Darkhotel
DarkHotel is a threat actor also tracked as Tapaoux and associated in the provided content with aliases including Dubnium, Zigzag Hail, Shadow Crane, Purple Pygmy, Paladin, Nemim, Fallout Team, Templar, Tieonjoe, EgoBot, APT-C-06, and APT-C-60. The content describes it as a sophisticated, likely South Korea-linked nation-state actor; Microsoft maps Dark Hotel/Tapaoux to Zigzag Hail, and Kaspersky reported indications the group may have originated from South Korea. Kaspersky stated the group had been active since at least 2007. The actor is described as targeting high-profile executives, government agencies, NGOs, defense-related entities, and luxury hotel guests in Asia, with primary targeting in North Korea, Japan, and India, as well as the U.S. defense industrial base and important executives worldwide. A notable campaign involved compromising luxury hotel networks in Asia to deliver fake Adobe updates to selected guests, with malware staged on hotel servers before a target arrived and removed after departure. The content also states the group used a two-pronged approach consisting of broad peer-to-peer infections and more selective spearphishing and hotel-based operations. Observed tradecraft in the provided content includes spearphishing emails with malicious RAR and .LNK attachments; malware disguised as a Secure Shell (SSH) tool; persistence via Windows Run Registry keys; dropping an mspaint.lnk shortcut that launches a shell script to download and execute a file; collection of running processes; collection of hostname, OS version, service pack version, processor architecture, IP address, and network adapter information; use of forged or stolen code-signing certificates to sign malware, backdoors, and downloaders; obfuscation using RC4, XOR, and RSA; just-in-time string decryption to evade sandbox detection; and process and memory injection behavior including WriteProcessMemory and Process32NextW noted in sandbox analysis. Kaspersky also reported use of zero-day exploits in spearphishing, a kernel-mode keystroke logger, and signed malware made to appear legitimate. The content further states that the NSA Territorial Dispute research mapped Sig25 to Dark Hotel/Tapaoux and suggests the NSA may have tracked DarkHotel tools in 2011, before broader public discovery.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Government & Administration
- Non-Governmental Organizations
- Military
Where they target
Geographies tied to known operations.
- 🇰🇵 North Korea
- 🇯🇵 Japan
- 🇮🇳 India
- 🇺🇸 United States
Where they're from
Attributed origin per open-source reporting.
- KR
Tradecraft
43 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
7 malware families attributed to this actor across reporting.
2 additional families tracked in Mallory.
Associated vulnerabilities
5 CVEs this actor has used in observed campaigns. 5 of them exploited in the wild.
Darkhotel has exploited Adobe Flash vulnerability CVE-2015-8651 for execution.
This detection identifies instances where Windows Explorer.exe spawns PowerShell or cmd.exe processes, particularly focusing on executions initiated by LNK files. This behavior is associated with the ZDI-CAN-25373 Windows shortcut zero-day vulnerability, where specially crafted LNK files are used to trigger malicious code execution through cmd.exe or powershell.exe. This technique has been actively exploited by multiple APT groups in targeted attacks through both HTTP and SMB delivery methods.
May 2018: a new wave of targeted attacks abusing CVE-2018-8174 (this exploit has been associated with the DarkHotel APT group, as described on Securelist), with diplomatic, defense, manufacturing, military and government targets in Asia and Eastern Europe;
At the end of June 2020, the operators stepped up their game by using a vulnerability in Internet Explorer, CVE-2020-0968, which had been patched in April 2020. Instead of delivering an archive with a LNK file, the C&C server was delivering an RTF file that, once opened, downloaded an HTML file exploiting the aforementioned vulnerability.
Public reporting indicates the group exploited a remote code execution vulnerability in the Windows version of a productivity suite (CVE-2024-7262) to drop SpyGlace.
Observables
101 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as part of the era of sophisticated malware campaigns that received deep public technical analysis.
Exploited CVE-2019-1367 in the wild and was later linked to the 'Double Star' attacks using Internet Explorer and Firefox 0-days against targets connected to North Korea and Japanese infrastructure.
Listed as a threat actor associated with the malicious file execution technique detected by this analytic.
Listed as a threat actor associated with Windows Command Shell execution behavior relevant to this detection.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.