XOR, and RSA-based obfuscation to hinder analysis. Documented post-compromise techniques include registry-based startup persistence, command-shell and PowerShell execution, UAC bypass, DLL hijacking, reflective payload loading, and propagation through infected executables on shared drives. Its modular backdoor toolsets include Lucker, Retro, and Collector, supporting intelligence collection through capabilities such as keylogging, screenshots, audio recording, and file collection. Historically, most observed infections were concentrated in Japan, Taiwan, China, Russia, and South Korea, although its international footprint also reflects indiscriminate distribution and victims traveling between countries.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
95 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
19 malware families Mallory has associated with this actor across public reporting.
14 additional families tracked in Mallory.
16 CVEs Mallory has associated with this actor across public reporting. 16 of them are exploited in the wild (not necessarily by this actor).
10 more CVEs tied to this actor tracked in Mallory.
308 indicators attributed to this actor. Values are masked here and available in full in Mallory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.