Loading story…
Researchers tied multiple advanced espionage operations to the long-running DarkHotel cluster, including the Ramsay malware framework built to collect and exfiltrate sensitive documents from air-gapped networks. ESET reported that Ramsay spreads through malicious documents exploiting CVE-2017-0199 and CVE-2017-11882, as well as trojanized installers, then uses persistence techniques such as Phantom DLL Hijacking and propagates via removable and network drives by infecting PE files. The toolkit uses decentralized, file-based command and exfiltration methods, hides stolen data inside Word documents, and shares notable code and operational overlaps with DarkHotel’s Retro backdoor.
Separate analysis of Operation WizardOpium detailed a watering-hole attack on a North Korea-related news site that chained the Chrome RCE CVE-2019-13720 with the Windows privilege-escalation flaw CVE-2019-1458 to escape the browser sandbox and run malware on victim systems. A broader retrospective described DarkHotel as a Korean-speaking espionage group active since 2007 that has targeted governments, businesses, and travelers using hotel Wi‑Fi compromises, spear-phishing, stolen certificates, and repeated zero-day exploitation, including CVE-2018-8174, CVE-2018-8373, CVE-2020-0674, and SRC-2020-281, with activity concentrated on China, Japan, North Korea, and South Korea.
TTPs, infrastructure, and targeting history in one profile.
10 events from the most recent confirmed update back to the earliest known activity.
ESET researchers disclosed the Ramsay framework as a cyber-espionage toolkit for collecting and exfiltrating sensitive documents from air-gapped networks, and published indicators of compromise and ATT&CK mappings.
In October 2019, attackers carried out a watering-hole attack on a North Korea-related news site, chaining Chrome zero-day CVE-2019-13720 with Windows privilege-escalation zero-day CVE-2019-1458.
ESET's analysis indicates the Ramsay cyber-espionage toolkit had been active since late 2019 and was under active development.
In May 2018, DarkHotel was reported as responsible for distributing an exploit for CVE-2018-8174, using a URLMoniker technique to invoke Internet Explorer through Microsoft Word.
The group also leveraged the Internet Explorer vulnerability CVE-2018-8373 during 2018.
The retrospective states that DarkHotel likely exploited a leaked zero-day from Hacking Team in 2015.
Kaspersky published a report in 2014 detailing a DarkHotel cyber-espionage campaign that targeted business travelers in the Asia-Pacific region through compromised hotel networks.
The DarkHotel APT is described as having been active since 2007 as a long-running cyber-espionage group.
Microsoft patched the win32k privilege-escalation vulnerability CVE-2019-1458 after notification from researchers.
Google fixed CVE-2019-13720 in Chrome version 78.0.3904.87 after the vulnerability was exploited in the WizardOpium campaign.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 22 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
blog.bushidotoken.net
Open sourcesecurelist.com
Open sourcewelivesecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A suspected **DarkHotel** campaign targeted luxury hotels in Macao with spear-phishing emails carrying malicious Excel attachments disguised as inquiries from the Macao Government Tourism Office. Researchers said the operation hit management personnel at at least 17 hotels, including **Grand Coloane Resort** and **Wynn Palace**, and used macros, VBS, and PowerShell to collect system information and exfiltrate data to the command-and-control domain `fsm-gov.com`. The activity was assessed with only moderate confidence as DarkHotel-linked because infrastructure tied to the campaign had also appeared in unrelated criminal phishing activity. The intrusion relied on **Windows Scheduled Tasks** to maintain persistence and repeatedly execute payloads, including tasks created through a **COM object** rather than only via `schtasks.exe`, a method that can evade detections focused on command-line task creation. Hunting guidance highlighted suspicious Office behavior such as Excel loading `taskschd.dll` and `wshom.ocx`, short-lived tasks running every five minutes, and task names like `MicrosoftOneDriveMgmt` and `MicrosoftOneDriveSync`. Defenders were advised to monitor scheduled task creation logs, image-load telemetry, and task executions from user-writable paths, and to use Microsoft Defender for Endpoint **Attack Surface Reduction** rules to block or audit Office applications creating executable content.
Aug 15, 2026
Researchers detailed multiple China-aligned intrusion sets using modular tooling to compromise targets across Windows, web, and mobile environments. ESET said **TheWizards** used a tool called **Spellbinder** to abuse IPv6 `SLAAC` by sending rogue `ICMPv6 Router Advertisements`, positioning the attackers as the default gateway for adversary-in-the-middle operations. The group then intercepted DNS requests for Chinese software vendors and redirected update traffic so legitimate applications such as **Tencent QQ** and previously **Sogou Pinyin** fetched malicious payloads instead of real updates. The resulting infection chain used a downloader DLL, an encrypted blob, and in-memory loading of the **WizardNet** backdoor, which patched `AMSI` and `ETW`, supported modular execution, and injected shellcode into other processes while maintaining encrypted command-and-control. Separate reporting described broader China-linked operations using flexible malware delivery and post-compromise frameworks. Trend Micro tied **Earth Minotaur** to the **MOONSHINE Exploit Kit** and the **DarkNimbus** Android backdoor, while TrendAI documented **PeckBirdy**, a JScript-based framework used since 2023 across browsers, `MSHTA`, `WScript`, Classic ASP, Node.js, and `.NET ScriptControl` for watering-hole attacks, credential theft, lateral movement, reverse shells, and persistent backdoor access. PeckBirdy was observed in campaigns against Chinese gambling sites, Asian government entities, and private organizations, alongside modular backdoors **HOLODONUT** and **MKDOOR**. The reporting also noted infrastructure and tooling overlaps linking some of these activities to **UNC3569**, **Earth Baxia**, and supplier **UPSEC**, underscoring an ecosystem of China-aligned operators reusing shared malware, hijacking infrastructure, and fake software-update lures.
Aug 21, 2026
Lazarus-linked operators exploited unpatched **VMware Horizon** servers vulnerable to **Log4Shell** (`CVE-2021-44228`) to compromise organizations, with reporting tying the activity to energy-sector victims in the United States, Canada, and Japan as well as broader targeting of Japanese entities. After initial access, the attackers deployed multiple backdoors and RATs including **VSingle**, **YamaBot**, **MagicRAT**, and **NukeSped**, then carried out hands-on-keyboard actions such as disabling security tools, creating unauthorized accounts, harvesting credentials, enumerating Active Directory, moving laterally with Windows administration utilities and Impacket, and exfiltrating selected files. Separate reporting also found the same exposed Horizon systems had been abused by other actors to install a Monero miner, underscoring how quickly internet-facing Log4Shell targets were reused. The malware set showed a mix of Windows and Linux capability and several methods for blending command-and-control into normal web traffic. **VSingle** supported remote command execution and file transfer, and newer Linux variants could fall back to **GitHub** to retrieve replacement C2 addresses when hard-coded servers failed, using repository content to locate attacker infrastructure. **YamaBot**, a Golang backdoor for both Windows and Linux, exchanged RC4- and Base64-protected data through HTTP cookies and could disguise larger exfiltration as BMP-like multipart content, while **NukeSped** provided modular espionage functions including shell access, file management, keylogging, screen capture, and tunneling. Researchers attributed the campaign to Lazarus based on malware overlaps, infrastructure links, and tradecraft consistent with prior North Korean espionage operations.
Aug 15, 2026