Darkhotel

DarkHotel is a long-running espionage threat actor active since at least the late 2000s and widely assessed to be linked to the Korean Peninsula. The group is best known for highly selective targeting of business executives, government officials, diplomats, defense-related personnel, and other high-value individuals, including through compromises of luxury hotel networks used to deliver malware to traveling targets. Over time, its targeting has expanded beyond hotel guests to include government agencies, research institutions, military and defense sectors, foreign trade organizations, and entities in Japan, China, India, Myanmar, North Korea, and parts of Europe. Commonly reported aliases include APT-C-60, Dubnium, Tapaoux, Shadow Crane, Paladin, Purple Pygmy, Fallout Team, Nemim, Templar, Tieonjoe, Zigzag Hail, and related naming variants such as Dark Hotel and Dark_Hotel. Some reporting also links DarkHotel with activity clusters tracked as APT-C-60, particularly campaigns targeting organizations in Japan and deploying the SpyGlace backdoor. DarkHotel is associated with spear-phishing, malicious archives, shortcut-file execution chains, DLL side-loading, staged downloaders, abuse of legitimate cloud and developer services, and selective use of signed or trusted binaries to blend into normal activity. Recent operations attributed to APT-C-60 have used phishing emails to deliver archives containing malicious LNK files that invoke mshta.exe, execute embedded or downloaded scripts, abuse legitimate git.exe execution, and retrieve later-stage payloads from mainstream developer platforms and content delivery services before installing SpyGlace. The actor has also been observed using living-off-the-land techniques and ordinary Windows components to reduce detection opportunities. The group’s malware and tooling show a strong emphasis on modularity, stealth, and anti-analysis. Reported behaviors include discovery of running security products and anti-malware processes, collection of host and operating system details, collection of network adapter and IP information, process enumeration, file discovery, string and import decryption including RC4 use, and persistence through Registry Run keys. Other reporting describes more advanced frameworks using Microsoft-signed binaries for DLL side-loading, encrypted module loading, multi-stage process injection, local RPC for component separation, and distinct surveillance modules for capabilities such as keylogging, screen capture, and USB data theft. DarkHotel has historically been associated with forged or stolen code-signing certificates, kernel-mode keylogging, zero-day exploitation in some operations, and disciplined operational security, including selective victiming and temporary staging of malware infrastructure around target activity windows. Its tradecraft is consistent with a mature espionage actor focused on credential theft, surveillance, and long-term access to strategically valuable targets.