DarkHotel
Also known as DUBNIUM, Fallout Team, Karba, Luder, Nemim, Nemin, Tapaoux, Pioneer, Shadow Crane, APT-C-06, SIG25, TUNGSTEN BRIDGE, T-APT-02, G0012, ATK52, Zigzag Hail
Kaspersky described DarkHotel in a 2014 report as: '... DarkHotel drives its campaigns by spear-phishing targets with highly advanced Flash zero-day exploits that effectively evade the latest Windows and Adobe defenses, and yet they also imprecisely spread among large numbers of vague targets with peer-to-peer spreading tactics. Moreover, this crews most unusual characteristic is that for several years the Darkhotel APT has maintained a capability to use hotel networks to follow and hit selected targets as they travel around the world.'
Targets: Private sector, Japan, Russia, Taiwan, South Korea, China
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
ATT&CK techniques
Recent activity
No posts or advisories have named this actor recently.
References
- https://securelist.com/blog/research/71713/darkhotels-attacks-in-2015/
- https://blogs.technet.microsoft.com/mmpc/2016/06/09/reverse-engineering-dubnium-2
- https://securelist.com/blog/research/66779/the-darkhotel-apt/
- https://securelist.com/the-darkhotel-apt/66779/
- https://web.archive.org/web/20160104165148/http://drops.wooyun.org/tips/11726
- https://labs.bitdefender.com/wp-content/uploads/downloads/inexsmar-an-unusual-darkhotel-campaign/
- https://www.cfr.org/interactive/cyber-operations/darkhotel
- https://www.securityweek.com/darkhotel-apt-uses-new-methods-target-politicians
- https://attack.mitre.org/groups/G0012/
- https://www.secureworks.com/research/threat-profiles/tungsten-bridge
- https://www.antiy.cn/research/notice&report/research_report/20200522.html
- https://attack.mitre.org/groups/G0012
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.